Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
2895f4f6e11ab22718401a0fe27a4f73_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2895f4f6e11ab22718401a0fe27a4f73_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2895f4f6e11ab22718401a0fe27a4f73_JaffaCakes118.html
-
Size
50KB
-
MD5
2895f4f6e11ab22718401a0fe27a4f73
-
SHA1
1a4f0167f3ce0cd1285e63222fcb1d912731372e
-
SHA256
ee03e733576d1410226539df85167715dfdf1b28f539d4e805b3befdcf0b603b
-
SHA512
e381280a0ba3ae92e3826ad836992596e9583497d81e5afc9c7e664bd6df5772fb10702e5c7548865adb82a989ab5d8ebd97dbaf29f26700ccd07b17460842ff
-
SSDEEP
1536:avrcdq71uhJYZ89VPcuO6DxJ3VbT2ObykI3tX:F8xQjUFoFndWkIh
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 628 msedge.exe 628 msedge.exe 4484 msedge.exe 4484 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4484 msedge.exe 4484 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe 4484 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4484 wrote to memory of 2968 4484 msedge.exe 81 PID 4484 wrote to memory of 2968 4484 msedge.exe 81 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 5012 4484 msedge.exe 82 PID 4484 wrote to memory of 628 4484 msedge.exe 83 PID 4484 wrote to memory of 628 4484 msedge.exe 83 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84 PID 4484 wrote to memory of 4140 4484 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2895f4f6e11ab22718401a0fe27a4f73_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcca7346f8,0x7ffcca734708,0x7ffcca7347182⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13298396180601095537,16585591826154728043,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,13298396180601095537,16585591826154728043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,13298396180601095537,16585591826154728043,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13298396180601095537,16585591826154728043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13298396180601095537,16585591826154728043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13298396180601095537,16585591826154728043,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1448
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3296
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
1KB
MD5bdd0a433b905e69fecfecb83e1dc8c51
SHA1ce97a45332a318d5f6d645bf1e99e2dd001c0863
SHA256304bd513a288a1e659b0f38fb32dd1aff7b4539a99cc0d1805dbed05bbe4b60d
SHA5127e3e7759a1ae000c76a75b90dec17985dde097d43a9c23a9cfe5a0b51715c21ed1e2caf79fcb3044e8d9a75bca8a372b9baa3695e4cbfdf5ecb13c163669e574
-
Filesize
6KB
MD5d6bd1ad1ce8c14ecd28adcb6991e4447
SHA18be6892777b65e59a7360f5bc994a7ced0d7ae8c
SHA256c38c60380aacb9c163a9c2af4e6a69a4bc5239efad4669e27c83c27e504953a6
SHA5128271a3d77f8e47ea4d275e033ab5b0ac52ebfa776aeaef2bc95f402a86d5ff344c6aa78bcc040d5044fc87339369c2f37d1062e32bcb290047d0f69fb0f3537e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d62531f1-1ca7-4e39-8347-8c4dc4313ff2.tmp
Filesize6KB
MD5e5fc242e08ec786346d9860c00dfde2b
SHA19c718cba14cc374a2fed4690a4bf6c6b539b2913
SHA2564c4fbd5212eada82bd51084bdf52f92b03fb7d9b40abc66be4d475e163f387bc
SHA51267e919dcf0c2283efde314951a9a10e54a682c4328b81d5dd4e6f5504f47f5885a7cac1c261bdb44802bb2ef48e82368e59c64b16a2105513dfcd521337e0be1
-
Filesize
11KB
MD5bd49359ad0c1f7f5f74d04e418375d62
SHA1468b3ad53fde504552db867f68e523b7bee70ebc
SHA25622f008b4b8372124cc9b7407bdc75309242d874a6de72fce1e119aecb4215ea5
SHA512beee22266bd099c948980628fb5362cf97449aa8e673637d67d4dd7e5b491a857a392ebeb0a6f52eb3594e3b967be315c249b1f5de4e71a93944fd034eb8f9d2