Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
172da6329b84b15078918078899e571a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
172da6329b84b15078918078899e571a_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
172da6329b84b15078918078899e571a_JaffaCakes118.html
-
Size
152KB
-
MD5
172da6329b84b15078918078899e571a
-
SHA1
5c5e56275173bbdb597376e20c92176a0d66219b
-
SHA256
651c1520f9eb62a2f1433b6b494d774fd891aa5c13a3161b89321e43c21d100f
-
SHA512
3068f5c014005b2c9dc27d75b9bfee38446189049f6914f545a8c927d16b01d69d30075c4406bd530780ae0eb8e1eaafdb356f9e7838a0a7ddab7d7953e119b8
-
SSDEEP
3072:SPkaqU06/yfkMY+BES09JXAnyrZalI+YQ:SPkaqU06KsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 3584 msedge.exe 3584 msedge.exe 1728 msedge.exe 1728 msedge.exe 1728 msedge.exe 1728 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3584 msedge.exe 3584 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3584 wrote to memory of 4420 3584 msedge.exe 84 PID 3584 wrote to memory of 4420 3584 msedge.exe 84 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4244 3584 msedge.exe 85 PID 3584 wrote to memory of 4864 3584 msedge.exe 86 PID 3584 wrote to memory of 4864 3584 msedge.exe 86 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87 PID 3584 wrote to memory of 4376 3584 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\172da6329b84b15078918078899e571a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff371b46f8,0x7fff371b4708,0x7fff371b47182⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4619572727361478711,4830902147317756414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:4244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,4619572727361478711,4830902147317756414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,4619572727361478711,4830902147317756414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:82⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4619572727361478711,4830902147317756414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4619572727361478711,4830902147317756414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4619572727361478711,4830902147317756414,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4752
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
Filesize
5KB
MD5b787050ba30a5d114a0117b025db2dc3
SHA143f2257da134f9b03cb77801630f774b10ee0927
SHA25676afbfb0601fffecfd5e4a0c1fda1b9a39e6079789a12ee55881dd01cead4c01
SHA512614716a76dc040519baf7d83ddb2e73c093cb3dcb6d757dcc8e800f0087ad9895afe72267d006690b46c1259acb4033fc25f94800a5d815a0e235148e41c6716
-
Filesize
6KB
MD57eb5456f225babdfed8d9b2cadd4eb03
SHA128860256178c0db8e7c8503ef4055253b0fef2b3
SHA25617c5972e46747bb91d0700e8255864c81515db2494aa99ebb060e1462d10b4d1
SHA5124db3baafceeec8e6685b5d9666cc040e897e93c8f3206d41ae3d48aabefffaac8921e40bbbc72aac8cb6c537356513b5f88fb4337b921183148677d728be2936
-
Filesize
11KB
MD59371d5b98dceb7465f5330dfe3712bc7
SHA1b3d599bf6e87c18ebd3f5887829ea51169713390
SHA25693372a20f8b2a1dca39b7e6da13439fe76841958a6601547cabcc65cd84dfc2e
SHA5127ace989ec223cd9e7fe531bd2f2f02a75740ff478bda5ac36a875cc12fd63fe749555297df38f30c26d4eeb21060d01c4a84afdd9274d7c550fb5c7c91a50f54