Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
7d0fc3cac65e12d64857bcce50ea7bca_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7d0fc3cac65e12d64857bcce50ea7bca_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7d0fc3cac65e12d64857bcce50ea7bca_JaffaCakes118.html
-
Size
58KB
-
MD5
7d0fc3cac65e12d64857bcce50ea7bca
-
SHA1
fa81d3446dd0ac69c57aa4fb61479d9d2d6c59da
-
SHA256
be315ecf71185baa98aacc92b3801d68177827abacbed3f4b3475a887823d3ab
-
SHA512
bb32335760f72953e61b83e5dc76abebc92e33932923e9958846cadf3eefaaaa9fca36662e00f1e4a0338d214c66046269b3497a992a8a186312ae603f9d4071
-
SSDEEP
768:f3qKC4Cz6bMzdeotNZuL5XUH/v4L01TDD:v0/wMzdeotNZuL5XE/A2D
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1488 msedge.exe 1488 msedge.exe 3472 msedge.exe 3472 msedge.exe 3324 msedge.exe 3324 msedge.exe 3324 msedge.exe 3324 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3472 msedge.exe 3472 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe 3472 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3472 wrote to memory of 2852 3472 msedge.exe 84 PID 3472 wrote to memory of 2852 3472 msedge.exe 84 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 4408 3472 msedge.exe 85 PID 3472 wrote to memory of 1488 3472 msedge.exe 86 PID 3472 wrote to memory of 1488 3472 msedge.exe 86 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87 PID 3472 wrote to memory of 2328 3472 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7d0fc3cac65e12d64857bcce50ea7bca_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa292946f8,0x7ffa29294708,0x7ffa292947182⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11949400768323342003,17299852452045097580,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:4408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,11949400768323342003,17299852452045097580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,11949400768323342003,17299852452045097580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:82⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11949400768323342003,17299852452045097580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11949400768323342003,17299852452045097580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11949400768323342003,17299852452045097580,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3324
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4412
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
5KB
MD5e616bf84287ca118ff1263e4dc2fdb11
SHA16a8e1b71eca273d09b6da552ef57bc00143eec79
SHA256b27447089b3334e3ea4aa57f7c43882d4ba1045e7f9e70b4b467024cc4253dda
SHA512cd925b472d7ec752c2e3f985abcf9e55a0fc47916599221c7c3bc7633a932ba570ade5db75e9f552c0d459f749a4022ba433ca3a15e849b0394a33a828efca71
-
Filesize
6KB
MD57b9153701a401f58ac2a4e44466db0cd
SHA102f87c8aeeb0fdf6198561867fe8358569ebff5b
SHA2562d0d0310aba638b57888b2f837bdc784d8759b1758c5125b76942fb39722e7e0
SHA5124846c5577035a93e0fac40397da68cdb3644c3bd436263847068515bba0f43df093075cebd3beb30ea2e772e241de8a7dd5c535f7df0a9a7de212b17f08bb294
-
Filesize
11KB
MD533f53319593269eb08818b533464ff6a
SHA17be95db82d8e47e00972e2b7762545a8758eeb7d
SHA2560d19b1ddd280586fd47b987823d2ec793ea635d37d7b1c7680a71661f67ca1fb
SHA512f20967a5e4e00f5082fa57c2ddd864ae2444d98d5b930d6abb37df3322139c77c1cfc4b90bd2dfee1adbd84e4aa5711807013d3f331fccfc06ac41601fdc155f