Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 15:46
Static task
static1
Behavioral task
behavioral1
Sample
420ab33b0df8b60ee07b24c85eee766e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
420ab33b0df8b60ee07b24c85eee766e_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
420ab33b0df8b60ee07b24c85eee766e_JaffaCakes118.html
-
Size
140KB
-
MD5
420ab33b0df8b60ee07b24c85eee766e
-
SHA1
5f57a1f65e6ec4b149af98050ee955ce41207ad7
-
SHA256
ed7c1d1b4411ec1d310308631fef29f3bfe07bb7b54e2e4195da9544e69e1f57
-
SHA512
f76f84e24b98bbf97d6f8165ca869ab008f9040dcbed3c0465dfaa1907b94902ece1c886f72b0799c5e3904809980256df2fbdedc85ace9d16c012638f7ddb06
-
SSDEEP
1536:SGDt0XtpYbjx+lMyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:SGDhx/yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3080 msedge.exe 3080 msedge.exe 736 msedge.exe 736 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 736 msedge.exe 736 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 736 wrote to memory of 2140 736 msedge.exe 82 PID 736 wrote to memory of 2140 736 msedge.exe 82 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3436 736 msedge.exe 84 PID 736 wrote to memory of 3080 736 msedge.exe 85 PID 736 wrote to memory of 3080 736 msedge.exe 85 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86 PID 736 wrote to memory of 5036 736 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\420ab33b0df8b60ee07b24c85eee766e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff739b46f8,0x7fff739b4708,0x7fff739b47182⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4531727172874861666,8962810110736969511,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,4531727172874861666,8962810110736969511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,4531727172874861666,8962810110736969511,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4531727172874861666,8962810110736969511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4531727172874861666,8962810110736969511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4531727172874861666,8962810110736969511,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3664
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:864
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD5482ad0ba68a955a6acf90de18b98044e
SHA12f1af914471b4d310cd062f46f69622d2a9f4afe
SHA25684356f7eed0389cc43c6a01d2559386261b5eb57a2031823a9bcfa19af0eb1d5
SHA5120ddfbb69b05bf9db73ab8f85b8e57aea2fd0de39aa51868a539e3965ca40b97899c3e227b1aba792209bbfe266b72ff2c964bf209a759221223bb36dff3adfbc
-
Filesize
6KB
MD5d8adc59ad22e2106e0add0b60960cd60
SHA1c37f46562c3f995f4d84dc20c145cf8acbc52bcd
SHA256e972e233bda54559018f12f48681eb13f62cbcd79d8cd1612283e4b728688854
SHA512f6a404209bd6fe4d60966c5642063edd16bbf8c1112810deaad9fad45724519dcd8fd9390a0e27e9055feab78d622f5904f3a2aeb6c20f3357e3765858c2e526
-
Filesize
11KB
MD585614e96a888d521d9b47b8172099ece
SHA12e53ced61c021b8677fe7d658a5db078a1790a7a
SHA256333a9230344f41aff31387916e16446a4f829bee9c9b5c876de44bd3ded03032
SHA51211dfd3b499073a28be5db2254d2477674368b72d82f1111bbb7523c9bd32e6f5edb35014be9992106b250b53e6ee9899dd538cb090cb2dfcba937993fd1babf5