Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
41ee0acf18b3ee92c174e8415dc75bf9_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
41ee0acf18b3ee92c174e8415dc75bf9_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
41ee0acf18b3ee92c174e8415dc75bf9_JaffaCakes118.html
-
Size
43KB
-
MD5
41ee0acf18b3ee92c174e8415dc75bf9
-
SHA1
f13659a32d043a25ac01567a43441c053aedeb6f
-
SHA256
2389a0fea6ecfb180bd87a3a566ad12287024565271870f3b026cc4ef42a65c4
-
SHA512
998a49c8cd3fa4bec4a9de5805f4cf02c26585d32065b730d1324635307b6485d45bfa95986b157b04f822d002260c4df05ad6c9e51263598d0458aa8eb3010f
-
SSDEEP
384:uujTpDt5QpFORiptMTzpFampS/BJuuqoTWhDKXlaRXSs26TXyTVnoTdiVVdE2NeL:uM9t5XRNOKlwymT6LwoZNALIN
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2732 msedge.exe 2732 msedge.exe 3980 msedge.exe 3980 msedge.exe 3088 identity_helper.exe 3088 identity_helper.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 2232 3980 msedge.exe 83 PID 3980 wrote to memory of 2232 3980 msedge.exe 83 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2856 3980 msedge.exe 84 PID 3980 wrote to memory of 2732 3980 msedge.exe 85 PID 3980 wrote to memory of 2732 3980 msedge.exe 85 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86 PID 3980 wrote to memory of 4180 3980 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\41ee0acf18b3ee92c174e8415dc75bf9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef9cb46f8,0x7ffef9cb4708,0x7ffef9cb47182⤵PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2316 /prefetch:22⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:82⤵PID:2460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:12⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:12⤵PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:12⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2304,7466672099257508301,16478992025600670552,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3768
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:664
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556a4f78e21616a6e19da57228569489b
SHA121bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b
-
Filesize
152B
MD5e443ee4336fcf13c698b8ab5f3c173d0
SHA19bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA25679e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd
-
Filesize
6KB
MD557dfc683366bbf9199790bbd2e72f6cd
SHA1a5ba0c4bbaaab680e354d22da563a0c2780ba480
SHA256b7826fb2b13e05038080f338d33c88e329152fa4d18943a38d0a3f9a3b93e1e0
SHA512f616fdf3d5c4468376cebedc57db47cc5412be1e6a80d52428b9d9d6cd9d6fab18790b7cff2cec4cb1157d7e9e5300141bb4f74f50d0de90badc3666a59fcc43
-
Filesize
6KB
MD56cbf0e18cbf9480c4dc433b6906791f4
SHA1ed19dce84a2ca115be849bd6b9a7aa583ff98c32
SHA256d84c7b40ef9696182f500bc742857317ed4e6fabeabd17b51d8c1e9553268b84
SHA512f03837d6c8308ce81a56823b7502cff301643c1d4077f18cb99c31c04f8386e9a38133ac67fa8e27c8645318ad556e8612ef1718f016a558d474bb05b664d3e2
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5a8edf9714981fb36290fb1710ffa7194
SHA1ae79ae4e03f4022dc7e85bd494e567694c0a1c4b
SHA25611a6913b57be9ec8466d7311314fb723054ae8d7d7246890e218c9fbf066be7c
SHA512ce169bc90813bef65b2bd879036431a8d25fff40ba8c53f02ee23e31389ef384c1980f0d63d6fb3433dcf92e7cab794096b02a9a87986945292894cb404db581