Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 04:44
Static task
static1
Behavioral task
behavioral1
Sample
0b14fd2fb7bea0dc26ed80ddf2ecf087_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0b14fd2fb7bea0dc26ed80ddf2ecf087_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
0b14fd2fb7bea0dc26ed80ddf2ecf087_JaffaCakes118.html
-
Size
218KB
-
MD5
0b14fd2fb7bea0dc26ed80ddf2ecf087
-
SHA1
1edf11586603fe5ea287bb7fe71dbe527bf04a6b
-
SHA256
4654244020b222761a49286e14811c1c3c3742007a6ed3bd67a7823375f77021
-
SHA512
d4ea46edf8b4964179092373e4b31ec547f3018ddd870acd7bee614743fd8ed312de5bffd4b84c5f01262bcf2c5a56a64e7a51c308a405b97aff7bc353dfe3b1
-
SSDEEP
3072:S5cWp1BqjHzyfkMY+BES09JXAnyrZalI+YQ:S5cWvBqjWsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2000 msedge.exe 2000 msedge.exe 3660 msedge.exe 3660 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3660 msedge.exe 3660 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3660 wrote to memory of 852 3660 msedge.exe 83 PID 3660 wrote to memory of 852 3660 msedge.exe 83 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 1700 3660 msedge.exe 85 PID 3660 wrote to memory of 2000 3660 msedge.exe 86 PID 3660 wrote to memory of 2000 3660 msedge.exe 86 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87 PID 3660 wrote to memory of 4500 3660 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0b14fd2fb7bea0dc26ed80ddf2ecf087_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8daf946f8,0x7ff8daf94708,0x7ff8daf947182⤵PID:852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,17166272658381637075,15211202813942284694,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,17166272658381637075,15211202813942284694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,17166272658381637075,15211202813942284694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17166272658381637075,15211202813942284694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17166272658381637075,15211202813942284694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,17166272658381637075,15211202813942284694,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3676
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4188
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
Filesize
6KB
MD5add72a53983dddfb6c67e8f80e10082c
SHA1de9cde3a3ec376aa8f9c94dc3ae8e82ae0189add
SHA256e38236f11771465250224fec8f8fc088ad1d304889914e21fb2557955af67e0a
SHA512d2034b0dce516efd49ee95fbf597ddf2a4786dab2ee8c62da886241707eda7b20c4dc9d1dc74720ce46f5729d3d3d016f55bf71f0c311168be5db80f8a5d2e9a
-
Filesize
6KB
MD5892c275cab5fe0c48382201b820c0e23
SHA1c64884ed793c1d3dcb30eca3bf017e6bb06f5944
SHA256ac916e7c3479c44f97bb18f5dce44b68f20c0cacd69df29d184332d92c1b223c
SHA512865c2ad13ab7c95e19ac9735148f0da22fdece38be4e79dde8d6ea43e2165165a6b147931ab22413683f2dc11a6a23d72a4d190ba953aa83e93842fd8cc16a19
-
Filesize
11KB
MD52a1b0837e8ede3c988a6ae3c96546514
SHA11d3df74da4729d355b75443bd9c8647f8e2dba3c
SHA2567f9d1956010443bf96d3c8b5b74aa04161f0845d294887b06fc3642972a37f1b
SHA5128233dcaac60032434955efa49e71328624f68e7bc3a16eb4ac85e1860ce5a0a06ebad33206c720b183fd3d0a772c26d5b55182d287bae652016b8dc3aa7993fd