Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 23:13
Static task
static1
Behavioral task
behavioral1
Sample
ce20f4efb681b0215f9db0b52c867f82_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ce20f4efb681b0215f9db0b52c867f82_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ce20f4efb681b0215f9db0b52c867f82_JaffaCakes118.html
-
Size
139KB
-
MD5
ce20f4efb681b0215f9db0b52c867f82
-
SHA1
e031c3e88b5289de975d259f01d5d173df8232d5
-
SHA256
5aa7d9a0c4e97382d865a416a0c2b2aee0abf49965cc6daf75e6e0d061975584
-
SHA512
a38bf57816f5ab055e083fc40b409af8cf5d23b21b8e4623e11420b9e069a2d5b164b3ce17d9af30223d8623695ec4e928b552e667116ee9744eb0e2ee795e2e
-
SSDEEP
1536:SYt+mKZlbiGyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SYcviGyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4932 msedge.exe 4932 msedge.exe 3972 msedge.exe 3972 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3972 msedge.exe 3972 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3972 wrote to memory of 3816 3972 msedge.exe 83 PID 3972 wrote to memory of 3816 3972 msedge.exe 83 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 2812 3972 msedge.exe 84 PID 3972 wrote to memory of 4932 3972 msedge.exe 85 PID 3972 wrote to memory of 4932 3972 msedge.exe 85 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86 PID 3972 wrote to memory of 3992 3972 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ce20f4efb681b0215f9db0b52c867f82_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5f9846f8,0x7ffe5f984708,0x7ffe5f9847182⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:2812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:1416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4300
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4056
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
6KB
MD53671d5d649575e591166a3bea03d7047
SHA13ce3a932f95858c5b752427bf5e9329f16587504
SHA25675133c2abc1a4f70c65c7f739b5d0f4142c64dd6ae29d9d9f5e01711bb0cc7fd
SHA512329d15f98c1092a882d624357f22909c1191cbcdd1ac13f7fa3190a8abc120ea66140ea751e0d73bdd22d8be9353ca007ccb7f20830f4c650252b09f0179cf0b
-
Filesize
5KB
MD56a53327159f18b1840429ba3c643ea26
SHA198d63e6f77b4c15321e18f1968e6f8c47343fd01
SHA2564b2b1c600a54007ade4ddff2420c728a4441dcdf4fdcca3b7960239ea8aca235
SHA51250d7ac48ad6a336919d8e1a023e8e4ceeba07e669278dbe96c841d5ab1b0ef1d5d25d2770c3629a3a9c3f11ba2a5a327179ccd3011dce527733e2c13f1c18c40
-
Filesize
10KB
MD5f0750c0e51446571da4c03e01741a43a
SHA143390b0a4dec9ab6b604cd169353db1359be2b16
SHA256431516c9bf729653fbf44598f88213241bcf1711a1665f1a3ad294b90cabe334
SHA512a14558943840c9c232ebff7ff322de859f5179c46f5818d57ff5d5bc8c6e5fc364de2100a37e0039328726f0d379125345e49e257c6f5a589bc9a19f0bad90c7