Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 03:34
Static task
static1
Behavioral task
behavioral1
Sample
0db916452902d06348a1bdb3d460e70d_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0db916452902d06348a1bdb3d460e70d_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0db916452902d06348a1bdb3d460e70d_JaffaCakes118.html
-
Size
138KB
-
MD5
0db916452902d06348a1bdb3d460e70d
-
SHA1
3d2e5258220a7b5b4900f9ae2f1f7617db1d2957
-
SHA256
adfe9259a02a9ae51144821457ceb28805499bd9f30b870c08f3d7c54868acd1
-
SHA512
afcf0960c1c4f699d9857b05e4e12ae719a3ece7ac20471dbd3e697cc1420833db46842cb50606a022b5f479acc8d23627293e78a9635cf2497b02f2fa5bfb96
-
SSDEEP
1536:SO1+AlYFvjyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SOwryfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4224 msedge.exe 4224 msedge.exe 1508 msedge.exe 1508 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1508 msedge.exe 1508 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 3028 1508 msedge.exe 84 PID 1508 wrote to memory of 3028 1508 msedge.exe 84 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 740 1508 msedge.exe 85 PID 1508 wrote to memory of 4224 1508 msedge.exe 86 PID 1508 wrote to memory of 4224 1508 msedge.exe 86 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87 PID 1508 wrote to memory of 2824 1508 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0db916452902d06348a1bdb3d460e70d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e8b446f8,0x7ff9e8b44708,0x7ff9e8b447182⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6808433285858656618,670554694932566769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6808433285858656618,670554694932566769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6808433285858656618,670554694932566769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6808433285858656618,670554694932566769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6808433285858656618,670554694932566769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6808433285858656618,670554694932566769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4236
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1192
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
6KB
MD598c8358fdc67ba30b3709e1dcb5d0de6
SHA118b7e7e05ee1f58f283dd67ad8d2169fd6dd6efd
SHA256773c60d0235ee4367043533d83f198d7406fc28590aa33394a7f1de6a544829a
SHA512d8448c184afd502613e6a7a6618e0cd50d563d53216f6da930c7641a6d44d27fd500fc0f9fd65d6254a93efe16583f59887d4c67a03094c1a0711cf51d3ff5c4
-
Filesize
6KB
MD57e8cc6553b96d299fd84b4d232397974
SHA1f4da84424982dc8454a86b9b18d9fd2d79a2a513
SHA2565b435f907247d023295c8b1b026edabb724732a83c588c6e95b83c6f03720d12
SHA512775e5b4a41349157a1540d9b5324b560e956b036fffc03c00b0c8594cc110c2e8a96859d53d789f937feaa5b014e06dadf8071c01fd67f0acd2574efa45a11d7
-
Filesize
10KB
MD5880eeef7f778d0b579f35adb869821e3
SHA1ade30b8255f42c36f67e14e2f6831438d4f1a10a
SHA25602f3508696fc25d9c0736fe532afeea75092c79dc5dbcb2a908a163c94b4617c
SHA5128910820177cc85ce73ea249a8c8601b05c4add37e325f7db5a3784a5b2d64919089fde8dfd4779509fcf30f0733b221bd88232e3ba8e84c293b666a94ece8aa4