Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
6b1ff2584bc0784ed1b1c5a4141b52ec_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6b1ff2584bc0784ed1b1c5a4141b52ec_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6b1ff2584bc0784ed1b1c5a4141b52ec_JaffaCakes118.html
-
Size
213KB
-
MD5
6b1ff2584bc0784ed1b1c5a4141b52ec
-
SHA1
e6d70c693bb4131c2a26293c8df3c3373cb13444
-
SHA256
12f38b6b3afff3c564861b310dddc96bbbbe6ea75f7271593cb92e967cab3a87
-
SHA512
2840290592d53d4a074155a75157b5504775f58a0722bd9bf82f2bbe3d4d0f5b55f0d0c7517c128376b3b66986999710ffa1b49ade70515871a27bf87b1de487
-
SSDEEP
3072:S4L5OBECoCP0KyfkMY+BES09JXAnyrZalI+YQ:S4MkvsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2744 msedge.exe 2744 msedge.exe 4600 msedge.exe 4600 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe 624 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4600 msedge.exe 4600 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4600 wrote to memory of 3392 4600 msedge.exe 84 PID 4600 wrote to memory of 3392 4600 msedge.exe 84 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2708 4600 msedge.exe 85 PID 4600 wrote to memory of 2744 4600 msedge.exe 86 PID 4600 wrote to memory of 2744 4600 msedge.exe 86 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87 PID 4600 wrote to memory of 972 4600 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6b1ff2584bc0784ed1b1c5a4141b52ec_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8517946f8,0x7ff851794708,0x7ff8517947182⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14554457559412150608,11826307831327729467,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,14554457559412150608,11826307831327729467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,14554457559412150608,11826307831327729467,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14554457559412150608,11826307831327729467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14554457559412150608,11826307831327729467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14554457559412150608,11826307831327729467,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:624
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2128
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
5KB
MD5b3fa23849923352d6acaf884a0c3728c
SHA102bd50d8d0b2f5ce8ee715fe34728851a72a5ec0
SHA256ab57a2736ae0cada1924d2887e29c892815f72dd7f35ead71a6f5d72f84fef31
SHA51229f0b98f64e574d91a6e822d525fb369e7b48e7b3d3f23da80684debd04141d1ab6eea42a343ea4a648e0445c76d13579ce1e8ae536fde2657651cf67ff55478
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0acc290-8374-4031-ad51-6ef69eed995c.tmp
Filesize6KB
MD5316e5366d1351678f1d1de4768af271f
SHA1c5f40b800ebd662355c43e1052fed17087b52cd9
SHA256452653ee74a378399da474e2ccabfdd86bf48fe1855a1eb18c22cb20f2624f27
SHA512c8fd2ea539b4853442f3ca4186b2d6697bb480835f36870b4b544ed4af46981f6d8fdd00253f4f9094ad84c722a50785559a3bba1e225aff77dd3e7473c760bf
-
Filesize
11KB
MD57d591078c509a0c069a4811cefbde3c5
SHA1ab709d9d9a5d91c288d5d8920f3c09b018dc60ae
SHA256328a2cf303b57358e5ac5a2ae06325e6bd30bf14fcaea5e20c502e6a526627a9
SHA51279b50aad931df2f0fafd4cf2b7b96fb6b69b7ec0369ab23af6d27d3256e2af49d2de08d420c846df3228fd1cb02755faf2b6459aa62cc66cf3529497833437e7