Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
6f6116f4f7dcdee173ea97a897983cbb_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6f6116f4f7dcdee173ea97a897983cbb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6f6116f4f7dcdee173ea97a897983cbb_JaffaCakes118.html
-
Size
213KB
-
MD5
6f6116f4f7dcdee173ea97a897983cbb
-
SHA1
274111fdf1b2b166067d016ef8bd4d861825fb79
-
SHA256
0abeb1ac104a4b23fb51b910c8074dc809b0178cce0389a2811b49e322c9e247
-
SHA512
d7ba9b7122e60e9271c68ac78140561d1883849f5f1a1ad1de5fe09d437768d590085599903deeb6efdf9c472355d751627bd9f0d24488aed99f7541df727234
-
SSDEEP
3072:SI6V7V61X3J+yfkMY+BES09JXAnyrZalI+YQ:SIgAbsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4672 msedge.exe 4672 msedge.exe 2612 msedge.exe 2612 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2612 msedge.exe 2612 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe 2612 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2504 2612 msedge.exe 84 PID 2612 wrote to memory of 2504 2612 msedge.exe 84 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 464 2612 msedge.exe 85 PID 2612 wrote to memory of 4672 2612 msedge.exe 86 PID 2612 wrote to memory of 4672 2612 msedge.exe 86 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87 PID 2612 wrote to memory of 2864 2612 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6f6116f4f7dcdee173ea97a897983cbb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8da46f8,0x7ff8f8da4708,0x7ff8f8da47182⤵PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,92597239297477283,13916779557239332149,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:22⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,92597239297477283,13916779557239332149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,92597239297477283,13916779557239332149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,92597239297477283,13916779557239332149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,92597239297477283,13916779557239332149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,92597239297477283,13916779557239332149,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4160 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4792
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1548
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\92964857-ccbc-4310-991c-cafde1d0ff8a.tmp
Filesize6KB
MD50a6d50e8b9dd0c5374338d9785e00dc2
SHA1e67b93318a05331f1eb5a61c118989c369322b18
SHA25625fe54dd4715d1ade78f291d9fba3e88e63924246a4293105c4c91aaa5af88a8
SHA5120f4a4abb5d124836d44b74b66eef1f44ec68a28d2e5b82d32c73d4bb94ca3d41a97f1ee795880cdee57eb4e158a6079a2ce3cd14b819edf65046c0bd55e72f71
-
Filesize
5KB
MD5fa44e72f30ee819d412173cf06dc9859
SHA1c19ce09b1f4af2b03ffc15a77337fca57d814218
SHA2563fa125ae96123ae06b68d23d3d0aa947595c5911a7d61031091d0d4268addfa3
SHA5121fbd6c9759e20c13bc599c5336d3a39a369ba13f3026dad7aa937a46f69318e445c98e15e221396606a0f6d66854e655a5c030cf4c074cfc8c35ad90f0827a5d
-
Filesize
11KB
MD56eafd0cb9d55276d3ab18896630d6166
SHA1585b4d5940d9f5b51e80459dd87fc99db54eb717
SHA256294f2ebdc4a530e11f541af0a718f3b913dbc97e0391337fc6350ecf51d1ecca
SHA5125d27cd23e68897f9abfc0c3bf59e40301448cb296c5ab91b17643f8b501d3525efe9cb2c8ca10411fa6a746b3860d96282313af37138c7ac45580ccb31568b3b