Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
21d1455e2e9c27647e4f60eade42ee38_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21d1455e2e9c27647e4f60eade42ee38_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
21d1455e2e9c27647e4f60eade42ee38_JaffaCakes118.html
-
Size
193KB
-
MD5
21d1455e2e9c27647e4f60eade42ee38
-
SHA1
8aa528dce4c251ba23f5493510749de045755b70
-
SHA256
ccbaaef7228f97de21bab96a741e0944f30b7b124d83c71f60060d63aebac1f7
-
SHA512
de97767bd5b55be7185b958ae066a272cfe18b2891d7727c5cfd3908d297f55e29f37b1a121abcf225784056297b43237dfb2940bbb79917a7244736e6ee8f21
-
SSDEEP
6144:hPll8iGtMSkZxB64GtMSkZxB6AGtMSkZxB6XZFk:XlDzSuP64zSuP6AzSuP6s
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5024 msedge.exe 5024 msedge.exe 3464 msedge.exe 3464 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe 4520 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe 3464 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3464 wrote to memory of 2492 3464 msedge.exe 83 PID 3464 wrote to memory of 2492 3464 msedge.exe 83 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 1536 3464 msedge.exe 84 PID 3464 wrote to memory of 5024 3464 msedge.exe 85 PID 3464 wrote to memory of 5024 3464 msedge.exe 85 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86 PID 3464 wrote to memory of 3812 3464 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21d1455e2e9c27647e4f60eade42ee38_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffabfa46f8,0x7fffabfa4708,0x7fffabfa47182⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:1536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:3812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:5240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:12⤵PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5144 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4520
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2200
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58b2290ca03b4ca5fe52d82550c7e7d69
SHA120583a7851a906444204ce8ba4fa51153e6cd494
SHA256f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
SHA512704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
-
Filesize
152B
MD5919c29d42fb6034fee2f5de14d573c63
SHA124a2e1042347b3853344157239bde3ed699047a8
SHA25617cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
SHA512bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
-
Filesize
1KB
MD5725808e930ebbb1cd379b40e01a34177
SHA1edf387e90e9d5edd0d6a2a5f625a31878124280c
SHA25625b996b91726d86c92f86f07a158915fa12a68f70f941d5e58a19ddfce603c90
SHA512add40afc5ab6a3d21d6b6e8f3a9d0526c71fd793b5337268fd3066cbef4abdccfeac4d695f57db593d12914f4a3607294c844767cc4131acf0666e3cea709ac4
-
Filesize
7KB
MD5fc138669215cbbd4b84a19d80ea2015f
SHA1b8f425ae4431dfbc2f48462ad3462b34f79d3d14
SHA2563f61b7e33c1891c16bbb90643f418a51427ab1b3114b064d70b34f3d015c8e90
SHA5125ab0296461878e3114fb0b55551b05573256be592aae05c24783558c2badeba2445961c237414d97593a4a703d99c98f5498b79c7b411b2149a4fc61ba02fadb
-
Filesize
5KB
MD5846c65a38291129de7d72b7221ad6fc8
SHA1e4813c3f161c98f7be48677f16a02066395b89c4
SHA256c84268b4a0b37f441a8b295549683253a6105f5e5038a5d91e978b18f9178eaf
SHA5129ff4f52060f36ddc4532081187bda9de41a022554befa4d96518b326a80825526cc8097709b286f0f94aa3d13322a0a055423162d1cdc7d2df4fb8c3253c7b81
-
Filesize
11KB
MD53c2d8f40fe9b7932a6b930bd8ed08cd4
SHA174222b62e969ad3660dabc378f50f85e3d39cc61
SHA25664d55f953a674db922fe0913b52cd6f871757faf3382d4a8db8d38483784fdf5
SHA5124c6bf8efaf7620ac4bfa37f258933e93ea69cac3e791bcf650d173e3abea7b2ae615b725472cdde6118f54d05587024f9cc902a72b34c678a95be1eaa57b1a88