Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 22:48
Static task
static1
Behavioral task
behavioral1
Sample
0f0f80e27cdb2a1682f685277760caa4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f0f80e27cdb2a1682f685277760caa4_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0f0f80e27cdb2a1682f685277760caa4_JaffaCakes118.html
-
Size
349KB
-
MD5
0f0f80e27cdb2a1682f685277760caa4
-
SHA1
c58014c0409a2dbfc8dc96381d98dd982d401228
-
SHA256
30065fe9a187c97b2d6b54d25479f4b00e89b5f113f97bd8e1945611a6220c15
-
SHA512
2573c7e24ae5518231dc930d7bd31b94871aaca7f4cf6c232323e958fce6c6f221d4c1a559e0749abec4fb00df1a556046346832aa477559503a0d29fd0706fa
-
SSDEEP
6144:SisMYod+X3oI+YQesMYod+X3oI+YAsMYod+X3oI+YQ:55d+X3p5d+X3Y5d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1108 msedge.exe 1108 msedge.exe 1796 msedge.exe 1796 msedge.exe 3044 msedge.exe 3044 msedge.exe 3044 msedge.exe 3044 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1796 msedge.exe 1796 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1796 wrote to memory of 1212 1796 msedge.exe 85 PID 1796 wrote to memory of 1212 1796 msedge.exe 85 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1860 1796 msedge.exe 86 PID 1796 wrote to memory of 1108 1796 msedge.exe 87 PID 1796 wrote to memory of 1108 1796 msedge.exe 87 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88 PID 1796 wrote to memory of 3184 1796 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0f0f80e27cdb2a1682f685277760caa4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa44546f8,0x7ffaa4454708,0x7ffaa44547182⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1376844782545529227,15375971439495076223,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,1376844782545529227,15375971439495076223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,1376844782545529227,15375971439495076223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1376844782545529227,15375971439495076223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1376844782545529227,15375971439495076223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1376844782545529227,15375971439495076223,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2584
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
Filesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
Filesize
5KB
MD5879bac7000580cffc5fba4c307b4559f
SHA152aabbf87ef7f03d3d2c1f89d65ac0539a750f17
SHA256732fd6c896688e8220eb9bf9cdce8e69b1ce0f68025f4312d6be9577aee4a51e
SHA512a2d1a9486ac33a6442762ba966b16271d8c9f252ddf631b264da52fbc4e5b901303439bb5f5518a4dc29a07dff93e56b1ccea93c50a5d395215456f372ac55ca
-
Filesize
6KB
MD56a308900f216a50fd1b68fc4ea9122af
SHA1c00dc4e1e2ad9e6493a87396483e58b9318aa265
SHA25626438a6e51a1ed712c43eb5ba6a5fba619a394aa4dca4630c86a9ade88fcfea4
SHA5124ed9d99158fd09fb66c2e2297237bcf7105b92230386b3906ff314d4bd839b42953aa730b51ed541f53f5f3d9bca1bf40668b17191e81aca7b59d970fb539237
-
Filesize
11KB
MD52c80c995c52b8c7028c9a753a9328e15
SHA1105d9dc64f7fff2a957a8c5c1e1fba7f2073229b
SHA256ef8909d4fdd58277ab80f813a081ba1a145ef857a011b369adee5a9826870abc
SHA5127c684efda6e2c85b57e4b1f34656dc8db2fcbcd46dbe5673cc368c8ead6e13463fd91cfbef1a702712cc5eb6292344d806b6ed6cdbbbb4612f253c19ec05bd9c