Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
278fcfdf230faac9cdc18c5a9372ffa7_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
278fcfdf230faac9cdc18c5a9372ffa7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
278fcfdf230faac9cdc18c5a9372ffa7_JaffaCakes118.html
-
Size
20KB
-
MD5
278fcfdf230faac9cdc18c5a9372ffa7
-
SHA1
28b781a9239a2f4e435bc8e1304f8a1b965a04a9
-
SHA256
ed468fef46111e51b0076bdf754641c85c9cb953bdcd3c34d272d0ac9bf96436
-
SHA512
db5debd14e3060cce013b110019e68ba3b18c7470d0c53f44c63b8f658d2c5da250f046c53defce8f853b4af8e018b478de15cf9c96d206e892ee8811073d4ce
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAINooHmtETzooHmtETPooHmtETzooHmtETnoi:SIMd0I5nO9HZsvNcxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1248 msedge.exe 1248 msedge.exe 3544 msedge.exe 3544 msedge.exe 1392 msedge.exe 1392 msedge.exe 1392 msedge.exe 1392 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3544 msedge.exe 3544 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3544 wrote to memory of 2160 3544 msedge.exe 80 PID 3544 wrote to memory of 2160 3544 msedge.exe 80 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 3744 3544 msedge.exe 82 PID 3544 wrote to memory of 1248 3544 msedge.exe 83 PID 3544 wrote to memory of 1248 3544 msedge.exe 83 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84 PID 3544 wrote to memory of 2884 3544 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\278fcfdf230faac9cdc18c5a9372ffa7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe902246f8,0x7ffe90224708,0x7ffe902247182⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14432080583923689665,15280192999777176369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,14432080583923689665,15280192999777176369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,14432080583923689665,15280192999777176369,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14432080583923689665,15280192999777176369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14432080583923689665,15280192999777176369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14432080583923689665,15280192999777176369,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1392
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:644
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
6KB
MD52d806048546e759ab706227065737124
SHA1751c2e2857e7c8e85c4fd3a6bf9a49228061156a
SHA256b52365a7613818d528a647a0f026df5cdeeb2ca66a60b2c7eaa2aaa1d782f0f1
SHA5129a36de6d1eeb747239a3d0b4269aa71ee6cf6dab94c95e81a61794753c140d01a51eda7ffe7e93eab4ce79e4bcf8f9f2da092d568dc863b0d0de0e5b17a66fa6
-
Filesize
6KB
MD50bb93a5f58d66819542a9c39de99ec22
SHA1217f97ce9ecf1e248a80837cdb4ba094b9c21adf
SHA25655485d3b8cd95fb39583b5a10f57bdfb831624186f98497ade51834c23dee066
SHA5129ec958957535de95e01372e2872f40b4ec8452f8df1062a9f9290508b0ed828ddd56d30a3efc1ee44f7a6a55103ac4dfe3c0cf94444914860a3375fc7d6d54cf
-
Filesize
6KB
MD58cdd3317333c2e5d5fbfa39d4f1d9165
SHA1aa22373ae02327cff446f66e6c70cacad53f9054
SHA25633a98674cbc47b39288a2b791c2723adae4f7b7bdd263ffef7e8cbbd4e4000ab
SHA512224dfd46042d4ade91529a270bfb04a3b9a6f283edfa2862c2e6b6baeb29b54fd4c7d2837f4c48832b3650a37841e22a765dab0d482c348423bdb5a29534421b
-
Filesize
11KB
MD5e3df628396c1c7815c5d70021b404a0d
SHA100a79fc7cf79fe1a12fb7908e335ce1924b5fc52
SHA25609310c8309eccbe7af4eaa2bb7f9dfca8edd26cb3ab24b31e3ad4bc05e2de009
SHA512318df045c5e71f98448977c411eb8c7ecfe20c71bd85521793dc07c03fe47e11409f1015584f12d556d3cdbe2b00a363da8f72da71f531fab8cf0cb31a3761c9