Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
17ead75f6aafb900bc77ca41d3a9ae3f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17ead75f6aafb900bc77ca41d3a9ae3f_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
17ead75f6aafb900bc77ca41d3a9ae3f_JaffaCakes118.html
-
Size
18KB
-
MD5
17ead75f6aafb900bc77ca41d3a9ae3f
-
SHA1
92314ccbcea18f4da70bcb98d6474f93e7a1ec28
-
SHA256
d09e20155e3aca4ae7d1d04e1154d2d99efb2ad7e32a9f7ba0b69f1843ad1acb
-
SHA512
699780cb364c88c854913d6d05d474a42657b25f7ed202ce484d96e88ac4b2598b96e18f966180519eb99ac16e87416ab31736017f53a9e197dd96d13f58108b
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIQ4azUnjBhuw82qDB8:SIMd0I5nvHXsvuzxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4848 msedge.exe 4848 msedge.exe 3064 msedge.exe 3064 msedge.exe 4576 msedge.exe 4576 msedge.exe 4576 msedge.exe 4576 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3064 msedge.exe 3064 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe 3064 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 736 3064 msedge.exe 84 PID 3064 wrote to memory of 736 3064 msedge.exe 84 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 3784 3064 msedge.exe 85 PID 3064 wrote to memory of 4848 3064 msedge.exe 86 PID 3064 wrote to memory of 4848 3064 msedge.exe 86 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87 PID 3064 wrote to memory of 236 3064 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\17ead75f6aafb900bc77ca41d3a9ae3f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9c4d46f8,0x7ffd9c4d4708,0x7ffd9c4d47182⤵PID:736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11256220499527007318,16068830727030547789,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11256220499527007318,16068830727030547789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11256220499527007318,16068830727030547789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵PID:236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11256220499527007318,16068830727030547789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11256220499527007318,16068830727030547789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11256220499527007318,16068830727030547789,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4576
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2036
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
Filesize
5KB
MD5f8af554f3e9fb7c1e8065cb4ee6efcc1
SHA11d374159707711f13479ba4f0f3b60eb114f9ae3
SHA256715d70aabc12634d824b6e3622f3d02be9a28e6f5c8944bd0b403e9073d5b736
SHA512c0c00c97216ffdddef8861b2a9f8f4ea53464bd2b96580ffc8f9a5e0ba35dbaf6aee000c58ae7b347ab5dc8290de2bb6eebddb919b1d5830aa49259e6063aa2b
-
Filesize
6KB
MD5074555094f99bb46667f26cd0ec2af29
SHA115994d4242c5c8141110330e3ce77e8a7c431b2f
SHA256a01f6157c0df164ae3cc319ccf6653557eb761ea264c88438a8479f255c93684
SHA51200db35a8bda55a2f4b1452c4ff9edda43e3c5adcf67f304d49695586c5a2e7a8cdaf2b4d70d72a5406d2703462be3b1e89731b706ecc8b4748ecfbf735ef8a72
-
Filesize
6KB
MD5db8c18b73cb0fd8aa7598f9b3df620c1
SHA1e8f446bd05c04c6da568b0591bafb891f9b87a08
SHA2564667b776d08ccaf42e684fb2d38852ebe9aad3e97725e8aa884ebd88e6b11a55
SHA512655dbad8a04e6dde5a1f69d28a3ce2460b47f8a4096964fd50d9da938263431c3a31307c3d56d70525064e18f519f0dd3694d14e50389d52901d5a5a9e880e67
-
Filesize
11KB
MD58868900b0f49ca474a9c0f9806153448
SHA1505de1d14270e27ba955312f3658a9efc9023fff
SHA256456f9aeadcd0485491925aaf1e6adca7c25563c008f6cfa37b4e855b098443a2
SHA51279aa3607bc65569b91eaf2a67b498e51f856bed51ca7a04f231dbe506a4e1cbaeae08e16792e57183daee9313c71f9520ea1def5b85db20ae32eb0aca9c6192f