Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2024, 11:37
Static task
static1
Behavioral task
behavioral1
Sample
106ba4bd562b79d2dcadbf5b90787585_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
106ba4bd562b79d2dcadbf5b90787585_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
106ba4bd562b79d2dcadbf5b90787585_JaffaCakes118.html
-
Size
213KB
-
MD5
106ba4bd562b79d2dcadbf5b90787585
-
SHA1
ff0ef15212f232bc3c47c3e50fb18f1d7ecb1724
-
SHA256
ed394fc2a65a41364855449d05afd7afd882063ff154b8d601bd300c4b74b06a
-
SHA512
54fa5b842a4b835bb3d609cda68292c500b5951b00d6741b19500daf14e61d7cd9ced3a75146d8ca5ff59237905b3eec6f36afc1fb4b74bfa25aa78e087e5021
-
SSDEEP
3072:SKJ6n+Jpf0a8yfkMY+BES09JXAnyrZalI+YQ:SKFNhsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3192 msedge.exe 3192 msedge.exe 4416 msedge.exe 4416 msedge.exe 3844 msedge.exe 3844 msedge.exe 3844 msedge.exe 3844 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4416 msedge.exe 4416 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe 4416 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4416 wrote to memory of 3164 4416 msedge.exe 83 PID 4416 wrote to memory of 3164 4416 msedge.exe 83 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 2072 4416 msedge.exe 84 PID 4416 wrote to memory of 3192 4416 msedge.exe 85 PID 4416 wrote to memory of 3192 4416 msedge.exe 85 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86 PID 4416 wrote to memory of 3276 4416 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\106ba4bd562b79d2dcadbf5b90787585_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffb47a046f8,0x7ffb47a04708,0x7ffb47a047182⤵PID:3164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,2526404602862341874,16338818429721644909,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,2526404602862341874,16338818429721644909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,2526404602862341874,16338818429721644909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2526404602862341874,16338818429721644909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:12⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2526404602862341874,16338818429721644909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,2526404602862341874,16338818429721644909,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3844
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2848
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
Filesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
Filesize
5KB
MD5ff2c82ceaee894344b84355f41d5347c
SHA12273c7db70a3078f7f11eab493744de5dc8b7788
SHA2564e64b3d7893c4358452a0e2b19656598aa6ea01e25cbff768601a6ffe201d41e
SHA5123c470b0a0593ca3b483ef85b02d724eb2eaf5aa2477384e236700242c8808349a56fa42df47cfa95369016ff8e3db5aceb2818445530a2cf8f60d87a2eeaae55
-
Filesize
6KB
MD5a03681a6da05d271117cf7c400fe6cf5
SHA13187769bff02fd1a77c3a34d97c887001d275e7a
SHA256e22a7bbb2d0caacb542f91d4c6cfeec96b75781082321993276e34938f16bd4e
SHA512a110bf71279452a511c2b204cfcc0ed4d4a9f2a4def67928dfa3cd0725b783a37a0618779a03796b6a3153f24eda4b7b459db906f584098062ca589e951cfead
-
Filesize
11KB
MD54f0809006ba1285459265bebde0c3895
SHA131e3fb87d4e655783f298696ffe9962e5329a27c
SHA25604b565149573dc04828aa77ed6d391a7f41886386313b9353f13a4b511781c36
SHA51276e521d4777a60dd64eb009aab1aebfa8df1c994f7978462992633b632aebc4d195c5f0fc586d5f421aea96bb305b95f06aae32f1b31a79272fa60926c4b247d