Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
3adae49826f870dad091ca692b3f221c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3adae49826f870dad091ca692b3f221c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3adae49826f870dad091ca692b3f221c_JaffaCakes118.html
-
Size
19KB
-
MD5
3adae49826f870dad091ca692b3f221c
-
SHA1
96ac39e7016cadaecaa4e72aa2ca25765a3ddb8d
-
SHA256
a47798e23dc3f7e7253db4287a6edcb5b54843cdc822ac10b5de51b556e421c6
-
SHA512
bba15423a589f6d9e4cee57f8b2e6e5745de2ef94658f1044375d352202369ffc22105790a04c05f2a8d51f34f39b0af5e0837418c9fe06d5e75e42f03d52857
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAId4xzUnjBhTV82qDB8:SIMd0I5nO9H1svTuxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4792 msedge.exe 4792 msedge.exe 1908 msedge.exe 1908 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe 2316 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1908 msedge.exe 1908 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1604 1908 msedge.exe 84 PID 1908 wrote to memory of 1604 1908 msedge.exe 84 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 2884 1908 msedge.exe 85 PID 1908 wrote to memory of 4792 1908 msedge.exe 86 PID 1908 wrote to memory of 4792 1908 msedge.exe 86 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87 PID 1908 wrote to memory of 3036 1908 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3adae49826f870dad091ca692b3f221c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c93a46f8,0x7ff8c93a4708,0x7ff8c93a47182⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10724680165484163631,13211654510024449542,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,10724680165484163631,13211654510024449542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,10724680165484163631,13211654510024449542,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:82⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10724680165484163631,13211654510024449542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10724680165484163631,13211654510024449542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10724680165484163631,13211654510024449542,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2316
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4292
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2cc38440-e985-49d7-b26e-892c72481a80.tmp
Filesize6KB
MD5ec4bc06963d66c597b0557ea4eeca270
SHA1a43795634e8aa49f5291f691eae33637888e2fe0
SHA2561d16dd3f59172a891619938da1593638641ef092d38a8146331901f0d05c1274
SHA512ed0a75dd353f745b7641955a3f632fb9f6b0978b7b257c8beff5d80170b3aa19542e480a25bbc02bbf835cc3bf61a59784f580b3e393a9485ea50ae2a25f4ea0
-
Filesize
5KB
MD554cafee0a8cb28092d8c5ee85501e413
SHA15b6477459f849726e88fc142d5bd1b19d7aa41be
SHA2568e23306475ddb2fed1acd123b58029c8c9171fa191f15daf57d44349f13a61ad
SHA51249516dbea9ca8051d35d3f012e0b5515e0ee7e87b9ce423d672f91128d7856583b01509170ad7e2945cff1c7af1256c2c8f3d8668241f83fc8b4e821daaafd55
-
Filesize
6KB
MD56315b6f30a529571eb77325b89ff7202
SHA151274787008bbf208c29784435ed5cde5c2331da
SHA256295484b3c0f4084e0aebced9da442746fb5ae34b9ce4bbafe47b09ddae2304c5
SHA51289b54bf8cce6430a0ed09fb3b6ed44d27e125641073d6f5466f3a7cea7270711f37a26246448e8d6c128a836e87defab121ac13e3a4a497fcec7a6e25adc7556
-
Filesize
11KB
MD57925f25241efe3412d118d6917cd4103
SHA105f7aac1251ad589a68240a3d55de70cdb64d736
SHA256ee083536a1657dd4892bf49294378100d975e39ad36079a25445a658dee56efd
SHA512c452d3c06453ebe0629347982c6af9d62d782d449c7910edffb395babad6cf917fd7f653d14c2e8e2116809e212a8d4efeae74fe7ecd896df27a48e70cce24b5