Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 13:11
Static task
static1
Behavioral task
behavioral1
Sample
2a1d237e3f18ee6304016562a8c4a209_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2a1d237e3f18ee6304016562a8c4a209_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2a1d237e3f18ee6304016562a8c4a209_JaffaCakes118.html
-
Size
20KB
-
MD5
2a1d237e3f18ee6304016562a8c4a209
-
SHA1
5a2788644c30d42e752ac461e88a77aa1117a642
-
SHA256
1d3867b3440afe3369b0a22dfabf68e61c688118bc14c59ada17a364620541ce
-
SHA512
4e51b1ea3271b2823a3bbbfa43a6685a0b21e8981235345dd254eaa89ee96b2f3c1e755b647590429a3e5e16e59fa3804346281926140089612fdcb703fcfc82
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI048zUnjBhga82qDB8:SIMd0I5nO9HZsvgZxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3208 msedge.exe 3208 msedge.exe 2452 msedge.exe 2452 msedge.exe 4184 msedge.exe 4184 msedge.exe 4184 msedge.exe 4184 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2452 msedge.exe 2452 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2452 wrote to memory of 1056 2452 msedge.exe 84 PID 2452 wrote to memory of 1056 2452 msedge.exe 84 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 1724 2452 msedge.exe 85 PID 2452 wrote to memory of 3208 2452 msedge.exe 86 PID 2452 wrote to memory of 3208 2452 msedge.exe 86 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87 PID 2452 wrote to memory of 1804 2452 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a1d237e3f18ee6304016562a8c4a209_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc0446f8,0x7ffcfc044708,0x7ffcfc0447182⤵PID:1056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,2641049437485428742,15390452887174395276,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:22⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,2641049437485428742,15390452887174395276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,2641049437485428742,15390452887174395276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2408 /prefetch:82⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,2641049437485428742,15390452887174395276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:12⤵PID:744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,2641049437485428742,15390452887174395276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,2641049437485428742,15390452887174395276,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4544 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4184
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3004
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
Filesize
5KB
MD539c7ed0d1c4d5e3e4d1c9df0bf6d0d8d
SHA19b0e5598b74884437a2b596e3233abeb27da1a24
SHA25692b4f841011e7d24df43b0aeda723ae1510c4532a0a9cb44ce43b78f0c7806e1
SHA512111d2b22f2ebc77aaded982465b049a94b4deadde0fbf16f7ed9253a1b042d1981b2148ec8d8848f0ee221f6123ea187979bedb344492e470a147f3a0d2b1ea5
-
Filesize
6KB
MD5e9b249ea507377d7e4d1b96bd505677b
SHA160c3b38cd8b53b699f258269b67dd40e7e51b498
SHA256a3b69e12dbc476cb80e7381fb7eae8f3c768aa92d86bc72c503cd1d2bc68ff1c
SHA512c59f69883ad727e6fd163a94c70a711ec927cf95a716ff449a3cb0aa83e6ed31cc2f32d02652f7ac7bcb96697a5a7ee0ddc47676758b87c14f18cf4f8c5bc6a4
-
Filesize
6KB
MD5053c399976bf50b06154653ceecd085a
SHA1de8ec3c5b327876012440d1da2e7b86c5b0112a1
SHA256f77a047db24d7789dcbc6ca5510586fc41f8551fbfe4f502a41be5949354738b
SHA512a99abe6fcaa0fb6181d4c7b3fbe19fc94ffc9e7a6d24b51f4f7a28df2592722e3bbe660f55e6b053cccbb4aeb670c04f6d285a5c238bdf046c42178ec2ca4441
-
Filesize
11KB
MD5f76bdbc152cb4dda843bb93aaa533555
SHA15d000b8f762be12e315c9b11ca0d55823acef1ae
SHA256162a4f52755ee6019048e133d8fd031b64a7d22faef9ea97bb22949d1d209f70
SHA512445b6875f6a057da32eca30db24863480b82a6bacea9876daa4c3e7b8c53e44ff471a53c46aa6f6d7f23fc8cca7d2607ba1727cf71a99e78ee846c7a99e0c046