Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 00:39
Static task
static1
Behavioral task
behavioral1
Sample
3b5a16b5c8f089941615b310a29f02d7_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3b5a16b5c8f089941615b310a29f02d7_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3b5a16b5c8f089941615b310a29f02d7_JaffaCakes118.html
-
Size
103KB
-
MD5
3b5a16b5c8f089941615b310a29f02d7
-
SHA1
9df1457f7e955bc2314fd2973e5616174091185c
-
SHA256
6ed6664235e9eedcecca98ff3e06b3f8189d8d94d19bde8e4ea5d68b4e851f4b
-
SHA512
300abcfcfd3cf222d13c3b0f29fa4508e46e4fde43dc62a7bbfec3e13acb508f39eecd41d760539a9726c26f8b37d370f573818c76e3bbbb3b3f6980b08d780f
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcrLyHA8PVLo86dcZfmm0Sp:sZZdLIG
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1164 msedge.exe 1164 msedge.exe 3880 msedge.exe 3880 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3880 msedge.exe 3880 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe 3880 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3880 wrote to memory of 4556 3880 msedge.exe 83 PID 3880 wrote to memory of 4556 3880 msedge.exe 83 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 396 3880 msedge.exe 85 PID 3880 wrote to memory of 1164 3880 msedge.exe 86 PID 3880 wrote to memory of 1164 3880 msedge.exe 86 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87 PID 3880 wrote to memory of 1768 3880 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3b5a16b5c8f089941615b310a29f02d7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa42fc46f8,0x7ffa42fc4708,0x7ffa42fc47182⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,13738526533987165431,4631892998222236346,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:22⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,13738526533987165431,4631892998222236346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,13738526533987165431,4631892998222236346,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13738526533987165431,4631892998222236346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13738526533987165431,4631892998222236346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,13738526533987165431,4631892998222236346,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4808
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3504
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD504b60a51907d399f3685e03094b603cb
SHA1228d18888782f4e66ca207c1a073560e0a4cc6e7
SHA25687a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3
SHA5122a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91
-
Filesize
152B
MD59622e603d436ca747f3a4407a6ca952e
SHA1297d9aed5337a8a7290ea436b61458c372b1d497
SHA256ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261
SHA512f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a
-
Filesize
6KB
MD5db4eaa99a317dd6ea70ac85eb157b408
SHA11decbe0703cd8601ba6baa462bcd590d4ea85f92
SHA256280b8b27a5a26142f436418d4d68b69e8d3eedc35df44d9feaa4a9e340651f11
SHA51281a1ce4e971c2cd59f05ce69a44f5104ba4ebd7beadfed5b13a1337dc553ee741014cecfcd5052a4056af0248f724222e56b6fe7ed7cae312c2f634ce84fa80c
-
Filesize
6KB
MD5bc993309ca8d30d4b6414945b2675a5a
SHA1b2f39db352571ea384886ecd9ca75efb479b1fc5
SHA25656ae0570d87e18f40898104423b1713297714cb8af37357440b50f26ebb4db9a
SHA512fd4ac3ff17759d931f1a7068ea8c684848ebe1cd7772e614f02a8c903701aee3177a41ae0c7b129725ac7c9fa969045d02d16741d4600141b139c168fd2d7a1a
-
Filesize
11KB
MD508ef6197cdca4acdaada0300ff8b1627
SHA131da4424e6aa33b8025438834edaf3b5f5512d5c
SHA256fe803ccd11c7dac1bfc46636bd077542b290a658c737140a5d17dfe8319dbd46
SHA5129afd8cca263edbb60a781a66c23ef7e5aca57f66b3a72374c3d3641760ae0be25888fb2653e7cbda52014c94466c4afe985eaaed6bf476a23c42d1db072678ab