Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 14:01
Static task
static1
Behavioral task
behavioral1
Sample
2f77b7323cb44ebf1f9d04450d1aa631_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2f77b7323cb44ebf1f9d04450d1aa631_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2f77b7323cb44ebf1f9d04450d1aa631_JaffaCakes118.html
-
Size
164KB
-
MD5
2f77b7323cb44ebf1f9d04450d1aa631
-
SHA1
c8e979f209c76127269338f8da34c6587ccc6c6f
-
SHA256
add2652116ca52b8f366af4c6ab0331fdb2a8827fe96d3210542109dc9fc35ab
-
SHA512
4306b50872686084f0cd6629304bbbb01c7070494f17d55e365eb6b4c4321330fec5ab547cab6ed65d7d02e7c636cf5e1282f1eb71bfd448678bedeef7377492
-
SSDEEP
3072:Smjm7j0/TTyfkMY+BES09JXAnyrZalI+YQ:SmMQ/T2sMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 768 msedge.exe 768 msedge.exe 4352 msedge.exe 4352 msedge.exe 3468 msedge.exe 3468 msedge.exe 3468 msedge.exe 3468 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4352 msedge.exe 4352 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe 4352 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4352 wrote to memory of 5028 4352 msedge.exe 81 PID 4352 wrote to memory of 5028 4352 msedge.exe 81 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 932 4352 msedge.exe 82 PID 4352 wrote to memory of 768 4352 msedge.exe 83 PID 4352 wrote to memory of 768 4352 msedge.exe 83 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84 PID 4352 wrote to memory of 3676 4352 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f77b7323cb44ebf1f9d04450d1aa631_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb533746f8,0x7ffb53374708,0x7ffb533747182⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15987199648108872056,15444185749941454269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15987199648108872056,15444185749941454269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15987199648108872056,15444185749941454269,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:82⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15987199648108872056,15444185749941454269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15987199648108872056,15444185749941454269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15987199648108872056,15444185749941454269,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3468
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3192
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
Filesize
6KB
MD5fe16a9c158cfbe17a41903d4804e5587
SHA1a0711e71c8f20f9375393c151a90177fc4998b0b
SHA2563f4f6ec42855565cabba2c7dfeb91671fc00f1311bdf51e5f57d98a43159f5f4
SHA512ab5a33658db23e567736a64bead8fdf9c30d78c1e6515489a07bb4a37b175233e3982ee5f5cd072aa4dc6d401b71f24c7ba5a40a6b0e31829a7dfa804fef89d9
-
Filesize
6KB
MD513bf7e4100a6a797e1337cb45c0f59d2
SHA1e59bf4780de08c98c43dd317ed27240c44a98a3b
SHA256c9bc5a1e304ef6452c2dcaa5364b85efbee977f8fb03b864dba78ccd9b3c3d0b
SHA512795eddf686c6bb326041693c8c253b4c5e118b969559ab0be76251e04b5653ae0fc073a7b5da5391b316ea69fa197d5003f3be6b37628d45407c471c83ae3fb3
-
Filesize
11KB
MD557f1b8dd2b58f808260f3960bcc57e55
SHA1f2d09f7d07bc0a26908e8fb6b98914c131e867cc
SHA256669fa385e0f7bbb25b57a28badb8843c40ad27dd2852874289eeec3f3a1b68e2
SHA51245f695e387d8352b760f2e16de9be0164a3d49cbab098daf1a22606f42df71276f6e30c85a4616b7a5190fc61b999881b888be6df35dcdc83e5e69e8128a368c