Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 14:42
Static task
static1
Behavioral task
behavioral1
Sample
500a3c93a2c38072f6965944265392cb_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
500a3c93a2c38072f6965944265392cb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
500a3c93a2c38072f6965944265392cb_JaffaCakes118.html
-
Size
139KB
-
MD5
500a3c93a2c38072f6965944265392cb
-
SHA1
9e67204ff590596526abdc5e3b74ccfcbe72d733
-
SHA256
10aca8f0209688ece1c2b83cdd8e7a95ddd07e68a5c189cde16f8a7742cfa7b0
-
SHA512
4cb2209425268961221d48023a58fffe106c5a8c8fe1211726152a7a101aa9b0ac70b8212eccec1ea63233bd4078231d5aad3944cbb30dd7f540f07d1ad90d93
-
SSDEEP
3072:Sj5nSwsB9Yr9MSY6fyfkMY+BES09JXAnyrZalI+YQ:SjJSwsB9YfYsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4720 msedge.exe 4720 msedge.exe 3980 msedge.exe 3980 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe 4668 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3980 msedge.exe 3980 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe 3980 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 4260 3980 msedge.exe 83 PID 3980 wrote to memory of 4260 3980 msedge.exe 83 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 1456 3980 msedge.exe 84 PID 3980 wrote to memory of 4720 3980 msedge.exe 85 PID 3980 wrote to memory of 4720 3980 msedge.exe 85 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86 PID 3980 wrote to memory of 1020 3980 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\500a3c93a2c38072f6965944265392cb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb611046f8,0x7ffb61104708,0x7ffb611047182⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1788,1740891766499588525,6652960852567420137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1788,1740891766499588525,6652960852567420137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1788,1740891766499588525,6652960852567420137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,1740891766499588525,6652960852567420137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,1740891766499588525,6652960852567420137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1788,1740891766499588525,6652960852567420137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3024 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4668
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4712
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD5a77831e3926a6e13953729523fc2a283
SHA123ff353907e4a80bcf346a65fc2248fc0af12cf9
SHA256fc876da0e2876f3274d420b4a3e590ae5065aad62d4856c1fb1f54892337280a
SHA51218b0fc00b0b9fc307be0c9493b101cf6b69bd49b8cb807778aa587235ec50701de7be2bd51196ed06d8bfabb0c80389e06b935fc2001d1bc38f7243ed9053a95
-
Filesize
6KB
MD5bef09e6ee5786426b57e33fdd4aa3d82
SHA178cd89000cfce83bfec52bae569ed8cd915b300e
SHA256ea5afdd792c0297d16dfb64c59eba0f0d18aad88b8409b9013231889d272f85c
SHA512601819368ccadf5267b7df487528a02dbd521e029b376ccc225fbc02bfdb7fde6f96fbc4eddb5211258fec7cd8bd193eab7e5e3a690a13395dd18e7c34a34753
-
Filesize
11KB
MD5586470c4ab3c243eb643c9ff22eec300
SHA17b63d3ca5d50d3f173a8316f8342462448b570cd
SHA256ea0cd698b9ba5dc771b2ccaad796b440a90f251429bbbeffaf9aeb328c02818b
SHA512536b0b596d128a3600ecda1e70e16ccc6674fc28a6bb8a2fa13224f876eef7d8cfd430dfcdefdf9645342b4ac636429134ee754f7f740c8bdd189aec1f58a6fd