Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 07:13
Static task
static1
Behavioral task
behavioral1
Sample
28dfe2ec768d04d5c907f93ed0c49334_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
28dfe2ec768d04d5c907f93ed0c49334_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
28dfe2ec768d04d5c907f93ed0c49334_JaffaCakes118.html
-
Size
87KB
-
MD5
28dfe2ec768d04d5c907f93ed0c49334
-
SHA1
574f45a27a62e720b6ede19139ebde31e7f9e293
-
SHA256
b710f3ed0ca664b8bc3481152e34e3a6a76fc1612b9a5193d4ebdd103f2b45ac
-
SHA512
40f9d866e60116208af6a9789b56a833324ef9306cb78af2ac059dd69c0cf403db8c0f68c9af738553be46984739c2d728269a51965381aca1cb65043889d346
-
SSDEEP
1536:ZQfGDxJy2GEGsVn/32nTeHJkBsFZfOMgKMdiE2zFvlD18hmD1cDCty1rnJee62au:2oLZPgdlXxuHclQN0YHmL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3776 msedge.exe 3776 msedge.exe 3480 msedge.exe 3480 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3480 msedge.exe 3480 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe 3480 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3480 wrote to memory of 4520 3480 msedge.exe 83 PID 3480 wrote to memory of 4520 3480 msedge.exe 83 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 1388 3480 msedge.exe 84 PID 3480 wrote to memory of 3776 3480 msedge.exe 85 PID 3480 wrote to memory of 3776 3480 msedge.exe 85 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86 PID 3480 wrote to memory of 2648 3480 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\28dfe2ec768d04d5c907f93ed0c49334_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90ebc46f8,0x7ff90ebc4708,0x7ff90ebc47182⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6048478896660080986,7841984556209320834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6048478896660080986,7841984556209320834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6048478896660080986,7841984556209320834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6048478896660080986,7841984556209320834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6048478896660080986,7841984556209320834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6048478896660080986,7841984556209320834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2164
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3344
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
Filesize
309B
MD5a2d33977b6b3eb020b2150c136e18164
SHA173a55b0764893afb96c0b828c2b63c268917cabd
SHA2569c872caa6bce6ec9a64d66cecb927ebbbcbf1b8427cb8851fd04f632186a5c5b
SHA5127cf0a672da3c6564a3e31238f20e4550793c99389aaa1b37bdbd1a0b0b652b82034e58714d57958ea20ffb5accf4541d94e46cb145ae06d69edade3548ab49a7
-
Filesize
5KB
MD54facb1fd194cfde18e54643cc17638c5
SHA1d2d5041a2e62b26fc239ee15c0b2946646427da2
SHA2563080161cc247c46777f30abc9982d37e61b7411f94a350b5680385a2a1c76708
SHA5128665481985e0fa4cf03f398c6d959e24478152dac537f6fedbe2e0835818257ab0869b0879009f5b9bdacca89e2adca8d5eaeb27670fb10cdd24ba307ad773f3
-
Filesize
6KB
MD52e0de9482417f30fe3ad7ded7ae9fd97
SHA1cf42702e2321ec6aa9dcc7854919cc9f6d2053e5
SHA256dbf21fe8ff2aedb136848357f86c109a31a3ad36d5131faac0e481f4abdbc34b
SHA51287270ea6b5b60ab0a9f36c90c9a2214a2e38780227d6a55c3f33d50d41b7bd78afe9c22547cba67e34b22c2a2652e813555ab6a5b42b5113f562c6771814f3dd
-
Filesize
11KB
MD506ed395c13d6289608317bad826e41bf
SHA1462b6796c3a3808168b8c67b90e7b08e1f713c95
SHA25657a0c1dac7ac7fa31e543be0f28c5739a396a6951b941f704d65399e921f594a
SHA512c4ab0fd8f1ae8736646f4f11eeee57ba77ff875b2a442de4e55262786f081b9fbbf189ec36856a39e378bb65846c7d4d14f0ec5ab0e62ea248044c2e05881768