Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
2c450ef0b9de3d06ced8dcf5787dfed8_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2c450ef0b9de3d06ced8dcf5787dfed8_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2c450ef0b9de3d06ced8dcf5787dfed8_JaffaCakes118.html
-
Size
14KB
-
MD5
2c450ef0b9de3d06ced8dcf5787dfed8
-
SHA1
c287d0347f4c16d48991247903e00f6854c874f7
-
SHA256
513170bb880a2edfc3840adffcf83b5bc2d3e99f06527b1cc3381fd61b757b54
-
SHA512
bd807cd024442f8424ece761d0ebcc3e83190ee6d997e2f33242db1c275e7674cc0fb9d3c92f259eecd56909e5a1f6ee697e478eb897db4c2d587c523d9316ed
-
SSDEEP
192:rDkTffv5gUfFS8VmFFmnrAD5rnrf1SGU6qCC9i1KYYY5:rDyfX5gU9raKr61rf1SGU6qCWCKYYY5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1472 msedge.exe 1472 msedge.exe 4508 msedge.exe 4508 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4508 wrote to memory of 3576 4508 msedge.exe 82 PID 4508 wrote to memory of 3576 4508 msedge.exe 82 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 4176 4508 msedge.exe 83 PID 4508 wrote to memory of 1472 4508 msedge.exe 84 PID 4508 wrote to memory of 1472 4508 msedge.exe 84 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85 PID 4508 wrote to memory of 2216 4508 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2c450ef0b9de3d06ced8dcf5787dfed8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98a5f46f8,0x7ff98a5f4708,0x7ff98a5f47182⤵PID:3576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3356
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f0f818d52a59eb6cf9c4dd2a1c844df9
SHA126afc4b28c0287274624690bd5bd4786cfe11d16
SHA25658c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61
SHA5127e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509
-
Filesize
152B
MD50331fa75ac7846bafcf885ea76d47447
SHA15a141ffda430e091153fefc4aa36317422ba28ae
SHA25664b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a
SHA512f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2
-
Filesize
6KB
MD546454d67eb267289678b46f4db8e8c68
SHA13a4074f31e437f31e5ac411e5620aa4317b5125c
SHA25620cd22646541f53d80508a9ca744c745103b0a4ced0d598807879a6caced299b
SHA512185f295dc7abf12b358ba150061cfbdf6f35979ca9fb9708fcfbf3fc7c9d5b9671236e3e3ba7691532259855e081f05a2527a3ac5b7c1a3ba4e2315fdf42e83d
-
Filesize
6KB
MD5ffe73ea50ad126bdb598062a49b7e296
SHA126368d3afc55ddc8773ebda010f66fb6572ab8ce
SHA25630d2a21accd2092434ef3b2f2525c46cfe8d6055360f3c6badd3f3d9d0982670
SHA512f89b3525dbe8bea5183e2cb42a8c589bba1e2e98c452f92c36dffb68f0d2fdd087d4611063875b06d772cb4e72b805dd698bdfded12b72681f335364273b1539
-
Filesize
11KB
MD599dbdeed8c79edb6168735bc74eb02be
SHA13a527d4197b8b5a8506fea861a2a14569ac2390b
SHA25628d3dd43dc63d8f32b0f776839c07072d3760a7cab6202ecbb76a8951c790120
SHA512cf01bf5e5c06f34cc2ab6dcd50e6c94d48a506002282b5b9b729e8ee53659845af88828c2d6946d68362ecdfdf055151820e8580188e5d8e44386c861e1bf3b9