Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
d21ed6c2da7a8441149f444797bd0d4d_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d21ed6c2da7a8441149f444797bd0d4d_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d21ed6c2da7a8441149f444797bd0d4d_JaffaCakes118.html
-
Size
91KB
-
MD5
d21ed6c2da7a8441149f444797bd0d4d
-
SHA1
2281d8f67a860ae77ec1587e4e08d50da440b420
-
SHA256
609cd1d9247702bda3a659d9638ec43851a7e40085c2a186484da253d3b22665
-
SHA512
f5cbb6b1b88ccede2710a0679b07c340920326a043294de0ddd95ae5091fed07517bb4e131d5cc410dd2ccbc1ae52add898f3a64377e6192d29d2c5ca0d6a4ff
-
SSDEEP
1536:GeJQfpB6Q14w0Su27Od6QY4t6ZbAagdmyb49M+3di5yp4X+OAyU4W8IMETymJ4d9:XA8g4Q7NF4YAV4Hd94A4e4bQ4lAgMrgD
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133701920480721480" msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{0569B22F-1DE2-472D-92FE-6EB3B5618970} msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3408 wrote to memory of 5696 3408 msedge.exe 108 PID 3408 wrote to memory of 5696 3408 msedge.exe 108 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4084 3408 msedge.exe 109 PID 3408 wrote to memory of 4092 3408 msedge.exe 110 PID 3408 wrote to memory of 4092 3408 msedge.exe 110 PID 3408 wrote to memory of 4604 3408 msedge.exe 111 PID 3408 wrote to memory of 4604 3408 msedge.exe 111 PID 3408 wrote to memory of 4604 3408 msedge.exe 111 PID 3408 wrote to memory of 4604 3408 msedge.exe 111 PID 3408 wrote to memory of 4604 3408 msedge.exe 111 PID 3408 wrote to memory of 4604 3408 msedge.exe 111 PID 3408 wrote to memory of 4604 3408 msedge.exe 111 PID 3408 wrote to memory of 4604 3408 msedge.exe 111 PID 3408 wrote to memory of 4604 3408 msedge.exe 111
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d21ed6c2da7a8441149f444797bd0d4d_JaffaCakes118.html1⤵PID:4600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=756,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:11⤵PID:3960
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3888,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:11⤵PID:2404
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5428,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:81⤵PID:3260
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5464,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:81⤵PID:652
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5628,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:81⤵PID:3928
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff9c6eed198,0x7ff9c6eed1a4,0x7ff9c6eed1b02⤵PID:5696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2312,i,15091050282026841233,4326833845644229776,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:22⤵PID:4084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1960,i,15091050282026841233,4326833845644229776,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:32⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2448,i,15091050282026841233,4326833845644229776,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:82⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4468,i,15091050282026841233,4326833845644229776,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:82⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4468,i,15091050282026841233,4326833845644229776,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:82⤵PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4540,i,15091050282026841233,4326833845644229776,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:82⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4484,i,15091050282026841233,4326833845644229776,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:82⤵PID:320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2780,i,15091050282026841233,4326833845644229776,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:82⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"1⤵PID:2572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
10KB
MD5faa2e563dce173c2443fbe26deb12d68
SHA16ddacf08c23828205d045a4caee520da0921b50d
SHA25608cf7740cc0264542d7842e3dcbcdc67f8b7f4ffb938b2245e895fcea4c1a692
SHA512a19a2334d4c72d96a8f7785605607be7d818b510cb1db3a542b7fd694886baf4378f695be9b82c20974b693321fc5e877fea2a38edd8460b8159e963fd115afe
-
Filesize
30KB
MD512a08fc965c3b4c83e4cadcc971c7dcc
SHA1ab8bc413dab23db5bdeccc6b49e3c5d5bd058998
SHA2568743f5a596fde86c4ca604db3bd39c34deeccb476c522502b7741d77ea1a8b38
SHA512e59daa4ed41f9dc98e318c1a1dcf3c43bb41993f945667e800a39e184cc15d5d3813a34d68674dd4f5f458b336b9ed407e3766c7d67f034470255e39f141f8d8
-
Filesize
53KB
MD54674d8d3019148f8f2f731b4ea75e93b
SHA11fdcf7cb97c69287eb69cbf40b925ab24a2e3c5d
SHA256b7e1ee74410f49b131543dac3c10c233c3544120b5317f9f4c5faa7785cb5914
SHA512aa41b2311811c96de9f5abe6b54c961a025f4e3835c06b1a52259b08f8f4bd17fc436efaa7c05c926f90a40fe9707fc4cb9da8006257658ec30ad90bbe713065
-
Filesize
50KB
MD5e20bbd392e128d71852255e796fa68c7
SHA11c03be746377e2a095944b138f672f38f450667a
SHA2560269b89cc17c5f87e53c1872e00ac3fabecbe6238dfa64cace562a824ff343c1
SHA512568d49a49b7e4688ba6f3394392ff6a208043f8d65ae6bbadc9950f34dbc534ef6619c7c82f54ae90a6bdc1cbee1d4727e7d90996f66c0d48841a5638ceae68c
-
Filesize
50KB
MD5567c9835dd58e7660bd279c5db3b4b11
SHA1f0e88d5e97e0c4cf9e0b0c59ebcb13240d4834e5
SHA256857b550610c1eba8ce87603ddf0e3bf44a4b1a79501ce69614da48600ee170c1
SHA51203f69bce2a8229b044dcaa210a87532b0314d6efe1142215b6b64ada21c96f82db6239c623ba6c88868e0670132b36dd7b85289d2238e20afb820d442abc5c8e
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Filesize2KB
MD5edd5e9618374fb92029d3bfae5411dd0
SHA1612bd80bcfc9afa650d4185e046c76e57c5aff42
SHA256502e05fa5e9e28570427330997c00e0940e42e4bc8d6922d5409164fd43619e2
SHA512f5e7e15dd633057b2ce7692022143d3f8b0a7c06e3db8d9c3933d304ea139b545e66d5bf0922beab8384ac094e1611cf44539f933bb861c76ec9d22e11b3ac23