Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 08:14
Static task
static1
Behavioral task
behavioral1
Sample
454543e4a1e62c675b08344ecff43a6d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
454543e4a1e62c675b08344ecff43a6d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
454543e4a1e62c675b08344ecff43a6d_JaffaCakes118.html
-
Size
79KB
-
MD5
454543e4a1e62c675b08344ecff43a6d
-
SHA1
ec6c033b8af9603a7c21a1042a1182b1e3669e84
-
SHA256
7aee5281ebbad00fa0580dc8f1a06570edce0f61bbff8bf29ffa2d95906c03a5
-
SHA512
2fa16bc3c9bee3cd09861bfa9512e9639c03095eadcbe3ac80798f8b67a26df361b6806062be47c7e1b3a346495d77782326373b3fa845ce23f09e922ce6876c
-
SSDEEP
1536:mUpCCcGB7FDOGXxqRg5D4CnuI2VfJcM/g3lAYGT6k2N0bWQ0Nxabp13A5rg6gfOT:zB7FDOGXxqRg5D4CnuI2VfJcAg3uYjCi
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1652 msedge.exe 1652 msedge.exe 4908 msedge.exe 4908 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4908 msedge.exe 4908 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe 4908 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4908 wrote to memory of 1964 4908 msedge.exe 82 PID 4908 wrote to memory of 1964 4908 msedge.exe 82 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 3948 4908 msedge.exe 83 PID 4908 wrote to memory of 1652 4908 msedge.exe 84 PID 4908 wrote to memory of 1652 4908 msedge.exe 84 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85 PID 4908 wrote to memory of 1952 4908 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\454543e4a1e62c675b08344ecff43a6d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff956ee46f8,0x7ff956ee4708,0x7ff956ee47182⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,896424305392062969,6177138620097676476,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,896424305392062969,6177138620097676476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,896424305392062969,6177138620097676476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,896424305392062969,6177138620097676476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,896424305392062969,6177138620097676476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,896424305392062969,6177138620097676476,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2164
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3160
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
381B
MD56310aa55fc137964f8e87d860b40cb75
SHA1a030fc6f14509b9aae355e11f98d045d2ef02203
SHA256728d7481482d3f71572d699f285df4078a1821495f4c499df80d25d8b82bb07e
SHA512947b5ae0caea3574b025815d81e0f7175fc6884fdc05652e6d9b2fc0749be407b4120eead80440a78a97ea2d963a9c1fab07e7d6e70c7968b431deb2c2011b49
-
Filesize
6KB
MD5572f14f1c689f35075f3802cb45312c7
SHA17574505767d661846dc2324abde0ef651926e5ee
SHA256f8dbadd9963eb4fc0a5961806e5f8c5569f634d048421317d2b3df7361a49946
SHA5123de33f690a0392d4487dcd1813e87aba83e0fdbca4af2ddcd8d08945b1060db84431b9f3c588f166f867c1b43d9f585c3028bf3fcca7a1d50d7f4c55bfbcb27f
-
Filesize
6KB
MD5136def646bf9588802d14fbe2a2a80b2
SHA11b7fe0cc6af669ab1e674d0e25bb37ddf1a57139
SHA256964e09ef6ac2986dd3484ff7d866ff5155a97142683839152b6b2e79ac185eb5
SHA512a1613e8584347baa9ed916acb4990f64f86a2d98da3d2e36ac1e66797fb7c1403c78bff56526ed3dd710d8c4feb904f4494d2a33450e94c0d6d59804b6485752
-
Filesize
11KB
MD586f3f887607231aefa74d9c711f8de5b
SHA185c006d7d6c2f5867bf4c824971a472730065b63
SHA256746a1d66ff74d6878d049278edd2a332b267e08fc6ece0c35abff272036f2e5d
SHA512070d2b0f95a814c960592372de76ee3bdc3fa85ebe0d1c8e4f89e4c72727fe05397c253eaf27261d615ac54905ee191ba05539ba03e8f87739ddbf36aee33d93