Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 10:53
Static task
static1
Behavioral task
behavioral1
Sample
d430c6e2371068723af274aeb674c530_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d430c6e2371068723af274aeb674c530_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d430c6e2371068723af274aeb674c530_JaffaCakes118.html
-
Size
157KB
-
MD5
d430c6e2371068723af274aeb674c530
-
SHA1
3546c27c32ffe7d5012154288579ef48ff2acf95
-
SHA256
9081c37099b282dc7035135183204bac874b32aeb3b063bab766f65c75869d6e
-
SHA512
d7067bd2adafe370b489209cf83e7c267b2f87301f585f5c2183ca305ce067648325f5d0f94b2ccdb7ecf3ff835c084182c89e0b55c65b83e5c05743da8daaa3
-
SSDEEP
1536:SQ3T40PejamlIhaHS3oyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:SQDgaXhoyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4936 msedge.exe 4936 msedge.exe 708 msedge.exe 708 msedge.exe 4564 msedge.exe 4564 msedge.exe 4564 msedge.exe 4564 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 708 msedge.exe 708 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe 708 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 708 wrote to memory of 3684 708 msedge.exe 83 PID 708 wrote to memory of 3684 708 msedge.exe 83 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 5108 708 msedge.exe 84 PID 708 wrote to memory of 4936 708 msedge.exe 85 PID 708 wrote to memory of 4936 708 msedge.exe 85 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86 PID 708 wrote to memory of 4628 708 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d430c6e2371068723af274aeb674c530_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab4c846f8,0x7ffab4c84708,0x7ffab4c847182⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11267044432753653107,9944068620480969099,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,11267044432753653107,9944068620480969099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,11267044432753653107,9944068620480969099,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:82⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11267044432753653107,9944068620480969099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11267044432753653107,9944068620480969099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:3060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11267044432753653107,9944068620480969099,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4564
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3212
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD5e18f1b7cda36decc0fe5d1bf6a953d64
SHA154606facecb1c31c432102eefd7947ce5cbe45d1
SHA2567d918d0042d83ccc73c445c0de11ae0ec086d2760eb244d6c26c3bf7cb40b5e1
SHA5124217ec4b593e01cb25e6e9fa5da771b661c62af80193283d3217d6095f8eafe9ba9cd93bb3bb5140ea7968d49c6461e4a3d794e78cc51475bad18ff1e812d8d7
-
Filesize
5KB
MD5dbec6627836b90e4fa117716e186d846
SHA1ff4874dc424de7a64065640b136c23b83740be58
SHA256902fab734f857eec68671c2fd8c4e7ace1ed26c6b8079b504e4c11155e51f355
SHA512f353eeb3dbe465ad4b046994129e1884faac30ef7f384aa350b3a32cc53378654ca78fd76f88d03f75d05b03a54daa2485101486955495968d8318c035e7bd32
-
Filesize
10KB
MD514027f03a461f0627544580376a6eee1
SHA1c8b4150430eb8cc6fa7e963fd6d111572be1a368
SHA256f8a1c7527dadaa41b53a4015d395997657d1ac4d313de3134edc57da5673d945
SHA51218041d86eaee6620e1b259def9785a16cf639f7d52bba72ad594dafeee9a178e7c15c7a8f509aff6917ff2309371cc101dc217a0194b11376f420fc2564a6f38