Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 03:01
Static task
static1
Behavioral task
behavioral1
Sample
11510fc7513c59ffe19aa653fe8acb61_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
11510fc7513c59ffe19aa653fe8acb61_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
11510fc7513c59ffe19aa653fe8acb61_JaffaCakes118.html
-
Size
17KB
-
MD5
11510fc7513c59ffe19aa653fe8acb61
-
SHA1
8834a0622a0cdce5e23aca7655d596911c48dc06
-
SHA256
5b67ef34993978ae79820e1217ce51805f225c434de8e9a4c34028ae1ec31b67
-
SHA512
f5b0c2f7b87267900dd07e9441a4b5e74dcb44a044498bbc6bc6d6c5806dd1752e0b25864d12788179272f3d7361e01aa8b8785b74f9f527e7fcdde66ce8b8fd
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAI844zUnjBhUO82qDB8:SIMd0I5nvH9svU9xDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2084 msedge.exe 2084 msedge.exe 4660 msedge.exe 4660 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4660 msedge.exe 4660 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe 4660 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4660 wrote to memory of 2044 4660 msedge.exe 85 PID 4660 wrote to memory of 2044 4660 msedge.exe 85 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 4100 4660 msedge.exe 86 PID 4660 wrote to memory of 2084 4660 msedge.exe 87 PID 4660 wrote to memory of 2084 4660 msedge.exe 87 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88 PID 4660 wrote to memory of 1500 4660 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\11510fc7513c59ffe19aa653fe8acb61_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc18ff46f8,0x7ffc18ff4708,0x7ffc18ff47182⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9362723834152880861,9817487491909397457,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9362723834152880861,9817487491909397457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9362723834152880861,9817487491909397457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:1500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9362723834152880861,9817487491909397457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9362723834152880861,9817487491909397457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9362723834152880861,9817487491909397457,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1560
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1360
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
Filesize
5KB
MD5e8d8baa3ddd850c4fc695cb71e6482b3
SHA1d4768301a05cd8a2096dbaa1a21c04d2132e075b
SHA2569b65b13e4228e6f2b1b4c36505f2ae647de86661846fb9399062f331e6ce8b4e
SHA51208c7d4b9009a3921be6c700b355e6fc752491441705b2ea359cc4374cc1ad3a84ea83f98873a6448f7d566bf0b7e77fdfccc626fec7ae71c64394620336e8d33
-
Filesize
6KB
MD501180f34ca39288dec2300adb2874ff8
SHA148df3492ef1ed3a9af67e0c8783c040871767916
SHA2561325b1a6c9bd7d3bc307b7c9e3f8922b71f1899d9ddd60789ab6d1e46ff786bf
SHA51241376c8fe2f11e0429d462403bffefa3f2888ddfff1cd92dc69a52eeca33ec393c2985ff62af25db403efd1c136e64337f10fb7a8fdda2a1ad5db13e86257b1b
-
Filesize
6KB
MD5916f8ed383265dfd622c5dca5d0db7fb
SHA134285b442e5d6b5a8f3c8c289dd0a63679d037e7
SHA256c658c57eaac992ffcf94130ef69a618324c04c6b810c3c15bdc214237b709b47
SHA512073f2d49470652a986b241504ac0e036aa44d75a51c5869f32616a53c658725d94933e6692c2407b64504f329a153d3d1df95f29074a41882c7b8214010ac2d2
-
Filesize
11KB
MD5898b59416c103c00cd6b16370ec9e873
SHA140db38694c099ecad0470ea83f25358e4a188998
SHA2564d16261238b0c2958ddbc10c381c3d49742f60ed8477602b693648640136a9db
SHA51218b623f7f1d410ad4e92b7ed7949cbaf884c16c63221990a35961dd8375a1e0efe9eced491a5f423be273edaa0966cb4561a1323eabf57b366fb779790bf84f9