Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 07:25
Static task
static1
Behavioral task
behavioral1
Sample
11abb7d3a0c91f82e1d2aa1baeaceed2_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
11abb7d3a0c91f82e1d2aa1baeaceed2_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
11abb7d3a0c91f82e1d2aa1baeaceed2_JaffaCakes118.html
-
Size
218KB
-
MD5
11abb7d3a0c91f82e1d2aa1baeaceed2
-
SHA1
f536382c811b93c92cb85e62b366fd0b6dca493c
-
SHA256
a6d19504211f5ac65dac334e054aabd5fad39fbeed41d0c2859e7f8a15d3e4c6
-
SHA512
c0d31f199cfab30da42eae972121451526e0f1cd356023652968d610c789da92b6d29ab4fa799463d463c532b0ae033cedb5b796b29e84b5db2a4d5c6311e9b9
-
SSDEEP
3072:SfesizTGDwxyfkMY+BES09JXAnyrZalI+YQ:SfezzepsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 372 msedge.exe 372 msedge.exe 4052 msedge.exe 4052 msedge.exe 3444 msedge.exe 3444 msedge.exe 3444 msedge.exe 3444 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4052 msedge.exe 4052 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe 4052 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4052 wrote to memory of 3560 4052 msedge.exe 85 PID 4052 wrote to memory of 3560 4052 msedge.exe 85 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 960 4052 msedge.exe 86 PID 4052 wrote to memory of 372 4052 msedge.exe 87 PID 4052 wrote to memory of 372 4052 msedge.exe 87 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88 PID 4052 wrote to memory of 2260 4052 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\11abb7d3a0c91f82e1d2aa1baeaceed2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeb4546f8,0x7ffdeb454708,0x7ffdeb4547182⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,154935657599308849,886739178617887385,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,154935657599308849,886739178617887385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,154935657599308849,886739178617887385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,154935657599308849,886739178617887385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:12⤵PID:4736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,154935657599308849,886739178617887385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:12⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,154935657599308849,886739178617887385,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3444
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3852
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
Filesize
5KB
MD5c0c0ba906d72069efd22ac5c82a0f78c
SHA1742b77c8e86f134166925370d85398d20223f61c
SHA25682c70ae3f11ef9dc00df4969882bd814da0cb4c4b73b42515c092c2e59cb92ec
SHA512d36db02d592a3ecbaaf84f5c2b2a1f13a494e41340036370b42b5ab82f5c09ee53d944f3f00188bdfc6b96950118bdfc42d620c17d2f16a32dd231dd06b42fad
-
Filesize
6KB
MD5d8f120f266f2f26e20fc20d5f78da238
SHA10aad5e047a66fcac6a68b4d26b4107a570806685
SHA256f65f0f992d4a563bf2db3f0e71d28c39bb244d7b5785959478ad2e35799030fe
SHA512474c3765353769e3e483be62021eef7ebdd31eeb7eea790c4ac9982ca88188718487555689b01539cee96170243ccc54ccc6ee5ff0ccef81d08c8164cca6fa4b
-
Filesize
11KB
MD5a91ad0e933a898836317647412b3ae65
SHA12e6f642377c6caf9b10519f8c37df12c38fbb758
SHA256ea2017564dea085bb2f13386bc1449a09da9aaecb6b060f882a34fd05c175c34
SHA5129c13aa715bf9cf5ced4573ebdd0f40071ea241cb69663eba6acdd3538f8414fc4e353267bd749f984adefa95f4a6c1cbffbcfe7609d678d523c96b759867371e