Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2025, 10:20
Behavioral task
behavioral1
Sample
JaffaCakes118_5d5540921b9c5092da5e135bb60db9b1.html
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_5d5540921b9c5092da5e135bb60db9b1.html
-
Size
19KB
-
MD5
5d5540921b9c5092da5e135bb60db9b1
-
SHA1
189eef83501d287d53fdb1a024534f629d7eafcb
-
SHA256
2c57c67a16a6b351e7b72745c10060846c3c16d5eb0646cf96b4cec889bd1783
-
SHA512
f814ccbe0355bd39a002fc1eac016195068d0cc04fe5c99c6ea7bd0dbe17605a93c4ed72435f32ea7020b4a58959086e1ceeb4e7cccc2c8095ae48187f83fb61
-
SSDEEP
384:zBqtZRsVuEc+6bkuOENb5Cul0LgIssbQbDwiTkBFV1aG/a1B7rl99Ye/ZGr1h:ItZRsV2+6bkPENbgJZYDN4n+Gy1Jl3Y/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1844 msedge.exe 1844 msedge.exe 1260 msedge.exe 1260 msedge.exe 3264 identity_helper.exe 3264 identity_helper.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe 1260 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1260 wrote to memory of 3108 1260 msedge.exe 83 PID 1260 wrote to memory of 3108 1260 msedge.exe 83 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 3280 1260 msedge.exe 84 PID 1260 wrote to memory of 1844 1260 msedge.exe 85 PID 1260 wrote to memory of 1844 1260 msedge.exe 85 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86 PID 1260 wrote to memory of 4280 1260 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d5540921b9c5092da5e135bb60db9b1.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6cca46f8,0x7ffc6cca4708,0x7ffc6cca47182⤵PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:3280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:82⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:12⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:12⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,14067581630055361319,17520373394673695685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4684 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3000
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
523B
MD523e4aedf1965c1b290fe3a832232efd8
SHA19df17fcb6f7135b2b5ccbd596ec1d3555114394d
SHA256ccdf19a341f2dc7c3444a1dfcbab0aa5fbe7a7e211f66cd6300d2f8d83351702
SHA51296c2710520e86eb5110f5d0f1fe8049a9d490d58604a5292f2f4287c56b849c4c3178f57a0e29cb0b91b85058447b04fd0c02d682c1bccb91b0fc55b405cfec9
-
Filesize
5KB
MD5b6a73075d352914524966971c883c8a5
SHA1650a4006e9c5e56ed64b9e25476949b4384542fa
SHA256f5de5d757dbad40055e7b945770ee94fae0579e0511540623c5c805b2470c913
SHA512ce8a15354200ff450fefd7654952542801e5b61182e009ef40f8ac316ee9020d3b5b383c77a197caa20cd83d1d15a9a3d3859566c626ed398d552e1abb91b7f8
-
Filesize
6KB
MD53e4b57a317484fd21fbdf268e341d78d
SHA13554713c653aa50495b4f29eb5d065f408d5c571
SHA256f95a9d5c5b7e0d99edccde93502767b9417ca50517a65f2ec3721f856df5cb0c
SHA512cc906398beaef9b5979cfb35f9dc8f001f46244f36357f059d6d1705a1a4efef4819689696ccea4e1962633674ac86feee2041600bc81c3625a4a91a474a826e
-
Filesize
6KB
MD5fc6eb586452a3f53b75fe3af4f4d5f9b
SHA1f20235df6c08ae34f6cff3d304ea4c375daf723f
SHA256e21a30565eff405f8a611e89ae57c96532d80d77b0cdd64d1c8e24a753e91ee4
SHA512ba0ddb98e3c6eff4dc8cfbc517f52634120c8e399de00b95068a354b2c9f85dd36a9f35d05175dca389ad436e814039701115cd61b109fe41dd409b70017af62
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a32a101d-00f7-45a5-b11d-87ae49071a73.tmp
Filesize602B
MD58bd2866bdc7aa99c28b3024e4e99b1e1
SHA13910151f2bd9c4c3b395135db29b5ec850742640
SHA256a61e406fb3a850b2be0487afd4d48ba146d700a3dff01294158b85bbe23c71da
SHA5126295fe3b1f0997310d520ad9b5c54a50ad534f445512ca9797547f5013dc72a740995e3973db615336f2587b07448d8dbfa171755de56eab5ba421c4db4f6723
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5b5a0d6ee3da124cd412944e9b0384e6f
SHA1dfbdcfcd2d8f4dd057e54ae085733f5a9b00fa6b
SHA25656d8e6df04eece91339e289973f993edb276499d21b342634e191508568e39a5
SHA512d6ce0db12e60bb8932bc3d69c24604fcd2db4bfd4518fe67bdf4830921ecf24a530cc9e4a03dc8fc3f78367dc33ac4ff40fa9f004ea683737116097664b2f540