Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 19:03
Static task
static1
Behavioral task
behavioral1
Sample
08660682fbc0943ecb72d4ec2b26b5e4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
08660682fbc0943ecb72d4ec2b26b5e4_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
08660682fbc0943ecb72d4ec2b26b5e4_JaffaCakes118.html
-
Size
24KB
-
MD5
08660682fbc0943ecb72d4ec2b26b5e4
-
SHA1
5da2b27f73af7e2c8028eac7e7d2281e1844d405
-
SHA256
b6d4c2f6724863a335b16a0c7211d1a6245380eb89d8ed7309ab74baea296725
-
SHA512
021880fdc99eed85cb6e4a71d07a58d8857b35d19673723818bae53977f99635b9608055c5d45fab5408ff47a81aa28bcd2709327e3dab46e6ffe25d00907819
-
SSDEEP
192:WLZLwKQIUOCUdQ/uQe/lCpqBlTiB+pIuPi6brY5WafW8OhaEZ9LgV4MW1ThlCp+r:frU2/INE9u7Zek1TXEuFD
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5116 msedge.exe 5116 msedge.exe 4296 msedge.exe 4296 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4296 msedge.exe 4296 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4296 wrote to memory of 4328 4296 msedge.exe 85 PID 4296 wrote to memory of 4328 4296 msedge.exe 85 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 3900 4296 msedge.exe 86 PID 4296 wrote to memory of 5116 4296 msedge.exe 87 PID 4296 wrote to memory of 5116 4296 msedge.exe 87 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88 PID 4296 wrote to memory of 3496 4296 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\08660682fbc0943ecb72d4ec2b26b5e4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7fff7c4946f8,0x7fff7c494708,0x7fff7c4947182⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6770604141205455038,16484583852157958725,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:3900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6770604141205455038,16484583852157958725,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,6770604141205455038,16484583852157958725,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:82⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6770604141205455038,16484583852157958725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6770604141205455038,16484583852157958725,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6770604141205455038,16484583852157958725,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4652 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4064
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3516
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52a70f1bd4da893a67660d6432970788d
SHA1ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA256c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
SHA51226b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
-
Filesize
152B
MD5fbe1ce4d182aaffb80de94263be1dd35
SHA1bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA2560021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
SHA5123fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
-
Filesize
6KB
MD59be3d3bedfb5097e2cd4e8865d7aa597
SHA1fe880b376ef8344bed399dd1c064ff93eb4f6f45
SHA25634ebc0fcb2737503442146342e46357dc66a57cb678bc158c42fc9ce2b151b46
SHA512424d808e5ca4214e5d2be3c5a45bd1b311882bdfb19fda6abc1b02dfa41ed149c8a6b1efd7f21d43c434bab436f8071e2fb61dadcce9e65c6ae93a30a6ab8fd0
-
Filesize
8KB
MD5ea43de703db6c03094748862eb46ef6d
SHA17a558977d7137572c87cb080057ebc5adaed725d
SHA256e433f209a5146166ee882479608db7fc2ea0fd704b061c13bcf7376a6d195e69
SHA512f66e119030fd3994f0ed58bb7be3af054173dbbaab0c887b7880dcb667f7bb5c892ef010645d8e7105b71c7167e2996cb44cf867974e8c357ebc390c9d40f1de