Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 00:25
Static task
static1
Behavioral task
behavioral1
Sample
88d9ab523c5cd180907bc3acd27d03e0_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
88d9ab523c5cd180907bc3acd27d03e0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
88d9ab523c5cd180907bc3acd27d03e0_JaffaCakes118.html
-
Size
138KB
-
MD5
88d9ab523c5cd180907bc3acd27d03e0
-
SHA1
de6e56ca865615a80f1b328e5749d75d89bb9dd3
-
SHA256
540566f80153171dfd43b1198f1ce23e08afe323fd6f81d7944b549776a455fd
-
SHA512
868f14eaeb9fbefef3cbb2d60760e2d0e57317c5a1ff13636d39a3b627a223e2e25481485d2b50d1a1f87b5e1b76cc5571cd52c5d286cbc532d190a48066f434
-
SSDEEP
1536:ScNTbAfl5/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:Sclw/yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3740 msedge.exe 3740 msedge.exe 2484 msedge.exe 2484 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2484 msedge.exe 2484 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 1920 2484 msedge.exe 82 PID 2484 wrote to memory of 1920 2484 msedge.exe 82 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 4224 2484 msedge.exe 83 PID 2484 wrote to memory of 3740 2484 msedge.exe 84 PID 2484 wrote to memory of 3740 2484 msedge.exe 84 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85 PID 2484 wrote to memory of 1348 2484 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\88d9ab523c5cd180907bc3acd27d03e0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa087846f8,0x7ffa08784708,0x7ffa087847182⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2211355315005502973,15934041663936816084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,2211355315005502973,15934041663936816084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,2211355315005502973,15934041663936816084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2436 /prefetch:82⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2211355315005502973,15934041663936816084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:2500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2211355315005502973,15934041663936816084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2211355315005502973,15934041663936816084,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3776
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4664
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
6KB
MD5010c69e98502d219b20e29b9eae77b6d
SHA135accda58f365fecb8bcd9c362dbc5b82d6d5212
SHA2565af4c84ef47eb7c5090377df0eb6c9c1e59daef41dcb0f9d5339203c0dc2ff52
SHA5123fbc1e990cdb639f9c644bea45f25a1acceafcfe4b1abf83f977d037e9ee0d960f7f5bf6c14e590d1526160c1fda2684474a449553b7816a8e7220ca317d87a3
-
Filesize
5KB
MD52a57646d4cbb9e82868875a7cbe427f6
SHA19469eb9e0d47cb62990b4628e5ddff9f4a17e57e
SHA256c996051ab910488604ae828cedf37d35963b83e1a9067cc6e0a9c636a76a68f0
SHA5121f48feeff8d21e8eb35a4686f908db9ca61d1eb9a5ac14136d2f055167915f0da1cbf6f43ab4f6679f48bfa696b65ba2b9a243b7887d00ac85e07f31fe07c7ff
-
Filesize
11KB
MD58d87efa8e3010ef3f019acefe11f9dc8
SHA13903928f000bc951ed07a6d86f44fc5cffc95163
SHA2560b3b9e26db31504f173c7c1cc2eb9530f010aa27fbddc4c05fcf99ec5b19f33d
SHA5129df30c31c5dc404548ef2b6ff52f7a11787d2656ba671c38eb2f8769798544c2c517b1e7bc0a262679eecb40650e47ccfdd095c8f5a8be3f92e6af706b5b8357