Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
5f6d30932bbade43bc0633b20cd8151b_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5f6d30932bbade43bc0633b20cd8151b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5f6d30932bbade43bc0633b20cd8151b_JaffaCakes118.html
-
Size
220KB
-
MD5
5f6d30932bbade43bc0633b20cd8151b
-
SHA1
9fd89c0808f3402be2a854435610e1a1c0af5c08
-
SHA256
8f02175d288fb29bdcb1e7b4e561e0249293fb1ac1f0106d3320fbb209d26c44
-
SHA512
839777e4c5575ce6ebeb904fa6053e2418cadda3030949b1ade75448f5fc1f672e4ee597b57b0a850bfad361d34b8e5378dc81d720375ea7a3fe45549b0400e0
-
SSDEEP
3072:S5jAWuihXYLEvQyfkMY+BES09JXAnyrZalI+YQ:S5jK8TlsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4376 msedge.exe 4376 msedge.exe 3152 msedge.exe 3152 msedge.exe 4696 msedge.exe 4696 msedge.exe 4696 msedge.exe 4696 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3152 msedge.exe 3152 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3152 wrote to memory of 1236 3152 msedge.exe 85 PID 3152 wrote to memory of 1236 3152 msedge.exe 85 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 1684 3152 msedge.exe 86 PID 3152 wrote to memory of 4376 3152 msedge.exe 87 PID 3152 wrote to memory of 4376 3152 msedge.exe 87 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88 PID 3152 wrote to memory of 4004 3152 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5f6d30932bbade43bc0633b20cd8151b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa597346f8,0x7ffa59734708,0x7ffa597347182⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4211850289109918419,5524864496629565904,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4211850289109918419,5524864496629565904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4211850289109918419,5524864496629565904,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:4004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4211850289109918419,5524864496629565904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4211850289109918419,5524864496629565904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4211850289109918419,5524864496629565904,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4696
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1828
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD53fe84bfd75fa1bfb9ede94d5b22fd88a
SHA15dc9ff66e64e6e5dd93e8448fddb052ad68df21c
SHA25601b1c2ccd120301f684a5438df3a58f8da07806877c0f1957b2ab1417622a5c9
SHA512f3ae03478774927c51dd1bcb2e0beb299b81a76adccf5382ac592278d24db382b1e006cee3bdd2aed608786681cf5c1749acc60b0c2736d88b9dc8a8add4a9c0
-
Filesize
6KB
MD511a5e17dc3580cbea780b5f1a322f283
SHA1ea23aa5e84ce8424d768cadc1a1b504c01065b32
SHA2560fb96879262d481055aaed7aa9d79ad5788543df43d3689fbdb434d34a7f60a0
SHA5125b1eb5c534157a1fb093fc7098862b336e30554f9c95e56d14f0b00fbbe8f20f5d1cf8aece59996e12b2d297ab7a54ab9ce59f2d40beee280b89b31b578f9f7f
-
Filesize
11KB
MD55adc828459a736dc177726a51a08c503
SHA120b0a6444d28ee145c33f1c4e36e21eac30896ad
SHA2569edbee1ec52ecfb6a24066536c5d3ec88df92c74a4263b530eb964e102859e0c
SHA512cd70f9319c57209adff97b2c01a461257624a274d081ccc6d5b8af158a466371258850e040ceaf196ecc003a9ac789b83e5cef68a8f7f9d7ec550b67c499a35e