Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
70400ae23dc8842cf1c40876400ac7b1_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
70400ae23dc8842cf1c40876400ac7b1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
70400ae23dc8842cf1c40876400ac7b1_JaffaCakes118.html
-
Size
214KB
-
MD5
70400ae23dc8842cf1c40876400ac7b1
-
SHA1
4b81e7b16e52b1eaaa49ceaa068e5df45786b110
-
SHA256
cdda59e2f53ead383bd01d5080d1bb4f9e3745c9d612023ace9047579093697b
-
SHA512
321a0e59d2531850953a77ce8f0166f50220743f9a0191a727cbd0bcb8851cc3f4eefff26f57837717f1b942d05a2ed127c90490a01d56c48af1ea5d114ebf97
-
SSDEEP
3072:mrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJf:+z9VxLY7iAVLTBQJlf
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1268 msedge.exe 1268 msedge.exe 1692 msedge.exe 1692 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe 4568 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2708 1692 msedge.exe 83 PID 1692 wrote to memory of 2708 1692 msedge.exe 83 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1928 1692 msedge.exe 84 PID 1692 wrote to memory of 1268 1692 msedge.exe 85 PID 1692 wrote to memory of 1268 1692 msedge.exe 85 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86 PID 1692 wrote to memory of 2844 1692 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\70400ae23dc8842cf1c40876400ac7b1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb611046f8,0x7ffb61104708,0x7ffb611047182⤵PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13253211024939376540,16180103012048253308,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13253211024939376540,16180103012048253308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13253211024939376540,16180103012048253308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:2844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13253211024939376540,16180103012048253308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:2704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13253211024939376540,16180103012048253308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13253211024939376540,16180103012048253308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:64
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD5e05949f2a5d22577502a71c39a7fc49a
SHA15a621bd4d1432af6ad337449e582a044e64327e1
SHA2564838996a9c29d789afcc951a67a14aa315006b980f02e5d2aa5a2aa30d77145e
SHA512f535aec112b3ca5cf73fe9b1886af6e017104564722f0a4ff694c04cc58a4709c41f202a041dbbf6ad7278877ff0d257675e07bdae83f05119751ecad9dba9ea
-
Filesize
6KB
MD5862d9162a08b448ee81192a5980c6bd1
SHA1de9e2a2117ced99672e08fe1bff4c08d04ad8160
SHA256f8f87674fb4dab39530c58b6e5414dd08bf327c204fb2ce3bd4e4b2a165717cc
SHA51229eb554f3a25e08427d5c9caed65b0ec6f6810fe0b482eb951f89b1b4c811775a5741e9940ae6994447fda3542040f5215323463b914235453295cb06512f7d0
-
Filesize
11KB
MD5f0cfd18da8a9291f47832077aefbcc37
SHA1eef5efb5c195ba0d0089218316f537cf0649ddc9
SHA2563285e76b694da6d669ac1aec16a90fb253c51d1d357a1bc0792e92f7251e64db
SHA512cbd5ab31dc0058c95c4842137b41e1bfe597efb77efd0fee716e16572441c25105f77f6302c1045d660f2adf977fcec1bf30942c725d61b95a466be050b08939