Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 12:01
Static task
static1
Behavioral task
behavioral1
Sample
eb05d3cd3b75d062abcc85579390824f_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
eb05d3cd3b75d062abcc85579390824f_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
eb05d3cd3b75d062abcc85579390824f_JaffaCakes118.html
-
Size
67KB
-
MD5
eb05d3cd3b75d062abcc85579390824f
-
SHA1
fc10d48aaa2c875399875d8cad0d6cfb73c3ec7f
-
SHA256
ef51c6fb563dcd32a5209f14f93e242d551811fd67dabcc9e088bcd024d765b5
-
SHA512
200bf1ef3f38a5cc49d12b30e367cfed2867011bead40cfb59a602ecf6055aeb9d8825210818661d2df921be0f78bc5875ec1f9ae380e849cf7d8241b877ab86
-
SSDEEP
768:iilQZuzOZu/YPR9Qw25GITJJfBeF46PvSGIifpwIRp5o9:iilQZuzO4/8RG0IDB4zplp8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3364 msedge.exe 3364 msedge.exe 3104 msedge.exe 3104 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3104 wrote to memory of 4352 3104 msedge.exe 86 PID 3104 wrote to memory of 4352 3104 msedge.exe 86 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 2272 3104 msedge.exe 87 PID 3104 wrote to memory of 3364 3104 msedge.exe 88 PID 3104 wrote to memory of 3364 3104 msedge.exe 88 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89 PID 3104 wrote to memory of 968 3104 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eb05d3cd3b75d062abcc85579390824f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6c3f46f8,0x7ffb6c3f4708,0x7ffb6c3f47182⤵PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5309829613672270715,8456524126149552092,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:2272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,5309829613672270715,8456524126149552092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,5309829613672270715,8456524126149552092,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5309829613672270715,8456524126149552092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5309829613672270715,8456524126149552092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5309829613672270715,8456524126149552092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:12⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5309829613672270715,8456524126149552092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5309829613672270715,8456524126149552092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:12⤵PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5309829613672270715,8456524126149552092,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1396
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2164
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57740a919423ddc469647f8fdd981324d
SHA1c1bc3f834507e4940a0b7594e34c4b83bbea7cda
SHA256bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221
SHA5127ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7
-
Filesize
152B
MD59f44d6f922f830d04d7463189045a5a3
SHA12e9ae7188ab8f88078e83ba7f42a11a2c421cb1c
SHA2560ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a
SHA5127c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD51fa31560d424fbc97927382003a1f946
SHA1ff02ad97d8db9bcb550b7be4822779fb1531ca2a
SHA256de619148d66fc51a204d88c6ac62e33f56bf282f8b843363105bc18cd6c3fecf
SHA512cf1d643ed8dc688d773978222fc28e620656760bbb78dbd2811d19bb9127bb4ea729804acfb71b61e4608fc17024d61dd371f3f14af4cabc5e9f0c54a59245c9
-
Filesize
6KB
MD5b38dea59d049fdd79c7805bd08b21f5c
SHA1bac86f477ce1d869f06cf30ec52ab64c3c184254
SHA25661e4617758f2a296baafc9f69e3abbe37736b29395ed5f35e4189e5cb7e31994
SHA512cd2a31b18f652e6e3adf6664e03a2096bdf86160aa1c4f5616b86028959f7335df9697c5752abd8768321ad272bb8b7316a354924c614b1a5ff6f40eaef7325c
-
Filesize
11KB
MD533ae3e4e469a1d5cbbfea60eae6ca9d1
SHA1119118e815442c2363f9feede7d0e46054d701dc
SHA256d33ad7a9893c23496d0c2205615dafaa0a3c533b2834bac6ae6d59fccf2504b8
SHA512cc02121857ef6719cf8e7b9ae0e486fc4db3650762a989244b9185616f2151d527a6241be78d50df68aa717c2a98589bd5c6260cc4bad00b1cd6e149feb26300