Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 03:22
Static task
static1
Behavioral task
behavioral1
Sample
90628715b9c7227c3f6eedc90ab80da9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
90628715b9c7227c3f6eedc90ab80da9_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
90628715b9c7227c3f6eedc90ab80da9_JaffaCakes118.html
-
Size
141KB
-
MD5
90628715b9c7227c3f6eedc90ab80da9
-
SHA1
8570effca62ff2fc704d6639f38b0ca180bd05b4
-
SHA256
c97c1b6ea21a7b0eb62c56e739e3533851ac688309cfb576055125b0ebe1a247
-
SHA512
63e23854f7bf12f7a0f0f305dabb469592afbd9a2bfbab7a068c5298eeca5d1f12208efa2ca18d4019ee3acd7a78b1659f6e1862f12402b922e1d421afd1ef90
-
SSDEEP
1536:SsqxaZUt6Dnx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:SDt6rx7dyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3772 msedge.exe 3772 msedge.exe 4856 msedge.exe 4856 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4856 msedge.exe 4856 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe 4856 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 4604 4856 msedge.exe 82 PID 4856 wrote to memory of 4604 4856 msedge.exe 82 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3476 4856 msedge.exe 83 PID 4856 wrote to memory of 3772 4856 msedge.exe 84 PID 4856 wrote to memory of 3772 4856 msedge.exe 84 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85 PID 4856 wrote to memory of 4888 4856 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\90628715b9c7227c3f6eedc90ab80da9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c47182⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,16045071158869500514,3354757131932169225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:3476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,16045071158869500514,3354757131932169225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,16045071158869500514,3354757131932169225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16045071158869500514,3354757131932169225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2884 /prefetch:12⤵PID:760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16045071158869500514,3354757131932169225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,16045071158869500514,3354757131932169225,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2624
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4848
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD56737579868cc0ed4770ff20539aec80f
SHA15d6ffb56a3f955ef1ae887c49c135b9ddb9b3a4b
SHA25615acba6e8c34dc4a2b6d76d958c94ad4c88f3739d2f9af30486283ced1e0a468
SHA512fc1cf50983faf597b243b7c7ac920c6643d281b5a0afa34c681e537b188b4c6cb565b5ce52d3bb8fecb75a249cf3f33d3829def26e4b3e02e644d978c3736d40
-
Filesize
6KB
MD5e42d1e23ebf37ea9aa1db0253f68d1ea
SHA13fa4eb10acb451ab73abd94dd0a55346d95ac175
SHA25617e49eed21b615146f3b541aa5c3e749e9944a3d197a85b9e00a96c9695c09ec
SHA512b3b18d6a56c56a3bae1bd1776d6d7a226a055d26fbffd4a53ac95cd773321a72808df1ad9959a091990d7a89bd02e2fbee672a3e74b323c623cc91606620bbfe
-
Filesize
11KB
MD5943319603444559bb97d1329f3721eb6
SHA13902b969e3d526cd793c6386637d33ca17da05e1
SHA2568f78908dc9d84c4b7112a5c0c1ec7d50af9f685707e36891a41366e80ab31273
SHA512f858995774e61642942d706add2faabe2219fd5ec533b681fb4aeef9bf56b24bce7fa6cc5aea90c0a969b0239675ee452e3dd0d116f96519d53849dd4e06fc62