Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 04:39
Static task
static1
Behavioral task
behavioral1
Sample
1184460dab9c98390d2206fe8a075861_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1184460dab9c98390d2206fe8a075861_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1184460dab9c98390d2206fe8a075861_JaffaCakes118.html
-
Size
213KB
-
MD5
1184460dab9c98390d2206fe8a075861
-
SHA1
8a29e36b8bac3c9a0ad44af8fde9ec304d0b26b0
-
SHA256
87e1bedf9a140402a802ee7ae1bf6bd8c30b73f50f57ca74e167d5eca1943431
-
SHA512
3499d7a30d65142ea6b237d2892125dbb42a47b09d8914aac05920f154a58060e14297806fd5a7c1c753821371ad0780519373ed093341abbb8104dccc4aae97
-
SSDEEP
3072:SHqBZkfe7IF0VutyfkMY+BES09JXAnyrZalI+YQ:SHoE4sMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1032 msedge.exe 1032 msedge.exe 428 msedge.exe 428 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 428 msedge.exe 428 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 428 wrote to memory of 4476 428 msedge.exe 83 PID 428 wrote to memory of 4476 428 msedge.exe 83 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 4856 428 msedge.exe 84 PID 428 wrote to memory of 1032 428 msedge.exe 85 PID 428 wrote to memory of 1032 428 msedge.exe 85 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86 PID 428 wrote to memory of 1348 428 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1184460dab9c98390d2206fe8a075861_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc28246f8,0x7ffbc2824708,0x7ffbc28247182⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14852545501336716378,2955150829689774234,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14852545501336716378,2955150829689774234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14852545501336716378,2955150829689774234,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14852545501336716378,2955150829689774234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14852545501336716378,2955150829689774234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14852545501336716378,2955150829689774234,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1072
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3024
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
Filesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
Filesize
6KB
MD52be244e498dfa4eb6461534ec088325f
SHA1bad734bc879956bc27097b6d64ac51b527ef7d9d
SHA256ad715a38e6815bc9fcb2fc321c096f61f8ae1d9291cdc502f92406e5e2e71f58
SHA5121ab11260e4be783bb69583348b6453129ec988f0ba0e4e7889d03cd548c7eff5b155827637a141ea52e28950d2c8106538011e477ddae2ff07bf20c4c04998db
-
Filesize
5KB
MD5a3b74b504f08fefafbcecc1546c9a775
SHA1984d57c6e112ace0ce75a5d8a1df4ffafd595604
SHA25612bc0048533646614930974333c961f51210ca64d72c55d9ae26de6aca8cc3cf
SHA5126b960549852d2ceb620e799e7b75affa0051eb31a0ff375b9ce2c097eb6fee0edf9509b11a18029f8741155b9374b2598719a2af4d1ae168cf989a44072d78fe
-
Filesize
11KB
MD540a37fd681d095cc8e850d094ee1e8fd
SHA190a4beb75d98901dce79e9792492b2f6ca018f9a
SHA2567276ff9c6cf67fb981975d67f8957bcd467806002c0b44818909f9918d724fd3
SHA512806f00f3c4e9836ee37c301762d29c87884a2bcd4e317d914557e2f61486b4513985deef75a055db1546bc5f47d983ea35fdaf061e3cbc7c1b06d8edec89251a