Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
405922a3240b4b21ef1891ad2ec482a8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
405922a3240b4b21ef1891ad2ec482a8_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
405922a3240b4b21ef1891ad2ec482a8_JaffaCakes118.html
-
Size
152KB
-
MD5
405922a3240b4b21ef1891ad2ec482a8
-
SHA1
1336d89c12bf1a92944ae90d49520b239aa4b344
-
SHA256
bd9fa1872fbbe0593f7bba83948598cb80269bd96021068b32ced619a8683530
-
SHA512
23770db9d607b2a32e0db2951da0b35729013d06e706465c6931b0d2fa52f65b552e56f237c7d2e146224c9c59349b7055135e56196bc03ece8aa63228b2027f
-
SSDEEP
3072:vTD5l9y5WaWZbPker/Sn8NuslcCEynt6l3QwqkIBZjIF9W5SVqhmYcs8O7Y1J0SN:vTD5l9y5WaWZ0n8NjlcCEynt6l3QwqkJ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2980 msedge.exe 2980 msedge.exe 4460 msedge.exe 4460 msedge.exe 5048 msedge.exe 5048 msedge.exe 5048 msedge.exe 5048 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 3680 4460 msedge.exe 80 PID 4460 wrote to memory of 3680 4460 msedge.exe 80 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2240 4460 msedge.exe 81 PID 4460 wrote to memory of 2980 4460 msedge.exe 82 PID 4460 wrote to memory of 2980 4460 msedge.exe 82 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83 PID 4460 wrote to memory of 3404 4460 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\405922a3240b4b21ef1891ad2ec482a8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb2aa46f8,0x7ffbb2aa4708,0x7ffbb2aa47182⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:3404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:12⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5048
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4192
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2168
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD5063b3a75036ef6629887861f34a9ad67
SHA13592cad35e228681d97c251e28cb4502dd4a95a8
SHA256feae88140e58938e597437990bdc14a9fc504c41726af0416e53e0777c743b62
SHA5123683eff124ffb723fe30da7719ea34c3fef690eac77f410975918181857963e85e72ef41d825aaea227a8bd092479841ac5cb11720c4795d4d8528967fa21eb9
-
Filesize
4KB
MD5665d06d4b96060a40f7549b35deecc0e
SHA198160f9c406fd1bf3f3b5ca921372ff3288daa97
SHA256a224f092d3e75296bfe1de816afdccd4378bdaf30bb57bcd35f6479fc552b1de
SHA512b13c3680b91e660cfd50859cde435a5e8bb5f8a3ef01683ede35a4d44b3984609cb5c605809820cb1b6e2a75249c743c033388d558a65dd6b05e07990e9096c4
-
Filesize
4KB
MD544089507a828ccd1fda2e28454adb6e3
SHA102ae837f9b2a1f397534b46284a8073ac4e9fe77
SHA25678482640682087f6600577a79912458e385346352d654ed52655740c35950ffb
SHA512f555b8b064e91218b80e0c9233d046411ee3f1041aca5dca781b5b1137123700473d55547b0a6f7585abc85d72fb84d4d265c0925fb5b35809b25bc139bb2569
-
Filesize
6KB
MD5afa5b722342e9cd3e296d04c5f4d3fd5
SHA186cf9d708a63f57b55aacd3d6013a6b5fbed5b0b
SHA25652e9db5dcccc05fe46f8c033adca5a90397b85725583ef03e9f56f97dc80d64f
SHA51213dca4b9059dfba9b6e936365c0a041abf2a63d9e237d125896cb01b83efda2d276f3768c66c4234b1d8511595e22e4b39e4e140089f6e826fa1970bdd48ae6c
-
Filesize
7KB
MD539a0113cdad8dcd3adfb4ec09c60cfdf
SHA1bf650cb7c8e3093dbea100e0127199974db03186
SHA2566ac9b58591af585dba4aff7efad6070cfbc894aa7ac34df714dc74ef9373429c
SHA5122040de928e36abccdb51f273355b119439126082e0980eb0999f742a815d771c39527dfb4b07376b64a8f1846ed8f1c5d10edb0fede46f31056a1f482c3eb341
-
Filesize
11KB
MD5ec2cb93fdf7d95168a12e7c2e259e51a
SHA1a20b01bdfd8607336b4b307e36d7db3e0b599f1d
SHA256b4ca06eee2e9e5e1bbb6a5ee7b7c7c8387ce2842120550b767d5dd19a6d4169a
SHA512f6502c611b2b511b22ca3d38fe688c68ad93368731d0a2ac665dd0fd9008354eda710b0cd9b34908a9b3b7570739ae5b9473db78027cf8d253ed6cd5be368f09