Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 09:57
Static task
static1
Behavioral task
behavioral1
Sample
7c8ced1689f4dc5842de4ada7c2fd7c4_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7c8ced1689f4dc5842de4ada7c2fd7c4_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7c8ced1689f4dc5842de4ada7c2fd7c4_JaffaCakes118.html
-
Size
213KB
-
MD5
7c8ced1689f4dc5842de4ada7c2fd7c4
-
SHA1
59daec73fea51fa6b5dfc19e0918a06e264cbab6
-
SHA256
be81af28cd7c998bd033948fffc7b4682ead3321f5caa3170ed6b70fac49e9a3
-
SHA512
ac2d7f1b2cc90c6b1a37f48dab0533c877ad811e9775b0a38b248ed0ddcf6e1b2713f38e7cc7846a8d48d55199d2b7229bcf593be95f74a4491c4b2d169cb4a1
-
SSDEEP
3072:SJJ8cJomf3oDyViUyfkMY+BES09JXAnyrZalI+YQ:SJnADdZsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1992 msedge.exe 1992 msedge.exe 3548 msedge.exe 3548 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3548 msedge.exe 3548 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3548 wrote to memory of 3800 3548 msedge.exe 82 PID 3548 wrote to memory of 3800 3548 msedge.exe 82 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 2648 3548 msedge.exe 83 PID 3548 wrote to memory of 1992 3548 msedge.exe 84 PID 3548 wrote to memory of 1992 3548 msedge.exe 84 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85 PID 3548 wrote to memory of 712 3548 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7c8ced1689f4dc5842de4ada7c2fd7c4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff968ca46f8,0x7ff968ca4708,0x7ff968ca47182⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12082375600807025307,7129352544463735188,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,12082375600807025307,7129352544463735188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,12082375600807025307,7129352544463735188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12082375600807025307,7129352544463735188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2728 /prefetch:12⤵PID:2704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12082375600807025307,7129352544463735188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12082375600807025307,7129352544463735188,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4868
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4524
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3753dc7b-e0e6-4493-b2db-23b02c395ba8.tmp
Filesize5KB
MD56cb951e7f41f54ab0bc73ddc6ac77565
SHA1f6759e9a6a5afd698c5893f67515003efdc4417b
SHA256e8cda5ad8c9141419a1c28b7fa84327679ff5884d2b20842e61035f34f61df93
SHA51232791b53407567008bac21ac187e2d9b4fb601541c2d408b2ef07c76177b2a867ed7dde2f9b82f319a5ebb73877970719e94bed21189c5a8aac11b9015f5414c
-
Filesize
6KB
MD5e652d54d8521ba4af9a09c7608b52a46
SHA127f9d776371627fe7b6065d16b8a8e942001055b
SHA2565108ef3e6ab64d159ac30b1d36c5a71a9872893ca08597553bf20acb596f02b5
SHA51285dc22461298335cdfdc6748857179611f8ad5529d94fdf3a348988e8ee9b75114b5256a4eb9e266ed09bddb213e5649034205009d491f37a97e2eb88db88ea7
-
Filesize
10KB
MD5368c56832692c48b935d086b6cc5f6c6
SHA1c5fe99ad8f14e8efb75b9871d8b1bbc10e7e787d
SHA25691b4356e8e8c8da82be230f8f3baf353a8b0f2df85058441973558710402204b
SHA5128c54ffa2ccfdbfe5550ccc3efb6aaac395567d9729edd2acf21c5f154da150666cd4e618166c61d93e21e0356147c141e57776583755fc57b86a09f1ff24c866