Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 13:56
Static task
static1
Behavioral task
behavioral1
Sample
846239115433b83bb8db850122d46be3_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
846239115433b83bb8db850122d46be3_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
846239115433b83bb8db850122d46be3_JaffaCakes118.html
-
Size
3.1MB
-
MD5
846239115433b83bb8db850122d46be3
-
SHA1
bfffbc8e56d4915f2b25fca151aa72f856e35fd2
-
SHA256
c16b9c631ce062725a5b0159d910c26b0c1d3479fd5f5c7d20f8caf1ada607ea
-
SHA512
af58f2a1f15e49719dadfbf46cdbfd5e892b14466e5d61e1d42547f064c7616b7094db479b24c73b86eefd7054d08cbf303c5799c2aa232b02fc2f7e5f88acb8
-
SSDEEP
24576:L+aDHsz+aDHsY+aDHsJ+aDHs3+aDHsP+aDHs2+aDHs1:c
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3612 msedge.exe 3612 msedge.exe 2528 msedge.exe 2528 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2528 msedge.exe 2528 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe 2528 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1364 2528 msedge.exe 82 PID 2528 wrote to memory of 1364 2528 msedge.exe 82 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 2912 2528 msedge.exe 83 PID 2528 wrote to memory of 3612 2528 msedge.exe 84 PID 2528 wrote to memory of 3612 2528 msedge.exe 84 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85 PID 2528 wrote to memory of 4716 2528 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\846239115433b83bb8db850122d46be3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb552146f8,0x7ffb55214708,0x7ffb552147182⤵PID:1364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9516374068449569965,8687609698364054038,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9516374068449569965,8687609698364054038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,9516374068449569965,8687609698364054038,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9516374068449569965,8687609698364054038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9516374068449569965,8687609698364054038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9516374068449569965,8687609698364054038,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2796
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5347eb36903be8923b09a61680a22bdc1
SHA172011604e575eb63fa5dd6069ea51aa7b99e2826
SHA2565018a13d88ef78d044e8a48530c160947c1af601ed882f2c9b1f098d691d0351
SHA512be3b84ea0752d11c64766ca75114135c805bf9d80fdb7bd77c01751dd7eb426e14bbdc2bb4ac7c09ca03bf55ffca6bc36286b519d3ac78fadb11b8413313ffa5
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
Filesize
5KB
MD504b6910ca632a0633d3e4cae60528a1f
SHA184432346d7eb1ed60822d35e287d79489844a809
SHA2567f25ae98e9d659ff221e7a6f27e98b2b8256eccfe93e7c0b81f473a3b9736549
SHA512312677a4d41e70492e6fd0037431ba880ec9b1ce06977a6a8295753b19d0a7b94ba565cd79a7698a95d1039e17087d7176680ca8712f861be073b8fb72863b90
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e804cec3-d78e-42d3-ab5e-7c9a9bd081b3.tmp
Filesize6KB
MD5833c0f3a8ce733a9a1e00cae441f779d
SHA14b8da746875de492f3cd56fb3af9a71e05486fc0
SHA2569350ba5f557e10887b93c82052604e0ec6d5a4f301251e92cbbc99442f2e3bfe
SHA51244e565d93d45cc5a148f920948eda64bd2dea85238b535b9d0cf79339ea3b5a9655aa914a0a376385a7f600bcc5e5f27044cb749b1b7760946b7a25ad9e2bdd3