Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 13:30
Static task
static1
Behavioral task
behavioral1
Sample
054c10aadb3663191ada6b7694319b42_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
054c10aadb3663191ada6b7694319b42_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
054c10aadb3663191ada6b7694319b42_JaffaCakes118.html
-
Size
107KB
-
MD5
054c10aadb3663191ada6b7694319b42
-
SHA1
25f4ef6c1dc270f910a6e4c179bec9ca649febb0
-
SHA256
1391772f30039851002eaac471372de77ec119dea47a25aadd9440cd108558e8
-
SHA512
9721789b4e65cc5de4528bf7d6b89b2ca0c14f0073e7c9ff19164352fd8d1a48799ddb1c4f4690fd875aff588426262bf04a1ba6ca0a0eb98758b520691338bf
-
SSDEEP
3072:zoQ366Jeb0g/hR7BhuISmAZsvSTqV6w1R/PEuU3JKjVXvngVhPofNn/u4:zoQK6Jeb0g/hR7BhuISmAZsvSTqV6w1f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5036 msedge.exe 5036 msedge.exe 3652 msedge.exe 3652 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3652 wrote to memory of 3464 3652 msedge.exe 81 PID 3652 wrote to memory of 3464 3652 msedge.exe 81 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 4564 3652 msedge.exe 83 PID 3652 wrote to memory of 5036 3652 msedge.exe 84 PID 3652 wrote to memory of 5036 3652 msedge.exe 84 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85 PID 3652 wrote to memory of 2836 3652 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\054c10aadb3663191ada6b7694319b42_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff61f746f8,0x7fff61f74708,0x7fff61f747182⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,7229138874387737487,625484896725569430,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,7229138874387737487,625484896725569430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,7229138874387737487,625484896725569430,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:2836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7229138874387737487,625484896725569430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7229138874387737487,625484896725569430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7229138874387737487,625484896725569430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:12⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,7229138874387737487,625484896725569430,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2744 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4624
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4576
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
372B
MD53b681be8660cdc5acd2f1ddc74897974
SHA19050eaa8c5561758269dc187161127caaee20876
SHA256810d047241af0e791d62db6e8c1c2a95c6bd0aec7790aacf7452b8d1aa495af4
SHA51211ed2298a8eb7a31cd96b6155c882feb75c2bfcf7af928548d208c767b6dcac440f1c5647d798323424394f1dd971d6fc829209dcc6c2c519776fc0a4db0cedd
-
Filesize
6KB
MD5303eb7c89243a06113d2c97524c597da
SHA108656cf285f1c525642bcb4fd527a20daa74758d
SHA256cb33ab308d23e562dcea9cc39494fd516dd4bbe707a38e32b399a7fd102b6e90
SHA51297ae6449ebfb04feb7dc33202d2e6ff81e6c6050ca30c7f945bd2e28ea643adb35e7f4e02fb4e63b452522217811bc895b85576889968e39e634e71046d4dcb3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cd63a897-85f8-4430-bf59-c1b4a1b36120.tmp
Filesize6KB
MD5af6481910da249b50f2c6a7a781d7edd
SHA1a4db659313572e5ef8b7643032ba8fd6fd139925
SHA256066ce42770f16a996dd72b2445d86d23dd0c18551fdb01b6b3ebb3dea958f488
SHA5126000b2f8d05adceb6cea2f68300ee241ab6a2e543b9dcb6366c6d7be6f72f298294c2daf447887034983118ff5d2a01affa16ee665c15bfa56415e88f30f9e5d
-
Filesize
11KB
MD5612e23214b54001731673e08467b5caf
SHA10eb2f074c6ef86040787d6c958ed7025e522c7bc
SHA2567b7ca1df7a04a83f40fe663cb767099ff9e14024e5e4bcf0b89651133c03f24a
SHA512147594221ce26cff3391c0d489bce9ec7e0c2761ea83729c994738baf106cf5e2201c5232571648aba06ca06129a24a20dfde26ab62016ecc227957b477e9fe6