Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 02:59
Static task
static1
Behavioral task
behavioral1
Sample
0244270699cda2e127e2b2b9ac8e88ac_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0244270699cda2e127e2b2b9ac8e88ac_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0244270699cda2e127e2b2b9ac8e88ac_JaffaCakes118.html
-
Size
3KB
-
MD5
0244270699cda2e127e2b2b9ac8e88ac
-
SHA1
35117e13b49d85207b40b95d79324a91a59b2023
-
SHA256
d16a71004c7a867ae5fc42fe31ca6857f674a0e7b5513c1b3da682e6f7edb573
-
SHA512
2ae5270b54d8e7a9f20de9ec4031cbf415b29562d36c51018d777157e70c3c2b040d977d4420fe5fe17ed01b1247ae3120b616d53793ab161a8dd3af820be53f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2256 msedge.exe 2256 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2440 msedge.exe 2440 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe 2440 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 3316 2440 msedge.exe 83 PID 2440 wrote to memory of 3316 2440 msedge.exe 83 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2040 2440 msedge.exe 84 PID 2440 wrote to memory of 2256 2440 msedge.exe 85 PID 2440 wrote to memory of 2256 2440 msedge.exe 85 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86 PID 2440 wrote to memory of 2036 2440 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0244270699cda2e127e2b2b9ac8e88ac_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c02546f8,0x7ff9c0254708,0x7ff9c02547182⤵PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5972053222441231572,82531135045155001,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,5972053222441231572,82531135045155001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,5972053222441231572,82531135045155001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5972053222441231572,82531135045155001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5972053222441231572,82531135045155001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5972053222441231572,82531135045155001,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3268
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4736
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
Filesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
Filesize
6KB
MD5e3ae5e7ba5c821ccbc32a75b82e8ae3c
SHA13ab23b904d326bd922802f305b1d050039076826
SHA256b6bfd4d4e19bc3e5f0b456c0b5e60552b9e3df9e6dd6164a1b91431c8f04ef95
SHA5120b9aeddc5dd1d2073feca9265793a360bb16dcdf1a0bce86c82ed09a9400e00204e3fbf2b1f0640ef14b5801dfe5dd7267c60a9d1a2cc80e74bbfe023ba87eb0
-
Filesize
8KB
MD58c4985c8ae51828f30b7169c829459c7
SHA1db9c4096cf4c8315bf9184beb42f94befd264e4e
SHA256b169a34160eb9058206e8d079767c2645bc2eb60444af3a88825b8a283a1d32c
SHA51275790f23f495d7f9d6c03a5cdf267ad443ef7c522ea7da0e25f5d3e47e0ab5851fc6f821d0dbd63e04a2f9d8a430f2a8b458749e033e70ac59539b97c18ccd46