Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 18:08
Static task
static1
Behavioral task
behavioral1
Sample
f65e61fef44baf841d7a7ec37012c0be_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f65e61fef44baf841d7a7ec37012c0be_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f65e61fef44baf841d7a7ec37012c0be_JaffaCakes118.html
-
Size
13KB
-
MD5
f65e61fef44baf841d7a7ec37012c0be
-
SHA1
e9797c3ad75bcffb26b491f277c3d86c0e78ae71
-
SHA256
54c92fff0e84a3631f3c254c91a97dd9c8ed9f3c6529e2528a223b4051db8d54
-
SHA512
f35f3f752d673cd51f2d495689854c1edc18765c812413cb0fe0c9c03502d0dc9968b4abf5db52d7774072ee7425451e054a91b9bc9aa133e5251726abf628dc
-
SSDEEP
384:vfbTSDDTXGerWtNsQdEsFj6XjK7MpT2W+W:vfXSDDKeeNVajK72TN
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4072 msedge.exe 4072 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4664 wrote to memory of 1492 4664 msedge.exe 88 PID 4664 wrote to memory of 1492 4664 msedge.exe 88 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 1740 4664 msedge.exe 90 PID 4664 wrote to memory of 4072 4664 msedge.exe 91 PID 4664 wrote to memory of 4072 4664 msedge.exe 91 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92 PID 4664 wrote to memory of 992 4664 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f65e61fef44baf841d7a7ec37012c0be_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecdda46f8,0x7ffecdda4708,0x7ffecdda47182⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5030256555542462266,13218054067265950744,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,5030256555542462266,13218054067265950744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,5030256555542462266,13218054067265950744,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5030256555542462266,13218054067265950744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5030256555542462266,13218054067265950744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5030256555542462266,13218054067265950744,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3200
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e2ece0fcb9f6256efba522462a9a9288
SHA1ccc599f64d30e15833b45c7e52924d4bd2f54acb
SHA2560eff6f3011208a312a1010db0620bb6680fe49d4fa3344930302e950b74ad005
SHA512ead68dd972cfb1eccc194572279ae3e4ac989546bfb9e8d511c6bc178fc12aaebd20b49860d2b70ac1f5d4236b0df1b484a979b926edbe23f281b8139ff1a9ac
-
Filesize
152B
MD5864aa9768ef47143c455b31fd314d660
SHA109d879e0e77698f28b435ed0e7d8e166e28fafa2
SHA2563118d55d1f04ecdd849971d8c49896b5c874bdbea63e5288547b9812c0640e10
SHA51275dce411fce8166c8905ed8da910adb1dd08ab1c9d7cd5431ef905531f2f0374caf73dedd5d238b457ece61273f6c81e632d23eb8409efbb6bf0d01442008488
-
Filesize
6KB
MD5995a238c97da27592a8e9c655b57c42c
SHA1a49ade9169d6fd7f8bf8ffb79890f32989a689ec
SHA25653602a7d5851edd22df34b38103ddbdb195707abe130f4b52a5aa1c805cbb714
SHA5120623d45ea1ab1ac01d4afe071f65200ba4e6bee66b94dc332c3e198c3e5936eec147485568a305ce86b853e8ea407967ea6fa851acc2bda164c99bc608eed7fd
-
Filesize
6KB
MD5569dad791bfa4feb093d91c2581f3f5e
SHA1a7aa196ea13d1bd09147be0d4df2fae68b00b4b8
SHA256a58ad0c5574c5acffe76b9c46b258c951bfcc9a9cbb9a1f653ca2589b94753f4
SHA5120c1b7e2703046f7e910cff2e47d2aa7bc6ccd771adebdf2ad5ad943fd91541e2003b5a4c451b16cd45d4d89bc8a02ec3023eb5df8e64c70a78cf372cff125901
-
Filesize
11KB
MD5c3947c95163a1f6d2ea67b32fd540394
SHA12cc1d004a650abdcfe04bad7515076bb059ed4c6
SHA25613d8e1b486f68f436ef686d5b3fca974696e48a67c4b16d6bbd219201680afea
SHA51209fdedf8e67b4036af6572b4da2fb017c68001a7d14c097d17037524b1a52da3ff6bf6eac5d01385e6d62b8cf2206141920cbd65a62bc5b43a5bebe1b66ada5e