Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 14:30
Static task
static1
Behavioral task
behavioral1
Sample
20ce87d83569189b281233e74a69fe07_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
20ce87d83569189b281233e74a69fe07_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
20ce87d83569189b281233e74a69fe07_JaffaCakes118.html
-
Size
139KB
-
MD5
20ce87d83569189b281233e74a69fe07
-
SHA1
c3b95a43c504cf11e12634f0fb44e83d5322658c
-
SHA256
4b0e0b9f590cdebb293237283f059ad7cf6526443c3e164f83a6b26c388bb1ac
-
SHA512
f5da93e600040986f2ff5aa6d4bed29c1a5ca0319b1371671480e07e4b3ee35b2b60c38a08d62bb9e7caa89740000ba64609b8a58b57d384354e26661026b6f8
-
SSDEEP
1536:SPZO54nlVO8nyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SPOCO0yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3188 msedge.exe 3188 msedge.exe 736 msedge.exe 736 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 736 msedge.exe 736 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 736 wrote to memory of 1276 736 msedge.exe 83 PID 736 wrote to memory of 1276 736 msedge.exe 83 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3560 736 msedge.exe 84 PID 736 wrote to memory of 3188 736 msedge.exe 85 PID 736 wrote to memory of 3188 736 msedge.exe 85 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86 PID 736 wrote to memory of 3932 736 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\20ce87d83569189b281233e74a69fe07_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf95b46f8,0x7ffdf95b4708,0x7ffdf95b47182⤵PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6574022643387911534,13955499682550107268,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6574022643387911534,13955499682550107268,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6574022643387911534,13955499682550107268,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:3932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6574022643387911534,13955499682550107268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6574022643387911534,13955499682550107268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6574022643387911534,13955499682550107268,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4376
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54e96ed67859d0bafd47d805a71041f49
SHA17806c54ae29a6c8d01dcbc78e5525ddde321b16b
SHA256bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d
SHA512432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7
-
Filesize
152B
MD51cbd0e9a14155b7f5d4f542d09a83153
SHA127a442a921921d69743a8e4b76ff0b66016c4b76
SHA256243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c
SHA51217e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d
-
Filesize
6KB
MD5f4dd2454f2b669c69979a1442a4aa926
SHA11e7eaf9647685912550891146999c2324b785e64
SHA2569f341dc2d9e9e7837756dd9446ab9d362ea72fb04b1812f1a30c597ba4eb61a8
SHA5125138895d28d2ccb9455a52610f4708c49296b6c7726cc81d05cde7181b1bc5d852d34063d40a02660e7914aff9a8684bcad500a83a4ad3523994d570dd2870af
-
Filesize
5KB
MD5e2d04ac92eb40f33dc5dd35f6b037de8
SHA1e3d2c92360c97a6c7e64ca53786e36c054146df2
SHA256b2d2f40c5d7bef8b39780b47a5481a1bcd1cddaee1b4ef578a4202d37b6330b9
SHA51259b3c1aa83770ff9e4643bfea04a023ffbb0448f084066cb5ebb5bfd027e5eeb9ec2316d5cf2429bb942d58b18e1715c1fb536a454d3f94aaf753ab6f590fdee
-
Filesize
11KB
MD598789f72980eeced7f436ebbe405f748
SHA1c30ae3da84389eff771fe53f2a1844ea3643ba65
SHA2567e295c82e09b721c30c69c25f514f39250165e79559784677f7bc447088e6303
SHA512f7a1d69cf5e996b14c3ae4fd094daededc61a06787faab7a6128f58c26592f9a411b65edd56c1600969099562ae9fa0de02a1f21e8ddd118784ae7096d01b969