Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
14a365604eb14f6f2dc1531512b95b17_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
14a365604eb14f6f2dc1531512b95b17_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
14a365604eb14f6f2dc1531512b95b17_JaffaCakes118.html
-
Size
18KB
-
MD5
14a365604eb14f6f2dc1531512b95b17
-
SHA1
d5eb2af59ebe8364f1ffc73203c87eebbb61da41
-
SHA256
131c89155bea3f1bdeefae1aa38b6851261e11a3fdfa33a970e5796177dba647
-
SHA512
4fff4964c2e1fff356a889726039b539240ad7afd525e9801f756194eaa0281e0ce6966d196288a0ea529cb221fb358ecf14877dbe22c555c5cbd0192cb3acd4
-
SSDEEP
384:SIMd0I5nvHvN5Z71HHHBPc52Lsvx7pexDB8:SEAN5Z71HHHBPc52L2leA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3564 msedge.exe 3564 msedge.exe 3788 msedge.exe 3788 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe 4500 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3788 msedge.exe 3788 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3788 wrote to memory of 1444 3788 msedge.exe 84 PID 3788 wrote to memory of 1444 3788 msedge.exe 84 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3684 3788 msedge.exe 85 PID 3788 wrote to memory of 3564 3788 msedge.exe 86 PID 3788 wrote to memory of 3564 3788 msedge.exe 86 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87 PID 3788 wrote to memory of 2100 3788 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\14a365604eb14f6f2dc1531512b95b17_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa643846f8,0x7ffa64384708,0x7ffa643847182⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9810399400291952792,11678089400529879790,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9810399400291952792,11678089400529879790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,9810399400291952792,11678089400529879790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9810399400291952792,11678089400529879790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9810399400291952792,11678089400529879790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9810399400291952792,11678089400529879790,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3392
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58b2290ca03b4ca5fe52d82550c7e7d69
SHA120583a7851a906444204ce8ba4fa51153e6cd494
SHA256f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
SHA512704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
-
Filesize
152B
MD5919c29d42fb6034fee2f5de14d573c63
SHA124a2e1042347b3853344157239bde3ed699047a8
SHA25617cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
SHA512bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
-
Filesize
5KB
MD53717f9a9e31e00dcfad4ade4297a8df9
SHA147c2d7381fa5b9042157cdd5f9ca6c45e5525220
SHA256b879dc9844d36cac96e99a1b92d8db0b294f76003f16ae49c29fa76da4b1c4a0
SHA51270038ff8597a0207101306f1b4865ed407a3e85ed61abe8069eea1377c3721af1a1e84a54ab97e09e7189657d36d24f2c40b0fb04cb3b63f1d139a158c1ae00d
-
Filesize
6KB
MD51a2d799406f85b2134f2a0d02ce07fb1
SHA125e49fd8f03c445505cf2323bad08f4f8202f9b5
SHA256ec9274f5fd123df2dc6e7d63977fe67e427559e610a5b40fa98c5f3b2a1ae63e
SHA5127dfaac529a1742e2c69522bd149909a5759262e05b8388716ff591141a0df45fe93b070cab97ecd3ab725c2a79b9408ae1d7f74423ddd55919240de00e07ae02
-
Filesize
6KB
MD596623bbaab2130a46d7e750278fe7e6a
SHA1e3780ecd3f98d625b388e6e65625dcdbede1a16b
SHA25683c79983fe422b22acdde7581a8d2bc3dda06c9c931e9da3c2be2185c7b4a89a
SHA512807b187d45c5ceefb87c8f323d00372e314c4b717724a7213938f652b20c33c4ae036a5d08177bccf82d421487c19bcd99ecffe7993f8dfcd9bf864c3a94a48e
-
Filesize
11KB
MD569d652b8f558b1904e09e731ff68cf69
SHA105373761b523d0df2a01d7e6ef4d0563773f2644
SHA2566501410fef588a4c627f89f675002f65fab632507d35d7ea617991db6eef9ae2
SHA5122e5bdca0565242482a3263ba548e903ed9dd0d82cd1d2088b7a80742ac96cbf756bb62fc63a58bf0c7ecdf6e647738bb031e78ba17b5d25533711c8d8a0c1c53