Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
2f176f49719f6d2d6680a560fcb4e5d1_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2f176f49719f6d2d6680a560fcb4e5d1_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2f176f49719f6d2d6680a560fcb4e5d1_JaffaCakes118.html
-
Size
244KB
-
MD5
2f176f49719f6d2d6680a560fcb4e5d1
-
SHA1
30b629ba02f11e46c80d5fda6fcc8e6a019299f7
-
SHA256
0aa01ead6725bfcc0301bdbdb443d96742e7c3e5502769e4308b3b49709ae67c
-
SHA512
0e55982e3c06d3ff62c4d835523d8fab9fdc56a5494d466d7df92c9bdc18df355fae2a09388369ab743a155962aa5d91c1b7921a8ccb894d28ac9038ce00466e
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcGOeHAN8dLMoeKoFXRcZTy2gOp:sHAgLuFXR+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4948 msedge.exe 4948 msedge.exe 768 msedge.exe 768 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 768 msedge.exe 768 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 768 wrote to memory of 4032 768 msedge.exe 82 PID 768 wrote to memory of 4032 768 msedge.exe 82 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 2648 768 msedge.exe 84 PID 768 wrote to memory of 4948 768 msedge.exe 85 PID 768 wrote to memory of 4948 768 msedge.exe 85 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86 PID 768 wrote to memory of 1168 768 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f176f49719f6d2d6680a560fcb4e5d1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8735f46f8,0x7ff8735f4708,0x7ff8735f47182⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:22⤵PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:82⤵PID:1168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3488
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4492
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:8
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f0f818d52a59eb6cf9c4dd2a1c844df9
SHA126afc4b28c0287274624690bd5bd4786cfe11d16
SHA25658c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61
SHA5127e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509
-
Filesize
152B
MD50331fa75ac7846bafcf885ea76d47447
SHA15a141ffda430e091153fefc4aa36317422ba28ae
SHA25664b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a
SHA512f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2
-
Filesize
6KB
MD5dd520c85a0a430820720db6deba3d1ec
SHA1dd9dbaed12ceebe3b1a43d4b13b9d03fc5947a57
SHA256899882aaae62f2c482a1ecff8cdb0ca23bcc52cf99c3e3a9f5cdd5bc9c322760
SHA5120e64a3286e03539dfd12c3ecf833585cfb7edbcab1794a3580c1bdd74ee5aeebc436cb49cb5c990a05d91a704a48e383d340831f15ae23cd2fae35c24b573703
-
Filesize
6KB
MD530e739e487c55b50d7e066d83f9e3c65
SHA1b9aa02199dde2e965f365e44a4cc604a0651500e
SHA25601b59e877c40802a7516cf0f7599bf96aedfb20dbc772479cb26352bc8dd2754
SHA512f90c891350081e54bd4d3d03d25fcbae4c37feede0612406639fb84203669c95d2a3ad96e0b29095719f15ac6c469e77249d6582c0a87db60cd6391284139818
-
Filesize
11KB
MD593101b7df6757170c977dc41fd3da59b
SHA1a15ec4d927e52833073d5087af96fb2ab7678582
SHA25622a361d7c6392846c672ed7a15dde53404f65c6753555497afc2dc1427c0b86a
SHA5121c7abdfb206acf67719dcba44c2e82e631f6e6395345fff40cdb306e65e9fe880827e221c62931e9ed1b89d5b655e81e5bb668755e1ed7841c376f5b77aba8dd