Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 00:32
Static task
static1
Behavioral task
behavioral1
Sample
547b2bff6250f6aa14385a582c95fe5b_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
547b2bff6250f6aa14385a582c95fe5b_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
547b2bff6250f6aa14385a582c95fe5b_JaffaCakes118.html
-
Size
30KB
-
MD5
547b2bff6250f6aa14385a582c95fe5b
-
SHA1
ac7fabc53e5a8f9ea5cf36263a47c3bd4d9d54d4
-
SHA256
a01c5c6381550d2f29d41360d742ec246f02f6dad002b5e1f8c25244f8465180
-
SHA512
bf159d82bd9e74ca877ca61d026f437464f7cf20ab9e1796734f343dfbda38c4e1c36c029f5d9ebc949cfdacc4a387e51219e58442329bfc28acecca5e18a503
-
SSDEEP
192:uwfsb5neynQjxn5Q/cnQienNn1nQOkEntwOnQTbnNnQmS+xtX2Iov2Mh1C6KcdRx:lQ/2txtX2PX6KCVXq
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2496 msedge.exe 2496 msedge.exe 4152 msedge.exe 4152 msedge.exe 4052 identity_helper.exe 4052 identity_helper.exe 4216 msedge.exe 4216 msedge.exe 4216 msedge.exe 4216 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4152 wrote to memory of 3008 4152 msedge.exe 86 PID 4152 wrote to memory of 3008 4152 msedge.exe 86 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 4208 4152 msedge.exe 87 PID 4152 wrote to memory of 2496 4152 msedge.exe 88 PID 4152 wrote to memory of 2496 4152 msedge.exe 88 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89 PID 4152 wrote to memory of 5040 4152 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\547b2bff6250f6aa14385a582c95fe5b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff984a646f8,0x7ff984a64708,0x7ff984a647182⤵PID:3008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵PID:4208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:82⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:12⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,6849685286177974764,6405678055099795148,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1308 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4216
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2812
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7cb450b1315c63b1d5d89d98ba22da5
SHA1694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA25638355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
-
Filesize
152B
MD537f660dd4b6ddf23bc37f5c823d1c33a
SHA11c35538aa307a3e09d15519df6ace99674ae428b
SHA2564e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
-
Filesize
5KB
MD50af5b2c0077305736f2ac1de8a8690e5
SHA1a42874c1b4e30a977819eeed438f59a5d3b9af5e
SHA25667d1e68d1a2dd20af1eccc4ebdfeb8b6556d4e496b35729bb06bda7d4d549e87
SHA512a3932a2d533c5a7ba11bf668e3dde8e7ef28458f4ae17b0a42d612a3e032d5f8f8537f7ead9088ade71ee8a729570acb2d66763feaa2a3774f498625188db2e4
-
Filesize
6KB
MD57ff3a8cba59ff54497685fc32c00827e
SHA1b376db70c0b016cfcfbe51d94a5dccae4cd96953
SHA25652721ae7d7d102cd402413d9a3ef60fd5908237f50281d5b7337718373b298e1
SHA512d30f42680971e01f258d53ca658c4ae33aaa8659e31aca1624668b719c42a8c8ff21a1e3c38a9929974630efa2b94bcc567fa694b1db05fb3c54dbff45edf333
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ebf461b7fcd08b9b54e1912166bd7e52
SHA194b43fa5f6275a435ea4bf5c9ff753777015b3aa
SHA256d80f4a72110a969c6dcebfa775beebab9d09a85205fb33503de9b92c213f954c
SHA512f7c6eb72baf452989a202b1b6a7ae89885b7110dadcfac1067cb8b674c4a6de669d87951e6a4d26f27d99ccd6138fb4f59f118b368321e83c21bad4eddf758f9