Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 09:55
Static task
static1
Behavioral task
behavioral1
Sample
2f1048bd960d9a32723586f35e99a92f_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2f1048bd960d9a32723586f35e99a92f_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
2f1048bd960d9a32723586f35e99a92f_JaffaCakes118.html
-
Size
64KB
-
MD5
2f1048bd960d9a32723586f35e99a92f
-
SHA1
bc038cb17ffc223bdf87fec7076fbba2ea4ea4c0
-
SHA256
9acaa54cc29f352c6b1040e07b065cd99f254ede5bc5444a7177abc3bbc9fa7f
-
SHA512
a00bc18a0bc7231f5c52d08df5d454d428e17c1a6cd942ba06774fe01f68e7613f053014625bd23cc7a383d16f0ffac51b8310498596da17f9f0ce0bfed903ba
-
SSDEEP
192:ULVD5GMMmP9BzZdKy7pFHwpW8dPezZI2v7O7LSw3PMhVn6PvRTnCV2fQLkFO82:HOPLzvZZ8dmzdwf3Ck4t82
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4024 msedge.exe 4024 msedge.exe 4560 msedge.exe 4560 msedge.exe 752 identity_helper.exe 752 identity_helper.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4560 wrote to memory of 1304 4560 msedge.exe 83 PID 4560 wrote to memory of 1304 4560 msedge.exe 83 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 1560 4560 msedge.exe 85 PID 4560 wrote to memory of 4024 4560 msedge.exe 86 PID 4560 wrote to memory of 4024 4560 msedge.exe 86 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87 PID 4560 wrote to memory of 4796 4560 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f1048bd960d9a32723586f35e99a92f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82e6446f8,0x7ff82e644708,0x7ff82e6447182⤵PID:1304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:82⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:82⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:12⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:12⤵PID:912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4649884941369761733,9323462075302448479,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4868
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5060
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7cb450b1315c63b1d5d89d98ba22da5
SHA1694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA25638355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
-
Filesize
152B
MD537f660dd4b6ddf23bc37f5c823d1c33a
SHA11c35538aa307a3e09d15519df6ace99674ae428b
SHA2564e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD5450cb8a3f70f4ac2653bf7430e15dbd8
SHA1cd1568962e287c04aa0a0a468f31a95087b70c76
SHA2560b74cef3057484ee4120fd8fe4e98992c3b5d9b78c5a67bbf8794a51b83f1fad
SHA5122ea2ce59cc71105acf32a491ea076b256e6984abb3fd2ecdb41d2dd7cee27e98e36b09dddf819cf17b52185d12faf230b514af84bb0c33170202b9a14fe70a4e
-
Filesize
6KB
MD577f2863e81512afd497c65bfea82fb56
SHA18aa533aab16f0f70fe945fde083929e03fd13e45
SHA25678af0dd134de3fa37e302d72603fb269faad776f230ebb2b372cec4564670583
SHA512a2019c9907dd70a6b0667162e6f1d0ca9002885970bce27f49a2905d0ee33bd2c06521d15796e71e7b6ed3e933f8cfabf1741f17cf5c0f32e62d41b134f38acf
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD589acdca3772be5b38fd00746de9661d9
SHA102244e398dae292e3a27977a65f0b4723bd12dbc
SHA2565c3b7b68c3c851850913b0b55b5d981f04f00d875c4ca61a6217a8ea33a632d8
SHA512d280fffc0701c4a34e4399f5a49d53f95d031c45663127918fe0fdc82c714d108e073dc387f918e62e94ed65f1890ebf4eb6aaa5a2f6b70144d65d0a12225a1b