Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 12:39
Static task
static1
Behavioral task
behavioral1
Sample
24e095a091b4b33d61cb02583c4e3567_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
24e095a091b4b33d61cb02583c4e3567_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
24e095a091b4b33d61cb02583c4e3567_JaffaCakes118.html
-
Size
220KB
-
MD5
24e095a091b4b33d61cb02583c4e3567
-
SHA1
b32c62966e5e3a04287c52e24e2f362c84e19c60
-
SHA256
c5e0fbceea0f968c52e22e14e935e94db75f492035ff25137c4fc1389b536dd6
-
SHA512
730ce912e100f18ede4ff43ebd7d316486254ac64f1f4288b34f57a8a029b2e312529893ba44b095b6291a6161eb455b8bc89e791902f244add26871daf7ac9b
-
SSDEEP
3072:S3+vdsG46puIJyfkMY+BES09JXAnyrZalI+YQ:SuTG/sMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3736 msedge.exe 3736 msedge.exe 1524 msedge.exe 1524 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1524 msedge.exe 1524 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 1920 1524 msedge.exe 85 PID 1524 wrote to memory of 1920 1524 msedge.exe 85 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3372 1524 msedge.exe 86 PID 1524 wrote to memory of 3736 1524 msedge.exe 87 PID 1524 wrote to memory of 3736 1524 msedge.exe 87 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88 PID 1524 wrote to memory of 1808 1524 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\24e095a091b4b33d61cb02583c4e3567_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6d1046f8,0x7ffd6d104708,0x7ffd6d1047182⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9655994476354633374,9769891696957050012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9655994476354633374,9769891696957050012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,9655994476354633374,9769891696957050012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:1808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9655994476354633374,9769891696957050012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9655994476354633374,9769891696957050012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9655994476354633374,9769891696957050012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4296
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3740
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
6KB
MD561068ab7bbf5a97f01249852e9778e2e
SHA1865e29adafb1e458e60e405c4d4082e1592f5880
SHA25634d08ddf32f8b8995041a07afb793ab10a22e4b0163e291b07016ff49c7d5eff
SHA512abfde31ec1c015574c22369168d013fdc854ee7e776849af6f9906e7be25c78e1863a09c5d2d6f7c739efe08931d9c036a880351d11a4a2de0d0307f3b34d8e1
-
Filesize
6KB
MD5e1417b322dc7f08ac5654a90ccb89395
SHA1c15fbd75daf8d01169d7b863071da346445faa4f
SHA256faf318d2067e7390cc1122c05d3a499ddaec7dd9cc49a730b2570133088e28b7
SHA5125b2235f080d960e3f200484895b1b52196b26905d79fb44aced8f60ba0e35a103fff6ec4930c29e86e06eef4bd97d05efeb5d8c0bb29444914bc5d918312ec3f
-
Filesize
11KB
MD5afc5fd8043e274c3fe96552a20192bfd
SHA1c584dd6a3b9486bcb16c7e52a0a778029bed3811
SHA2563ab6b40938ea814abf79ab8b216c0b8e971a96693f408b8d4c427143ac239daf
SHA512e1e4a9b94f58981867ea9fe5f75e7d42d74f66dcea549f0907f20353ed6611462110364d4195b9cdfab498755ef757a58922f19f7c8f524a25348235ebc45b21