Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
2a151eac1e351e9704f4d884c6475aea_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2a151eac1e351e9704f4d884c6475aea_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
2a151eac1e351e9704f4d884c6475aea_JaffaCakes118.html
-
Size
21KB
-
MD5
2a151eac1e351e9704f4d884c6475aea
-
SHA1
e20de2f65480afb8d059e43670dd0561ff9ca1c7
-
SHA256
1df4f0a100977a8ad2536ed1f0c76a78e9ac282f164f038b7994886a1124604c
-
SHA512
9ae5ad87d5a6028984a041e78d67620e9baed8831d8406f9bc621ec358a005d111688cb08181b973141d8c32a8b299fa5e5ab588a444d4e7202756c3aea8a948
-
SSDEEP
384:S9wBhSCDOWH0xn9oiqWPHzycHwAfR9nxiYkoJMkj6FMryBNyCQwYwSfWO8GkG8cn:SMzDRH0xSZWPHnHwAffsT+rsVSeO8PG7
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4080 msedge.exe 4080 msedge.exe 3464 msedge.exe 3464 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3464 wrote to memory of 2960 3464 msedge.exe 83 PID 3464 wrote to memory of 2960 3464 msedge.exe 83 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 2168 3464 msedge.exe 85 PID 3464 wrote to memory of 4080 3464 msedge.exe 86 PID 3464 wrote to memory of 4080 3464 msedge.exe 86 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87 PID 3464 wrote to memory of 4548 3464 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a151eac1e351e9704f4d884c6475aea_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffc8f5846f8,0x7ffc8f584708,0x7ffc8f5847182⤵PID:2960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,3856868048456494618,12646593898667445187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1916 /prefetch:22⤵PID:2168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,3856868048456494618,12646593898667445187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,3856868048456494618,12646593898667445187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 /prefetch:82⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,3856868048456494618,12646593898667445187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,3856868048456494618,12646593898667445187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,3856868048456494618,12646593898667445187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:12⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,3856868048456494618,12646593898667445187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:12⤵PID:2664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,3856868048456494618,12646593898667445187,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1508
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7cb450b1315c63b1d5d89d98ba22da5
SHA1694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA25638355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
-
Filesize
152B
MD537f660dd4b6ddf23bc37f5c823d1c33a
SHA11c35538aa307a3e09d15519df6ace99674ae428b
SHA2564e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
-
Filesize
304B
MD5f30358e7bd0c06cc37430e8ce9a9f60a
SHA1b8ae22d17fbff682dc2eedda14c22d37a605ae06
SHA256d663fb5b4f4f0368b3ed32a20a07eb6499a503f6de152679fd37c439bdae24cd
SHA512c532cf706e7c69f1b9048cf54b2117a563fd840a264461d39cf76165496f55da8d762a998d860f5962148620f90d7ce7d4676e974c800ff51381df545eceb83a
-
Filesize
6KB
MD5deacee017a5a322cf9be4c42fdcdac8e
SHA1037e2b3ff838867f71b45c603aad5e57452b040f
SHA256616b86fdf9c9a8cb8f9a967f9b1b23840849063aa1271dc4e709bd7d357c7301
SHA512d4dfe4bcfb33dfc703c541aedc8486239f7e67c640cfe1d1dc4db0f102e7009f70724dbc703efbf6f211324b0f5b229eac6890dcf52fa45364a468e21e19c4ef
-
Filesize
6KB
MD560f68ea752f15d3b8c6ea390c8d6dec8
SHA1eb8741d7fa9a2939011956e48203f7e43fa5e9d5
SHA25622602b50d15261f85f6ca195ed53f1643803b3986c3c0b580d59f3a5f94ad002
SHA512e405266666ad8669e030bb876207344a43e1a2909274004ecd7c1df8609c4759062ea7d0584f59fdf5a680dcb48d28805277d4767c55f7197d1408e9bbabb9af
-
Filesize
10KB
MD5f7186dbaada8865c2b23f14561e1cd3b
SHA1b0421d9d2e16f9a6c4fb42b7195aeacd46c087d2
SHA256df7285d813c4538f856d94a3654928f772ecaa966599635ae589d8fdeed401a3
SHA51229843e009421d7b02c8725f07479388ae88787f2eb0d17028026d9815b65edb4d706ac18efb87ffae1062eef98f2eda1bc1a249128b7e1a43d21dadb90ca8d1c