Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
133104902841935e7abcbad35627a0c6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
133104902841935e7abcbad35627a0c6_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
133104902841935e7abcbad35627a0c6_JaffaCakes118.html
-
Size
20KB
-
MD5
133104902841935e7abcbad35627a0c6
-
SHA1
69a5c190b49aaa02a884da4655603383b077f051
-
SHA256
229c22191e677a5490727695d1c90afd214d3101180c48f6f23128c329d497b3
-
SHA512
1bce48f283eae58fa4dc3b99fb4dc9e47ca9b0b35b002e727879910ee8f0aad565eb44e93065188fba84ebffd319b8443950b8a3c4f8220aef38feb57b76b97d
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAI84OzUnjBhC082qDB8:SIMd0I5nvHPsvC3xDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3588 msedge.exe 3588 msedge.exe 4092 msedge.exe 4092 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4092 msedge.exe 4092 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4092 wrote to memory of 2848 4092 msedge.exe 83 PID 4092 wrote to memory of 2848 4092 msedge.exe 83 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3252 4092 msedge.exe 84 PID 4092 wrote to memory of 3588 4092 msedge.exe 85 PID 4092 wrote to memory of 3588 4092 msedge.exe 85 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86 PID 4092 wrote to memory of 3480 4092 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\133104902841935e7abcbad35627a0c6_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2df146f8,0x7ffa2df14708,0x7ffa2df147182⤵PID:2848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10631059465299068591,14760870117717540479,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:22⤵PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10631059465299068591,14760870117717540479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10631059465299068591,14760870117717540479,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10631059465299068591,14760870117717540479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10631059465299068591,14760870117717540479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10631059465299068591,14760870117717540479,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5108
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4412
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54e96ed67859d0bafd47d805a71041f49
SHA17806c54ae29a6c8d01dcbc78e5525ddde321b16b
SHA256bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d
SHA512432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7
-
Filesize
152B
MD51cbd0e9a14155b7f5d4f542d09a83153
SHA127a442a921921d69743a8e4b76ff0b66016c4b76
SHA256243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c
SHA51217e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d
-
Filesize
5KB
MD59b7145de4a983873e6cbc5d894984ce5
SHA104e2bcc3ba2496b1c7cb5715f82e560774cf4646
SHA256c749e8c19827789584cb055668c6c1e73846d686fe622a377552696796b0b561
SHA512c8f2020c3440360ca7407062ddc9f70701ecd16a756fc8d17a83a28f4aa0f7610b727ca30f9678f0adfc0d8d56c6e3fad42b6b4bcbaa5f5de4c2225c16b24fe6
-
Filesize
6KB
MD5e632d0c8b5ecef8a9f8adeb890f05604
SHA1940c61b1f0f45e42daee6163b806b9eb293fafba
SHA256beaf5b97af9fc04e3951a7e55a6ded3babb460d2f408f4c9f14521a39cc419d7
SHA51284b4f247a5c53670e55d0c1c3f183fc406c72cba5ea5fb0a80d45b70081054932bbd38ac69b98ddb40c40e5df1f40f05234e8aaed2b4f8b5794bd8ce887cbbb3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d554d953-d049-4afe-8478-f13cd7c36c96.tmp
Filesize6KB
MD502c9e4fcda85eaf7184a1d502a553ef9
SHA1caf5d51f80eb93a5e39ae9d2135e7d4bffa53db3
SHA256af2c8fa2659699d2042c421e27879adfd11d0c1d5f988af5f83c87c876eb0ac3
SHA512875d0627b4bbf26cd6fdd97df9ec4e314bf1de842429e0440820e8391ebf0f6b433c9c120a924d4c1706d59d855a7c027f851ccfe5b6a14ccad814aaad2c04f3
-
Filesize
11KB
MD5162e6db707748460231b18789c0533ee
SHA1e4384aa37b206f010d070ef48ee92880a0a2c2e6
SHA2568c5bde5242c5afdbba690c580eb0dc188069c5b9539a18cade7385af3ad8d172
SHA512769fe01af04093bc275a0d6adc398b8cb8b803b71c97ee2c1b4bdd6e57b9b6273574fc92a9cfcd1921c04012eaaaba48e89f32695d9cebeaeca1123490d1c43a