Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 17:01
Static task
static1
Behavioral task
behavioral1
Sample
4c2218cc3a6b15a3c8adc84c77f59369_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4c2218cc3a6b15a3c8adc84c77f59369_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4c2218cc3a6b15a3c8adc84c77f59369_JaffaCakes118.html
-
Size
213KB
-
MD5
4c2218cc3a6b15a3c8adc84c77f59369
-
SHA1
829adca2261dd2cc3b0875dafe7bdc6eecee6b03
-
SHA256
dc2c061cb034fd3ad4836ee1ac2059efed595f4afc97fbe7f38ac7de461e56f9
-
SHA512
7863e216ad9ea35846da2ef333f4783a206c00da90de7a6be25f0d51c3836f162076f688e6437fdfefc19aa42984c5c282adcf11b7177177d3090aaaffe66586
-
SSDEEP
3072:SQOcNSHL7uusheyfkMY+BES09JXAnyrZalI+YQ:SQwCh7sMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 2864 msedge.exe 2864 msedge.exe 732 msedge.exe 732 msedge.exe 732 msedge.exe 732 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2864 msedge.exe 2864 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe 2864 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 920 2864 msedge.exe 82 PID 2864 wrote to memory of 920 2864 msedge.exe 82 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 2916 2864 msedge.exe 83 PID 2864 wrote to memory of 4440 2864 msedge.exe 84 PID 2864 wrote to memory of 4440 2864 msedge.exe 84 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85 PID 2864 wrote to memory of 1740 2864 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c2218cc3a6b15a3c8adc84c77f59369_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf8b746f8,0x7ffaf8b74708,0x7ffaf8b747182⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,15869097765812357309,16246593727537659465,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,15869097765812357309,16246593727537659465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,15869097765812357309,16246593727537659465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15869097765812357309,16246593727537659465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15869097765812357309,16246593727537659465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:2316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,15869097765812357309,16246593727537659465,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1920 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:732
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4028
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
Filesize
5KB
MD554c28e2c526f03d1ed73f46af2f84cad
SHA145204f3bb993c7db5b8d44f34e018bae1a8e2d8a
SHA2566a5d6a9be71323c76fbba8b53c60e8fb6e8af5d27fb6547924b601c249e7d24e
SHA5128af13630de386ea3ddd63b530765a58e50d52958fadd18cdb2635b8a182f6f107097f875ce1c2064931265f27cb700330db05f765740af7beeb40ea333f4a6d4
-
Filesize
6KB
MD5384203a7da10c4711c834c511b94022a
SHA10e7a0ea34d31d0ed017d67ab08bcde4a2c090fdc
SHA2564cffb2d29dbcd9e9b002e36c9594e6d8d00d6635a761b72e364e45aa4743af76
SHA512362603813a0514d94f64841f56ea66c9cef59c4ada011a58e39a8271c220658f7e72cea8061b8376361c8cf26a9d4fb4e8783e4274509fdef9410032c2110407
-
Filesize
11KB
MD59e258fc36586cee4f1b0d97bc6b3bc93
SHA1bca828920884bde2860e901c23839b08f1128da2
SHA256a37ff0edc0a0f27cc8c16c8731ced8445de54a29f00a04006fa3bff877c784a0
SHA512b3d3344008dd9846bb7f257ef7800c81023c7e537619af37f9375e2be0de46e34fc1475c494ec3665fc840a7285d4b9a75ca847295806e8a58694f76b8a67cce