Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
6340ee2bd800f24b0494d7760df62730_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6340ee2bd800f24b0494d7760df62730_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6340ee2bd800f24b0494d7760df62730_JaffaCakes118.html
-
Size
215KB
-
MD5
6340ee2bd800f24b0494d7760df62730
-
SHA1
db6ea78d9c138bb81d1b79fc6d69b8f7fc46b5f4
-
SHA256
cc569ac81fa88dddf86f9b248eda60516659986027ea43781a6970d7422e546f
-
SHA512
6d97dd098f72ccfb5a11fbfa9cd3c45bab17bd5a138225c405f8a4f078aaddbbadf659fc496ec5fd7a4c6ba8d76e86aff9658d17ed135851715e3152082eb392
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcO4b2HAtP0L0EKSdBSAcZ/mOUyp:sfMsLzBSA6
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 512 msedge.exe 512 msedge.exe 668 msedge.exe 668 msedge.exe 3992 msedge.exe 3992 msedge.exe 3992 msedge.exe 3992 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 668 msedge.exe 668 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 668 wrote to memory of 2940 668 msedge.exe 84 PID 668 wrote to memory of 2940 668 msedge.exe 84 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 2044 668 msedge.exe 85 PID 668 wrote to memory of 512 668 msedge.exe 86 PID 668 wrote to memory of 512 668 msedge.exe 86 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87 PID 668 wrote to memory of 1960 668 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6340ee2bd800f24b0494d7760df62730_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba81946f8,0x7ffba8194708,0x7ffba81947182⤵PID:2940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13357159330842848247,18296396871957818790,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13357159330842848247,18296396871957818790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13357159330842848247,18296396871957818790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13357159330842848247,18296396871957818790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:3280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13357159330842848247,18296396871957818790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13357159330842848247,18296396871957818790,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2536 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3992
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4496
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eaaad45aced1889a90a8aa4c39f92659
SHA15c0130d9e8d1a64c97924090d9a5258b8a31b83c
SHA2565e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b
SHA5120db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4
-
Filesize
152B
MD53ee50fb26a9d3f096c47ff8696c24321
SHA1a8c83e798d2a8b31fec0820560525e80dfa4fe66
SHA256d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f
SHA512479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5
-
Filesize
5KB
MD588eebc6712367d09f16bd436cfe171de
SHA1339a2c622f7952727024d43ab874969e79db1b61
SHA256351891c5a1a62059faea47b462c5dfa0b76051c9e2eb3ae3eec6241c0ff1e7d9
SHA512eda3a1d2357e9895bddcdd5606abb8ced063cc7d00115272f849f26ab7de1b17e395f516be5a01e796f737c6af44bffbd082c7d309bc0f8a9027d2086e2dae5d
-
Filesize
6KB
MD509ae972aa6e7c122151668e278a4b923
SHA1c9899ba8230d4c70e1048c84f990da852275ef90
SHA256b461dbc447afde84f4faba8b77054436da8628749e2c30345e174b06591474dd
SHA5129bc95d8f4a9f7f3bb43f43cc0d2448c3d8ef8787861e88cdb776e8efae2f6e72b0ecfef36475599d24cac1a5292c6616f2f6a1fff8d4e74b255288b8ac453552
-
Filesize
10KB
MD574fef59a3456568633cb799c5ff12631
SHA1e5517d384178ad62ac1f7b0d797602ca6cefd364
SHA256109acb8477d636713d05d9173d7eea62c3dbb93e5ec9ee405726c300d12875e3
SHA5127a670a918b1d2f5be6119dcb18e60be408ae63e12546e52518c41df199f26ab085a187e09beea809c0b1931bdfd69032bc52c70957fdfbcd49ce944a51774974