Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 20:01
Static task
static1
Behavioral task
behavioral1
Sample
0737b7787d86ef80c2169159f313c2df_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0737b7787d86ef80c2169159f313c2df_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0737b7787d86ef80c2169159f313c2df_JaffaCakes118.html
-
Size
139KB
-
MD5
0737b7787d86ef80c2169159f313c2df
-
SHA1
d74829f2d9f02a6cbf14e389f29403d1da1e7f6d
-
SHA256
897802c56841d889ce42243f1c8d38df08f2d02ca679049bb7d18baf95f8f718
-
SHA512
698cc41fd31f003788245368d913ed26b485145d1d128ad1db1cf152b552c12b2d23c07be53b3bde9881d535dbd24089f8eadbd84bbab3a61ee4cbfb364b82a4
-
SSDEEP
1536:SWJOsdho0vl1qMyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SW9BXyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4804 msedge.exe 4804 msedge.exe 1792 msedge.exe 1792 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1792 msedge.exe 1792 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2924 1792 msedge.exe 82 PID 1792 wrote to memory of 2924 1792 msedge.exe 82 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 3864 1792 msedge.exe 83 PID 1792 wrote to memory of 4804 1792 msedge.exe 84 PID 1792 wrote to memory of 4804 1792 msedge.exe 84 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85 PID 1792 wrote to memory of 4772 1792 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0737b7787d86ef80c2169159f313c2df_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8dff46f8,0x7ffe8dff4708,0x7ffe8dff47182⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14147643899191751510,18362274125586034809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,14147643899191751510,18362274125586034809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,14147643899191751510,18362274125586034809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14147643899191751510,18362274125586034809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:3204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14147643899191751510,18362274125586034809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14147643899191751510,18362274125586034809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4404
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2144
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
Filesize
5KB
MD57e165ce5abd3ebe23b75a6450670575f
SHA10e453b1218f4556eaad759f537ac6d5137679208
SHA2564ab330ec6a25bb0ee08f3fea51ff3c4a20d9a6b2ce1e7af1420d8f5b20280c8d
SHA51266859dff905f774c79f9f20c2262b8337e35f55c81ca94c4f9497b38ee9a7fa0d0da264b57ce82be52751bc0070f2ba5cd60805c419110b8d754a1df312819b6
-
Filesize
6KB
MD5c996dfad4286810a13fa97127a19904b
SHA18b641ff37d5f02ef426ab1bbb51f9309ff953948
SHA256a1d5cfa5c74f47561736e77160741af45b686444f4c510d09c5d84a9af4232c1
SHA512c0ef4ec2620d4de5537e26d895c154fb215e95abe3c13f38fa7e04c72eae2d43b2cbcc4fa5f044ff9153084aacc77837063b8339f4a03cb93c93a77ef235f237
-
Filesize
10KB
MD52da2e2455d98f9436c683e776547e36b
SHA1b28a61b9ba23a32dd7d7974d801c89fb0d5fbf20
SHA256a1bd17007c51437aec462e5008bfe10a4b2351d5c12e4f1ecd1a0e4b4db716bf
SHA512e101c5b8e70cabc80802f97a82a0ec38b458bcab05598f9ed1e59213f0426c1c1d8ff52ae14716be8b087705b5618ddb25e8e3e648b951156c978370183d9def