Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 18:13
Static task
static1
Behavioral task
behavioral1
Sample
3c296571060bea80b0ca3c142ceee8f4_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3c296571060bea80b0ca3c142ceee8f4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3c296571060bea80b0ca3c142ceee8f4_JaffaCakes118.html
-
Size
220KB
-
MD5
3c296571060bea80b0ca3c142ceee8f4
-
SHA1
53c5be23d24eb38ca124610045120df06ccd82c4
-
SHA256
b02b0f2c7edad03eea54a5b10bae84af56e02b0f116f4066716c998f1c860ec7
-
SHA512
03ea2cf6604667f2f18db017d5e6488a5137e24bada62df9b9a41b22efce9e01a67c255a5296f085a50d2a9e0a281dcf4a96ab09d8a35d8c88d76f2551257b38
-
SSDEEP
3072:SWgo58zl5VcEfeyfkMY+BES09JXAnyrZalI+YQ:SWEzzsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3228 msedge.exe 3228 msedge.exe 1724 msedge.exe 1724 msedge.exe 628 msedge.exe 628 msedge.exe 628 msedge.exe 628 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1724 msedge.exe 1724 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1900 1724 msedge.exe 81 PID 1724 wrote to memory of 1900 1724 msedge.exe 81 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 1444 1724 msedge.exe 82 PID 1724 wrote to memory of 3228 1724 msedge.exe 83 PID 1724 wrote to memory of 3228 1724 msedge.exe 83 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84 PID 1724 wrote to memory of 4812 1724 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3c296571060bea80b0ca3c142ceee8f4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8e0146f8,0x7ffe8e014708,0x7ffe8e0147182⤵PID:1900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,18252512477900118975,2384074772151526998,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,18252512477900118975,2384074772151526998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,18252512477900118975,2384074772151526998,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,18252512477900118975,2384074772151526998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,18252512477900118975,2384074772151526998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,18252512477900118975,2384074772151526998,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:628
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2928
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
6KB
MD50a5f3d75512af0177c01aa8f9f550244
SHA13936fdbc3bb302a0028ff339de1c6116a8752f28
SHA25677d8fff68fefdf4bc0604a4ed5255ce1c1795b8d5d39b3bcc3585b20108f367a
SHA5124e846340430430a818d77ab1a2b1aa81685d5da1243e9ca91ee756fcec9c69b5d603e6b5c28175d900ab47a0fdebdd40532701a2ca348655fa85545903ef6765
-
Filesize
6KB
MD5eabee215ec1aa313c3fba15def211d3d
SHA19347cf9a368b4b4e1a301da5a9f9190f64a0b8f9
SHA256a54559f0d61c473dfe9ae04608ea8a4781696a9dfe52c08eec48565c4bbe91b6
SHA51287474e300684c170ddc7a8aae820d1f0113af76795e241f3d7b09c05c5b06510e7bb9857f87aece1f22259fd36bed9d8706db0a1c0623b4e6c08479ccd7574a5
-
Filesize
11KB
MD5304eb2c29d006f2151d749d3bf257b63
SHA1a5b5b3f8abbb2de5bc88a7ab6509e5f8807e4ca0
SHA256d0f6795286f0eba08decbc94b20e6a787ec8ab6596c02082005dedc9e1d0ed46
SHA512136a38d03825fe026777cd4a6d551ed79afc464c0aabf79e820084e6cc08e4c4de2222e9c4a8150edd68a33f7563b42b591be90e5bc4b65fba206ecc2aa40dde