Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 16:51
Static task
static1
Behavioral task
behavioral1
Sample
13a0fc545e4ce8166c0c615716fc5900_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
13a0fc545e4ce8166c0c615716fc5900_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
13a0fc545e4ce8166c0c615716fc5900_JaffaCakes118.html
-
Size
26KB
-
MD5
13a0fc545e4ce8166c0c615716fc5900
-
SHA1
4ff074bd0bef8aae07cf09bf0e754a9d3eb843ef
-
SHA256
e974c3b3161b96f25915791d73639229787a5ee3777adb228eac28ae1ac359b5
-
SHA512
6abbbf77405cbd70ba5db4201eb622bac6cb8bd4f78be925387409b8c829068c566a6321693f2095fe62da42aa9448542debbb9d63311404c600e27afad394a6
-
SSDEEP
384:SI+deX5npye7pyyZOmu0KmL4BGTNMAiKy2zGuMnmmALCe1SH6fbpZUP0DLGHD+bo:ShFhIPtqmmALCe1SH6zpZUP0DMtLFrf
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3028 msedge.exe 3028 msedge.exe 4236 msedge.exe 4236 msedge.exe 3336 msedge.exe 3336 msedge.exe 3336 msedge.exe 3336 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4236 wrote to memory of 2740 4236 msedge.exe 83 PID 4236 wrote to memory of 2740 4236 msedge.exe 83 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 1132 4236 msedge.exe 84 PID 4236 wrote to memory of 3028 4236 msedge.exe 85 PID 4236 wrote to memory of 3028 4236 msedge.exe 85 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86 PID 4236 wrote to memory of 4484 4236 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\13a0fc545e4ce8166c0c615716fc5900_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7046f8,0x7ffa9e704708,0x7ffa9e7047182⤵PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12497133915923194705,7743165142098805218,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,12497133915923194705,7743165142098805218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,12497133915923194705,7743165142098805218,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12497133915923194705,7743165142098805218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12497133915923194705,7743165142098805218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12497133915923194705,7743165142098805218,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2788 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3336
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4280
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
Filesize
183B
MD5a28fc8c7b408c9fec7eb29ba72319a1a
SHA12b1815d04fb077e076a7c078db984304b82cf50e
SHA2561d26a34f3b686ef9b0f4402fd77dbbf4e517c3a60d31f19751f038953abe9e65
SHA5126a6f10e0011b2e2f335d65b2b5da07e47e06aa5eeb22ac8950f63928c18242952d216526c8a2ba909ad04fdaf073215c4277272c6de2a28c7cb39a211f0a78bb
-
Filesize
6KB
MD5f789c6188fd8ff73bb18d6e55d831869
SHA191f6810d80a31f9e5624f639258106c112e51ddb
SHA25680df0f779144677ddf7e359e313970f0f7f266c214c676b6e994dcad8b46cd73
SHA5128f5f3fc06685a60d134ede31aa030ef86b7df18809776c81d34cf6f0b5a6cd250830e157d664215816e7ac199484a6016913d2da7b10375f4c09ad45a0663ec0
-
Filesize
6KB
MD5ac7b1004259ef9df787a9947b6280911
SHA1d296c44251fb3689554c0ace9a44e888f700d207
SHA256c9f6fef3c4e8abb998aec7335501573177a6e3065dd190c63d5e21acd9ebaf17
SHA5121eba23d613410bcf1317e70a55b6f215d61865a302fb6747e643b2ce63817a8f404905efeea9818c8b0e972faae6850d122213da631d05db54cf0b2a31c5ca83
-
Filesize
11KB
MD5b7ddfd30ea072f4f9c071f53791a8b39
SHA1b126b8216c4b5e78156c9b5c5f21ce4f24fa1d75
SHA256a31be6b0e1551e0b6fcd132c39163f32baa61aba105972a575eb09799d3cc693
SHA5126242e7c55f6174cef90e2d37beaa681d9a03a06bf89110c74219839b3d6ec48c710e9935d38836fd7bf57fcd77346952c14840c36574a08d5ae8a22ac44b7c71