Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
93c3cf0b5271726a86657e735de89ada_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
93c3cf0b5271726a86657e735de89ada_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
93c3cf0b5271726a86657e735de89ada_JaffaCakes118.html
-
Size
18KB
-
MD5
93c3cf0b5271726a86657e735de89ada
-
SHA1
7431b470c6551563a3ee12e19947d93acd37d60d
-
SHA256
a0386b9feb7d2216fb468892a70f06d35da13ced9b78542c7707c9be87da202f
-
SHA512
3a06c2b404a6a9ba8c9d8652fd485a0abb856ea3ef2223222bda2c069aade2d8a10fc5e26757c7364531f2931cabc8e62bb8e321fae453a3f8cffc45818d14e8
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIT4xzUnjBhDF82qDB8:SIMd0I5nvHFsvDexDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4644 msedge.exe 4644 msedge.exe 3164 msedge.exe 3164 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3164 wrote to memory of 2320 3164 msedge.exe 84 PID 3164 wrote to memory of 2320 3164 msedge.exe 84 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 5104 3164 msedge.exe 85 PID 3164 wrote to memory of 4644 3164 msedge.exe 86 PID 3164 wrote to memory of 4644 3164 msedge.exe 86 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87 PID 3164 wrote to memory of 3304 3164 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\93c3cf0b5271726a86657e735de89ada_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf44a46f8,0x7ffaf44a4708,0x7ffaf44a47182⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,5711730039756516724,12073481511077055436,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:22⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,5711730039756516724,12073481511077055436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,5711730039756516724,12073481511077055436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5711730039756516724,12073481511077055436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,5711730039756516724,12073481511077055436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,5711730039756516724,12073481511077055436,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4148
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
6KB
MD5baefdd4f7196e7a0a35535485fbddbf6
SHA1e16c397c8d742a3efc258b3fbd6fc5e46e6ba74e
SHA25602b05f3307f7e69e83292981524840a1b7787f8975604753f604fb569e45fe20
SHA512ff2b6cc1ea9960c367f2e2de20bdec089464cb5a028d765b4519f14478f328e0c9a0e282a9b4371eeffc66245c9b86f7e3fd9f6b3663864adf4fdf9c272f8f6f
-
Filesize
6KB
MD56e36f322df29a15f051d3c25b84e629a
SHA16bcfce8b54d96eabf36f11d64fc90ad719dfbdd5
SHA2563d365d7b9751dc3ce3f0a0dc3c2fb2ff78a45acfd9157e4f0b4492b737ddbb50
SHA5126651658565b1a147d44a90d4237c044f9b193f48d7f70d1274304eb246e1da7593a5645291cf3968c2bcd063ea05c3ce7838b295caa02fd723b70a8420cd1c0e
-
Filesize
6KB
MD5c3aad0caab37324ffffde1b3deac150f
SHA121edab9222223ba9360a78aef54a3fa34addb1b5
SHA256e07a895ab60b4a2e7b0e8c126e67e9acfba81b33d8aa089bfd97004b19a754cc
SHA5129b3b72a525df098c6459f1faab383babe401f7161328f09c5228a27d0db97ac52e73959cbc0e11a64a480b687784fcda2cd6c913c79ca99e3495b08d1e009d22
-
Filesize
10KB
MD54453057ba5d4532cb2b3bdcf0805a93b
SHA167cbc3361b37823854fea1b0470de62daa47b245
SHA256023807ca08ad057c082f402a35a2c8032d4bd1f06a3c2001a7efd62400fbb1d7
SHA5128889452f2a7a9607e7fcfadafdca423bcc026eca09de142b0fb12d061c1824b1553e5c0632b7eb5ff3ea75ca741e60a9847d7bfe5e33b54eca0021b0312f357c