Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
8b29c6503bd35e9a55985946acc57b1f_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8b29c6503bd35e9a55985946acc57b1f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8b29c6503bd35e9a55985946acc57b1f_JaffaCakes118.html
-
Size
213KB
-
MD5
8b29c6503bd35e9a55985946acc57b1f
-
SHA1
de6e577977aa106e9e5e2325d69967736310c930
-
SHA256
b89bd50bca8b2251ca9b2c37fe2f9620948be70741ca9431f49e9757cd9679e9
-
SHA512
6c0912f61d2ef4fcb326c70bf2dca7c8d4f8e8ef3a4f8e96a1887e33b2aacc44118b3691d4876e74f9bb850ee0165586ca78e9e0101b95f156ffc99f63ceaf4e
-
SSDEEP
3072:SbvdMf0D3pjqbyfkMY+BES09JXAnyrZalI+YQ:Sbc1+sMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4376 msedge.exe 4376 msedge.exe 3336 msedge.exe 3336 msedge.exe 3336 msedge.exe 3336 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4376 msedge.exe 4376 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4376 wrote to memory of 1952 4376 msedge.exe 83 PID 4376 wrote to memory of 1952 4376 msedge.exe 83 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 2676 4376 msedge.exe 84 PID 4376 wrote to memory of 4864 4376 msedge.exe 85 PID 4376 wrote to memory of 4864 4376 msedge.exe 85 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86 PID 4376 wrote to memory of 3560 4376 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b29c6503bd35e9a55985946acc57b1f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9272c46f8,0x7ff9272c4708,0x7ff9272c47182⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17796217109373541320,3417167277476193755,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 /prefetch:22⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,17796217109373541320,3417167277476193755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,17796217109373541320,3417167277476193755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17796217109373541320,3417167277476193755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17796217109373541320,3417167277476193755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17796217109373541320,3417167277476193755,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4996 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3336
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3924
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD581af2267d87fef08228b07e305a58a84
SHA1bfdab569520f7635211d54528c0341f73fec9e9a
SHA2565619676654621cf661ed1ca43eb25665f8c04c8f1f7aa41968d6ddbe38c79b55
SHA5128cc43012ee35992622bf5df4cb1d206a3fa766208e94583688b1b1e9f0cf313b833909e744214735759c52e24206db9445ec53952e15031b6ee2bdf842ff1c7c
-
Filesize
6KB
MD58c030a1eb3d1d8bdc94b88b6243ad426
SHA16d16d9230169247229de12b7af23af0285be9375
SHA256d3a2c04f4219598d1212072d89cc781670b8c5549563148ce6fa89c8e0e4c383
SHA512d7e8cc31b41e6c0c0b30cffaa413b3918607f6bd236fa9a13de993d149426aa9d3deeaee6d402c563eeb670100612223f0bf7dbbf171a1f8f99315dd9da1ad70
-
Filesize
11KB
MD52bfe42c02e1ae9819379a9e7803afc64
SHA1930642693224bed056084f1c4f51aec68d490048
SHA2562ea0d67cd8d0264e6b3405a7b65808f1cd3c3f058d2ca37a44864499bc102b08
SHA5129134a2885370303efaf4bea386b82e520714298247c086ff838a3ebbba23841a2f67166fb5d431f236e1b74f638395f9def09824e457e0ce61a628c3a5d7ae5b