Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 13:38
Static task
static1
Behavioral task
behavioral1
Sample
4294e47b367c86a2fb12b05def14d8aa_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
4294e47b367c86a2fb12b05def14d8aa_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
4294e47b367c86a2fb12b05def14d8aa_JaffaCakes118.html
-
Size
27KB
-
MD5
4294e47b367c86a2fb12b05def14d8aa
-
SHA1
7db1548443fc8643e324b3801960fc91301de192
-
SHA256
d1c190f22772627ed8dc5c6162ff21d01dcd4855a4f1da427c387f91a5a9d9aa
-
SHA512
01444fd5234f1517e6b50926180cba5b03b16951b4f6bdddebe2b2cd8edd1f49e106d5f14da261cefa55b16d917f8445acf8b9c23427fc8d88cfc38d3eaa97d0
-
SSDEEP
768:Dqkrf23hMnaU+2Jo2Ydi7vkpursPFaCDFW+4/Pgej3jv+w2PCrwprldvw+vLhj2b:Dqkrf23hMnaU+2Jo2Ydi7vkpursPFaCU
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4148 msedge.exe 4148 msedge.exe 4524 msedge.exe 4524 msedge.exe 1540 identity_helper.exe 1540 identity_helper.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4524 wrote to memory of 2104 4524 msedge.exe 85 PID 4524 wrote to memory of 2104 4524 msedge.exe 85 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 2980 4524 msedge.exe 86 PID 4524 wrote to memory of 4148 4524 msedge.exe 87 PID 4524 wrote to memory of 4148 4524 msedge.exe 87 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88 PID 4524 wrote to memory of 2608 4524 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4294e47b367c86a2fb12b05def14d8aa_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfcd946f8,0x7ffcfcd94708,0x7ffcfcd947182⤵PID:2104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:22⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:82⤵PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵PID:3796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:12⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,15239938951133176263,5775025137012433301,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3996
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2532
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56960857d16aadfa79d36df8ebbf0e423
SHA1e1db43bd478274366621a8c6497e270d46c6ed4f
SHA256f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
SHA5126deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
-
Filesize
152B
MD5f426165d1e5f7df1b7a3758c306cd4ae
SHA159ef728fbbb5c4197600f61daec48556fec651c1
SHA256b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
SHA5128d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75675170-25cf-4e81-90e4-a4577d646a0a.tmp
Filesize6KB
MD59b1ca98672cee1ec58aea2ed4252cab8
SHA1c9de1aaa2b5a5cd85104cfd39ffd4a8ae73f2147
SHA256c4f5cd5827352d8052da2da5a7fd822e21a7c9e0e866102ac96dbec5f969e6dc
SHA51236933f7c713e46c66fdb8d3025062ee1e0d1687a4f459705598dc9332f455679eca295d5635143dfaca373de9d7ecf6609181534637cea12fa7cad51c0e499db
-
Filesize
6KB
MD59d591a95f1ae0e5e9f211420eee3a353
SHA1d152e9fa318fba0773e37fff8b897e6a20c26e6c
SHA2561634492c3d3fad6ab2256b092e3a1e9c631d2bf55bafd18c7257a08dcaaee37c
SHA51247859e1e3a00ef66dacd9e15bc96056aa469b5fcbd53813147435be90e7205a90a497cb76c3eaf9922bda83060d96a7be92ab5d6d6b38c96c3cbed65e6697903
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD592fde61046786897fbcc4340e93633d6
SHA1ed2e3f69535cd007737e2fe3f972460b140765f8
SHA2566ce19e73986f16889c3b66babb56ba9297c00909fdb7607c44b176155db05eba
SHA5127ef9264ec47bb56f29c156a0cccc63c91c3babbab212276fcbe2c454ea813b4c466aba8f6f4ae3f265bc7ef443c0c687f390edea2ca68896e4bb6dd41ef5c302