Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 08:38
Static task
static1
Behavioral task
behavioral1
Sample
8667615028857f5ed41091b1853531af_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8667615028857f5ed41091b1853531af_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8667615028857f5ed41091b1853531af_JaffaCakes118.html
-
Size
220KB
-
MD5
8667615028857f5ed41091b1853531af
-
SHA1
2d7f3492e8abeb77a55af49abc31b013783c82e5
-
SHA256
c7766274668697e6d121ccc07dbb675bef61f058c1b8691bfd67fdb23b9152af
-
SHA512
77ae75e16acab58e140325455b8cc64848f1ce862a1e455e47e9c2cd4e5c3599a6f6a747eec33b965102bcd950f151c3211d8f2c71f3e1d09345c5e5476db8b1
-
SSDEEP
3072:SiyUMui6kVORyfkMY+BES09JXAnyrZalI+YQ:SipS9sMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4744 msedge.exe 4744 msedge.exe 3228 msedge.exe 3228 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3228 msedge.exe 3228 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe 3228 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3228 wrote to memory of 4376 3228 msedge.exe 83 PID 3228 wrote to memory of 4376 3228 msedge.exe 83 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4584 3228 msedge.exe 84 PID 3228 wrote to memory of 4744 3228 msedge.exe 85 PID 3228 wrote to memory of 4744 3228 msedge.exe 85 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86 PID 3228 wrote to memory of 4464 3228 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8667615028857f5ed41091b1853531af_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c93a46f8,0x7ff8c93a4708,0x7ff8c93a47182⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,1385119635056004867,11871436712525380589,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,1385119635056004867,11871436712525380589,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,1385119635056004867,11871436712525380589,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1385119635056004867,11871436712525380589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1385119635056004867,11871436712525380589,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,1385119635056004867,11871436712525380589,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5116 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1104
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
5KB
MD5c03200fe5fa20a5df18f1b88cec042a5
SHA17fbf75ebbcf61725d1164b56c1796a51260b7ce5
SHA2569028f62dd6a37fcb6a19b10941e397fe8008a9da7a14a920f67807c453c8714f
SHA512e5f44d639c36068f58009176e6c9577713b6f7a10a961637ed93c194732cd6d1e4dbd2a89d14adda2e7bb6571fb49ffba8a44fabf7906309b595f47ed72e42f4
-
Filesize
6KB
MD587a9f7c0796c9cc0bf84e87a53997747
SHA159ce0785bf5d4aaf6e0be90b49d975dd60709def
SHA2561bfc284c3415f279b4a75c7138a646df4dc726613035099b4252dee0533ff95e
SHA512730ec04e7fafcac84f19745ca9d046de770a84df45b2b9ea55dc5869323bd7a9bc4ca23c9dff0e9eb3158290ef85af13b103f6e0aa8aa96b177fe83daf1a5d91
-
Filesize
10KB
MD582cdb84fcefbe13c86e0f61dfdac5bba
SHA184414e33120b59684c809993414015685440a508
SHA256aa41341fef19f976a34a7e2dda8e6871259b8b0d46e2809b8ba9bfb962177c93
SHA512e19bce8eef9574e431ec048688ee986237f0c2459af1b1b21ec3edc70c40dfeef8595c263206147184074830e0bc605b247da2629eea4f0a9807e8fac0138563