Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 00:49
Static task
static1
Behavioral task
behavioral1
Sample
0d2b62e02b296c654da8cd36b5e7be05_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0d2b62e02b296c654da8cd36b5e7be05_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0d2b62e02b296c654da8cd36b5e7be05_JaffaCakes118.html
-
Size
250KB
-
MD5
0d2b62e02b296c654da8cd36b5e7be05
-
SHA1
7e818b1894f758aea7af06e53d0351dc6dc08b95
-
SHA256
b81a23dc07bd1eceb7c73bca00fde4145f601e35cbccc75fc31f51777b3547e0
-
SHA512
5a673807f846b44e5333e77c54c542a898edf4ebba3cb177fd5fb1f1ff616a95a99fe0a8f60f6331c67534ac3cfb1ea0394030aebb153f2423e4f38cade1f845
-
SSDEEP
3072:FP7gD7r9HwvRPJ5No4e4QVtNGcPSu31RfB1jNmgxz/7i+1u8hV/LCMMKFuOgyqlr:xgDKu4QV3V5PA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3336 msedge.exe 3336 msedge.exe 1144 msedge.exe 1144 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1144 wrote to memory of 3812 1144 msedge.exe 82 PID 1144 wrote to memory of 3812 1144 msedge.exe 82 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 4224 1144 msedge.exe 83 PID 1144 wrote to memory of 3336 1144 msedge.exe 84 PID 1144 wrote to memory of 3336 1144 msedge.exe 84 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85 PID 1144 wrote to memory of 2268 1144 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0d2b62e02b296c654da8cd36b5e7be05_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff540d46f8,0x7fff540d4708,0x7fff540d47182⤵PID:3812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,10968501582893163108,9214633593136604825,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,10968501582893163108,9214633593136604825,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,10968501582893163108,9214633593136604825,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10968501582893163108,9214633593136604825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10968501582893163108,9214633593136604825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:4552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10968501582893163108,9214633593136604825,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:12⤵PID:672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,10968501582893163108,9214633593136604825,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2936
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3296
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD58281a0ff42bd78185e3d8f0ee0a22f90
SHA186667e351f0e2cf1c1a456c037e14f0bfab87156
SHA256a3d5a864e2d8e6c8abad40b10b4c37d71bbb898c1cc41897ffdb782cfea89434
SHA512c09f5bec34e61541e9478156496931d5fd4c5a0a53d83ae5ea49416ab550f72e69c1c781bdbe390df671d29b0b06c187b5643c4ef544d8cda0ab494b0e20f4ef
-
Filesize
1KB
MD5c10ff34479d2d30d35d624e455fc1cce
SHA17f2b05c4ecb5e6bbc76718863d738a83f41aba41
SHA256bbabf5aa9b3d466cf23f951b6029dd4035f8d49bc3994e351ffbd71b1cbfd325
SHA51224d1c47a2dddb6ffef730e75f7140ed39d84268075658a9a474cad77a2582ba30814d26e41e8eeb2d5a65bcd6891c542463ce95ffc02d56775c30ffc950b7f7c
-
Filesize
5KB
MD56cf53ee49d4a7b93d1cffdca72afad0b
SHA1a88441a5d5680a2f1c4ac86b2f1044fa3571bcb4
SHA256befb4fde835de7d601886181ec6ee4a96a4d6adfd3384d4f89b5a98464e64606
SHA51260f85513c2ae66b758a8718505902f899808311bc473f6eb0b60eb2c81b1674a1993bb530b40b7976dc2729900ddf8c5768a7e095412edef140fc6f798adb8aa
-
Filesize
6KB
MD5a502f7b8cbe3f7ed5a7439547f0d1ea8
SHA18d0164c5c4b2afba30fbaa83dbc4cc302516d40a
SHA256de27f91c853fcdbe3b1970ac2554d50657da75876e418bb06e681d26ab2101bb
SHA512e5c2ae88d7427f80aa0ea568056ae6002f591c8f815695a45cfcaa5941451284eb275d85c9ef12c056e23f5020c75cbe3bcd7e461653d9e06d70e84525e56ce6
-
Filesize
10KB
MD54cc133539793ef6f07731fe89867e9d3
SHA1581256f21f2af7e973cd6ffa6c6a80378779c1f4
SHA2563d2d9ff011f031006786a80f4c1794b4b49bf6b7ada0b7a81274d57b8424cca9
SHA512db32ff877afa2230675e060a75ea99c2f232d187d562a837f5a5808a58074f8cb7b5096852c6d60407345cb1ddfb5b24858bc2aa26f35cfe1ae8083e7340afcd