Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
5c81d422d11483be49b8f883e6ad44d4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5c81d422d11483be49b8f883e6ad44d4_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5c81d422d11483be49b8f883e6ad44d4_JaffaCakes118.html
-
Size
214KB
-
MD5
5c81d422d11483be49b8f883e6ad44d4
-
SHA1
b68bb427516bf80cabf4eeafa095d3db27ab5b8f
-
SHA256
47fe05ec6bf492d259ecb9d7c3b04f9e376bc7b9d57a95ed81a491c9a3f9fa87
-
SHA512
93e27db4664acee9d7ef1d90306e958cd453a3f56e7190aa6587bc56a23541b785c8c0d9380a56f3657cb26c96a175269c2bbc6c4db6d1ae1349f721e50b4830
-
SSDEEP
3072:MrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJG:Uz9VxLY7iAVLTBQJlG
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4924 msedge.exe 4924 msedge.exe 2336 msedge.exe 2336 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2336 msedge.exe 2336 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 4156 2336 msedge.exe 83 PID 2336 wrote to memory of 4156 2336 msedge.exe 83 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 880 2336 msedge.exe 84 PID 2336 wrote to memory of 4924 2336 msedge.exe 85 PID 2336 wrote to memory of 4924 2336 msedge.exe 85 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86 PID 2336 wrote to memory of 4688 2336 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5c81d422d11483be49b8f883e6ad44d4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffdf846f8,0x7ffffdf84708,0x7ffffdf847182⤵PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3446317512458803981,1201645225407251728,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3446317512458803981,1201645225407251728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,3446317512458803981,1201645225407251728,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:82⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3446317512458803981,1201645225407251728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3446317512458803981,1201645225407251728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3446317512458803981,1201645225407251728,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2740 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3044
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
Filesize
5KB
MD5fd5c7a4d41e4c0f0032865c99dbc2d3a
SHA11d0b089a896dbac47a1523281e01dd2f64bd3561
SHA25676724b70de2c0e768aef615d554e2aa2acbad91f4ee9cd5731dd7c4eb49b8d7f
SHA51243e20e3349de885e93cfae673923e22dbcc38969faad73ecd325ed16e3b0deec76bbefc083eae00f3e71217ab2ac3b56ebc0c727016b197ee800a49485128cce
-
Filesize
6KB
MD5a6ac3cd7fca41668fcd3d67f3ec6c4db
SHA1fb8c052c663d31f00d5f9c114c2b1e498c70852c
SHA25616021b1f4c31ecbfcfedd154302821cf49d17347799a2b103ce08192304a48d4
SHA512cc6809ab85b597b86d2a5ae624f4de237bddc50ed75191c5b11ce2867bccc6eaa3da0de867d4924a8b0a3008bde640addbd723cf63c53e37ec8aa8a953c4c80c
-
Filesize
11KB
MD5be94de451bdc07d31e0e50f86c8c18bc
SHA1c20f01138b490b654d3e7a5517b31ac4cbefa56d
SHA256a4043fc2f80deb3517776cbbd1c544b6764088faff1a655e85fed80f73ae064b
SHA5124aeff6ab86e783f15e4610c537c19be0019aec6cbe13bc415a4fb44c2595f8a75facf7e23222ac352e9f484a57835c314219119ef0ad0f6dfe6442b3a82b5ce5