Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 05:17
Static task
static1
Behavioral task
behavioral1
Sample
8d01094941b75f749ea7e77096f771f6_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
8d01094941b75f749ea7e77096f771f6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8d01094941b75f749ea7e77096f771f6_JaffaCakes118.html
-
Size
139KB
-
MD5
8d01094941b75f749ea7e77096f771f6
-
SHA1
6adb19d936cf1e440caa5b57822f27b765a85716
-
SHA256
72f68300b1a920676906910af2da54baefb8143c4debc8698323dcfe0121f46a
-
SHA512
074ecd5740eb0ae83cb384b8299f767dbe2abcb7c463ec9092cf29cbc7d3d1d9180729a5d1aaf98277792a388247154a0f748186753bc6957c942d590813c966
-
SSDEEP
1536:SaFUs7llMEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SaV70EyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3156 msedge.exe 3156 msedge.exe 1916 msedge.exe 1916 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1916 msedge.exe 1916 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1512 1916 msedge.exe 83 PID 1916 wrote to memory of 1512 1916 msedge.exe 83 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 4368 1916 msedge.exe 84 PID 1916 wrote to memory of 3156 1916 msedge.exe 85 PID 1916 wrote to memory of 3156 1916 msedge.exe 85 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86 PID 1916 wrote to memory of 984 1916 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8d01094941b75f749ea7e77096f771f6_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc2ac46f8,0x7ffdc2ac4708,0x7ffdc2ac47182⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6027210320850329796,7240636766307983257,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,6027210320850329796,7240636766307983257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,6027210320850329796,7240636766307983257,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6027210320850329796,7240636766307983257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6027210320850329796,7240636766307983257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6027210320850329796,7240636766307983257,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2996 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4176
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2676
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD5906d6a8a80f566e98f30bb8d6f60a38d
SHA11a2e814973564914b99b6a2b23c6adab94dd8fa6
SHA256bc9a4a98fcda5676422c6db9ca3d840068fd7f10d39e0521e40c5b0cb7ed603c
SHA512c226e6a563e743fdc6a19755503531bd193f2bf62c73c45f2bc229e9f3ee29f11390bec5922f896ec9b42617ed63d9241b2773ff9ceb191cf214e62d7413d0e0
-
Filesize
6KB
MD5cd8a0eee7f8537feda13fd2be713038a
SHA1a308352391d87c83a515017fe9528895a48b954b
SHA25620efe195c887417126df7d69e07b6a795ce981c701e96a6ade281014ca482871
SHA51244b213274ea9f4a92587cdd5a49cf8b318644d21fe7c137a05879b2603184ffe581494493367e261057b17e03be66689327e0718a1c63c3bfb33b37696f30921
-
Filesize
11KB
MD56afcd6ef04cc040d0f0640b26d5650aa
SHA1660411e91c6b52bb602fc93791c5ba3bdda489e1
SHA25626f72a5dc7a7a258bd761c7f84ae39b3618bf0e20caadc5110c1dc8507416862
SHA5124dc09d42869eb6be962440a42c546caa5fbc718466a348374e22ff29afe51b11e93f240349620c56b1fa8b470b1f6f4cabbdc5b23e8b405c8d17c80020fdedb2