Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 18:35
Static task
static1
Behavioral task
behavioral1
Sample
477d078f4ea91ddac119f355249e3af8_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
477d078f4ea91ddac119f355249e3af8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
477d078f4ea91ddac119f355249e3af8_JaffaCakes118.html
-
Size
138KB
-
MD5
477d078f4ea91ddac119f355249e3af8
-
SHA1
8fbf795ace9a1796caf2a3c51a431dcb86a9f118
-
SHA256
0fb4432db0d3ce8d3d6d703048374e18a76eed3f88fef47004062161172b1dd4
-
SHA512
68cb786c89e90a1a6bb4addb12dd8cdd52010549992f690be69e883e9567d25d589d739ea300974fb7901bace24810b99f23606786366368d7e1001087c94c2c
-
SSDEEP
1536:Sc2mn4D+h6hzyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:Ssnto1yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3648 msedge.exe 3648 msedge.exe 700 msedge.exe 700 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 700 msedge.exe 700 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 700 wrote to memory of 4644 700 msedge.exe 85 PID 700 wrote to memory of 4644 700 msedge.exe 85 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 2476 700 msedge.exe 87 PID 700 wrote to memory of 3648 700 msedge.exe 88 PID 700 wrote to memory of 3648 700 msedge.exe 88 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89 PID 700 wrote to memory of 3836 700 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\477d078f4ea91ddac119f355249e3af8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc835446f8,0x7ffc83544708,0x7ffc835447182⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:2476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:4544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4148
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
5KB
MD538682b586f1f3f1ff9c38a830b7851fd
SHA1146055f386fcde0f69bc5da97f19972936f8276f
SHA256aa3f50ceb18e32dbebc2205663ba87f820d41f1e8795fcf5705006bd5c222a9c
SHA5122b11dd08a2ed7e3cd158331d94281d693b9df8e27cbcc74e5d7e8ec65f3fbe9cc7b7953d265f8d6dd6977af84cfbc4b58e3b48ff828bff4b04c40b180c98415d
-
Filesize
6KB
MD556b71cdf39e57884b8a4b6474b541fe9
SHA1a5cb903c65d2047da3e8ab6c2c9d9f5ce9130e71
SHA256fe816828b8c8d004d7ac84561dccb9caeab886b3a77e066fe7e670066cfe1147
SHA5125b850ee7ddf2f073c4e0d0d1dea86a7553beb2904a55727716c6df2bece53b65805157aa6b8c5a20400d9cb13c6317610da0e6694d6285a10ff416462dadb63e
-
Filesize
6KB
MD557440d37fab345456d396e62ea6a90f5
SHA17340b6f9d6209032022a163ac6668aab1bcb1788
SHA25617802e4356509d3154323a49227a85c5f1271d2a1959a71a298d8d571d857c5f
SHA51216ccf681506c2f3cc47d3ac9c4b9375e28502e957a176318cb594f2a35bc4c81b8c3866650a48b807b085a3d7212a13966d61531de078da985cfd2733953a79e
-
Filesize
11KB
MD5d9c3f802596f5ebf0a116dea424f15b2
SHA1d3b31d0089af517543183e46f1f66c62ca56f023
SHA256d2dfa97ae64bdffe54040dbd7175bf45e5476772c7ca777f248f3c1aec740ec9
SHA512fa6fee7a286c225f6bb42d33730a0747e5143d979f663cf86eda068899e7ed63fa084932719f915e8c8e5a96e4a51982d861b4ee04e0753b7f1241cf02e044dd