Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
872d4f60a1b2d51205b13f3f8f900635_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
872d4f60a1b2d51205b13f3f8f900635_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
872d4f60a1b2d51205b13f3f8f900635_JaffaCakes118.html
-
Size
688KB
-
MD5
872d4f60a1b2d51205b13f3f8f900635
-
SHA1
14e2330b644419444f75aee3fd62cbf011f197c2
-
SHA256
9d1ef21a6acc8eb5749bfd63214f0483aa8e405051974400762161aff99d75f5
-
SHA512
cf530a32abac4f372c801ffb3c6a4fdfbbb5ac958c34e4a6f913d23cc67b3da016963f3d983ba2ea1a1be0fc6b5cc70b287a3ce9ab8731377dee2105480222c4
-
SSDEEP
6144:S4sMYod+X3oI+YBltNosMYod+X3oI+YBltN0sMYod+X3oI+YBltN9sMYod+X3oIp:75d+X33A5d+X33I5d+X33X5d+X33p
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4856 msedge.exe 4856 msedge.exe 3016 msedge.exe 3016 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe 636 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3016 msedge.exe 3016 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 4016 3016 msedge.exe 83 PID 3016 wrote to memory of 4016 3016 msedge.exe 83 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4716 3016 msedge.exe 84 PID 3016 wrote to memory of 4856 3016 msedge.exe 85 PID 3016 wrote to memory of 4856 3016 msedge.exe 85 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86 PID 3016 wrote to memory of 916 3016 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\872d4f60a1b2d51205b13f3f8f900635_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1fe446f8,0x7fff1fe44708,0x7fff1fe447182⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9839108848825616133,10613986237620489372,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9839108848825616133,10613986237620489372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9839108848825616133,10613986237620489372,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9839108848825616133,10613986237620489372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9839108848825616133,10613986237620489372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9839108848825616133,10613986237620489372,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:636
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4436
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
5KB
MD52b266fa173ed696d3769c5acd8fd933c
SHA11351f18a360b415766e40aa92f4d0e3e7de3abc0
SHA25649f1c9adb77c09cb9d0f66364cbc9f22c23cc50e03d74ce52eea444aee29ee2a
SHA512aa13d1264eafd1ce04ccb8b250feeed8842d85e94650e182dd8d12c3dddce964fb0c5fabca35b0236320fc982a875c7c6f44e595a7d64a7dc965b26f1be7f0d2
-
Filesize
6KB
MD5f8270fe9a87b055e35f22da549134155
SHA1cf62fafe8b0e7968ec220e3f205de433846870c3
SHA256c68f282722d5be84730e44ba64cdcdc0f701ff925a989309abec085918688383
SHA51296b85842957e8a753403ee4926d70c73ee1b1bb1db023c5f3c221fb47fc495743d6db82ee677c2c6e52525a2aa70693861ebbf648320d292618534426ea50d8f
-
Filesize
6KB
MD5e6d3d0e549dc1109c1f4e499338a6305
SHA134e932761afa9a8a508814d28cf0179fddb21512
SHA2565c03e1e70101223ba85f4396d900df23f87084076a06f99db4b2311153b86b96
SHA512ed0f12470b6eba85bc72301760adede16f496be107c6b9ec2fde8f0d933dca8b3114676726b5c56d76fb2823ceeac4754993e02d14e9f7be8b07a0c1cb739440
-
Filesize
11KB
MD562b5a128fccd32fea9c3cfc6bfc43fe3
SHA1faa4a0ad2a4155e3342cf50d100f14211573d0ad
SHA256780beea2bebcb40cd781714c7ad2540702bf358d701b93f9d4cf19d1d95749a6
SHA5123ac8508d74528fa7d58b2ea737ea8f0ed719165c6ddc3ec7aa79ef07c30020b7c8e79113388f4287779ff0bf2008dce14feb7dc84cda58be8c418eaffc5ebed5