Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 23:56
Static task
static1
Behavioral task
behavioral1
Sample
4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html
-
Size
140KB
-
MD5
4da3bdc51118fe1145a27261c26d5551
-
SHA1
db445d7c09cd7d12993427814f6ffceb4cefe162
-
SHA256
d0c195e826675880db03ebfe18532fb9f9b5f5813479a9b5ba846306bf42b3d9
-
SHA512
e315257ee2c8c13b8fdb55cb886dc8077c1d952a63d932bf9a48ad3b22d3d66f855b47894de31fd61c820fdcd11f426c2f23d543179425da6d97525624a3dab3
-
SSDEEP
1536:Smb9pFOcc3lOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SmbjTyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1968 msedge.exe 1968 msedge.exe 4272 msedge.exe 4272 msedge.exe 4384 msedge.exe 4384 msedge.exe 4384 msedge.exe 4384 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4272 msedge.exe 4272 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4272 wrote to memory of 1008 4272 msedge.exe 83 PID 4272 wrote to memory of 1008 4272 msedge.exe 83 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 3844 4272 msedge.exe 84 PID 4272 wrote to memory of 1968 4272 msedge.exe 85 PID 4272 wrote to memory of 1968 4272 msedge.exe 85 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86 PID 4272 wrote to memory of 3528 4272 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ad546f8,0x7ffa3ad54708,0x7ffa3ad547182⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:82⤵PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2360 /prefetch:12⤵PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1876
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
5KB
MD566cee0d63d15bc0a80f7b877a2f58c1c
SHA151cf55c99bfb199c51f20b3682e7ba1bbcb9f6c6
SHA25676c75141e3d706247e8fd77de58b4f195cff12f06b871cb1e80aa08159862662
SHA512c65e95491582cafcbc4b5da22075adea6f6ae6990319c5fde304a1c8358ebff78628f3ffcbbf367c4515fd6fcee30475b76653a6ebde2d789b5f7a81c51c56c3
-
Filesize
6KB
MD5a56d8ea94ed27c74417dbe79deb1e7b2
SHA137282abd607912569514e7ad790c4a43e963f435
SHA256c87914ad8376365db704fd90b8b9194f04a1e7ff417d2071573d3508c49714e3
SHA512419331508d50054f31012a62af12bb113fe44a78e62843d3da04ba9056c2aadbd5bde18d411b541ebe231ed5ce6bfb79808c923138c99415d20d0a8edd6d35f1
-
Filesize
11KB
MD52e9d80c43a420f80fb4fa60947a01c44
SHA14cbe2b661235e973993cbc0a9e59fe0d4a6fff9b
SHA2566c41fe7292899975b70839a902a5dcafea873bcb55b2106acb4310e55612cdd2
SHA512930847ff2d26ddfae6c48fb9a2c1b3d097f50a9b62ec85ec525cd0888d93524a98640c78f32e355a76d653dc47cc906686c98d574d3fd42cb58719daae56e0c7