Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
8369797c44e33ca6954557529c82b375_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8369797c44e33ca6954557529c82b375_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8369797c44e33ca6954557529c82b375_JaffaCakes118.html
-
Size
159KB
-
MD5
8369797c44e33ca6954557529c82b375
-
SHA1
e23779383d9c07022f9ea30f0be8dceceb0c5d06
-
SHA256
fcf051913fa7ab292326dccecec2cf75064f729293f7135ffa416846b95d68d1
-
SHA512
56d2ed532e9cc4a90dd1a7d7fb39da1fdc051985128d84a0c3c929760fce300fe276b28343b5496098f003cf9c8b9a96bce5cf994b288bc93f991b11cd8510bf
-
SSDEEP
3072:SQ+sYoQo0yfkMY+BES09JXAnyrZalI+YQ:SQpR5sMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4656 msedge.exe 4656 msedge.exe 3936 msedge.exe 3936 msedge.exe 1480 msedge.exe 1480 msedge.exe 1480 msedge.exe 1480 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3936 msedge.exe 3936 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe 3936 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3936 wrote to memory of 2256 3936 msedge.exe 83 PID 3936 wrote to memory of 2256 3936 msedge.exe 83 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 3076 3936 msedge.exe 84 PID 3936 wrote to memory of 4656 3936 msedge.exe 85 PID 3936 wrote to memory of 4656 3936 msedge.exe 85 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86 PID 3936 wrote to memory of 1664 3936 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8369797c44e33ca6954557529c82b375_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8591c46f8,0x7ff8591c4708,0x7ff8591c47182⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4608024113521419115,8534854222199805015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:22⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,4608024113521419115,8534854222199805015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,4608024113521419115,8534854222199805015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4608024113521419115,8534854222199805015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4608024113521419115,8534854222199805015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:2332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4608024113521419115,8534854222199805015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1480
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4220
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD5c6821e8a8b18e83bedb349fe08182de3
SHA16c7bdb022c424968d38e9e091fe013181605a5c0
SHA2566170e9928989d64f385b831293dca24c411aabe5b0dcd2b73137b5c54f637c2f
SHA51212c40cd136021a234bf1e365896ed522e3e169032f20a77bbbb0246433d680b61a902b072151c468fe6d41b388f18d71e4a6f283dbd1c1c07426fb7b9347b2f2
-
Filesize
6KB
MD582f39a18fa83d810515046ce4822c24c
SHA157065e971f955d1df7eb3b03bfc59f7adfbebc48
SHA2566100376de556b360329390edf8c3aadb5f4df56135e990c321049d83c94f0f4e
SHA51219ab97baab951677af80f7c0d14a304da3fcb952f4f37f0905673787a93cd4292fdf6ef8dedb62a49e2a641035c4eb47f262922667531e32cdbb4d31bf276191
-
Filesize
11KB
MD57fdf5e4bc4a8dcecdb55af05454c52b0
SHA1d39a690c222ec1e851d7f07b5688807f7794119f
SHA256c557e4f007bed62aa1915bf15a75b2be4718111f914b978a4e919e7ef09052c9
SHA512e6b3b1ae6f9f88a07b6678720a55073a0b5ab311d6a24c53df128a1d8847d65e5dcc39c4253f884ab96999d2dbaf0efa7d85384fba9f1e25dc7d6fae55f9cf3d