Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 09:58
Static task
static1
Behavioral task
behavioral1
Sample
2452a414d2c1d7c35420c8c0d75ab104_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2452a414d2c1d7c35420c8c0d75ab104_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
2452a414d2c1d7c35420c8c0d75ab104_JaffaCakes118.html
-
Size
213KB
-
MD5
2452a414d2c1d7c35420c8c0d75ab104
-
SHA1
da5fa99d80ee7aecdf86e4b57b9cf26365ed6187
-
SHA256
7095249465068853b4fcb2d9cfa030e0daf363d1c0b169d4a975271571af08d8
-
SHA512
f58d43a5e8240287eddbcff8791a4dd5ae82250327dbe20a8a90e711759fc0185d9c4830cdf90aac8e40a3189bdf289914ec1557ab8dead6a763f4a1610aa313
-
SSDEEP
3072:SfuPuDHYIY8yfkMY+BES09JXAnyrZalI+YQ:SfXohsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3668 msedge.exe 3668 msedge.exe 3524 msedge.exe 3524 msedge.exe 3052 msedge.exe 3052 msedge.exe 3052 msedge.exe 3052 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3524 msedge.exe 3524 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3524 wrote to memory of 1804 3524 msedge.exe 84 PID 3524 wrote to memory of 1804 3524 msedge.exe 84 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3424 3524 msedge.exe 85 PID 3524 wrote to memory of 3668 3524 msedge.exe 86 PID 3524 wrote to memory of 3668 3524 msedge.exe 86 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87 PID 3524 wrote to memory of 3916 3524 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2452a414d2c1d7c35420c8c0d75ab104_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa184e46f8,0x7ffa184e4708,0x7ffa184e47182⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,7273269721179492998,9865017526945380087,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:3424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,7273269721179492998,9865017526945380087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,7273269721179492998,9865017526945380087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7273269721179492998,9865017526945380087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7273269721179492998,9865017526945380087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,7273269721179492998,9865017526945380087,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3928 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3052
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4716
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
Filesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
Filesize
5KB
MD5259f90fff129b3d643811735537911b1
SHA1d72482a02501e6d71462ae98445e77d92960e67c
SHA256e6e58eb279274a2ddc3471dda2aa5337c30f77768caffdc25b02568b2029e201
SHA51268dabf5531e2c0684c0b924ef0cb23f412871db5e32d9a7a816cc00045d82195acdbc4f9c0a07a164e891bebec9f13638651a9d96e8a11da25fc051688f178a0
-
Filesize
6KB
MD5035eeb4f2f774c8172b6f08ef6c4d953
SHA10c596f5eed8268a07a97e467cef9b52967349fb9
SHA2566acff36011b001fbfc2a3b25abb5dd119d54cb65bf7fa5d9241bf428686f6d14
SHA512923cb355663a8c68bf97fa4ac2ceecd5cfc375980fcc0d61dfa2daca8d1e303fa0f1d5fc01ebbe8727df3e0357df3408194e6c3777baf9c7d6f6c04cd82f6b57
-
Filesize
11KB
MD52a3570290b5a04f092016e12fa210838
SHA199cbc225e05dbc64713763515b56430364a72623
SHA256f6a908092a295ab26ce066ecc9c0c124100297229d13c216e07d480ba710f13f
SHA5120bbc0b39f90e3a915b97a8a7e475d022b37ee2e63bfa93c8d916668baf828a92f25aeec244a20394aed70b87fa174251b6f44d30fcc4d2ba67a0b7657c9b4adb