Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 01:32
Static task
static1
Behavioral task
behavioral1
Sample
96e73a8505f5a9265a33fbb205cf4313_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
96e73a8505f5a9265a33fbb205cf4313_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
96e73a8505f5a9265a33fbb205cf4313_JaffaCakes118.html
-
Size
139KB
-
MD5
96e73a8505f5a9265a33fbb205cf4313
-
SHA1
9f45416abb0e00f53b20392209e9036c999a7bfb
-
SHA256
496dbc7df796dc535f3cfb05969fdb0fe85204e400b7fb7931ee8a6e8b9d9a7c
-
SHA512
02a98db5e9d97704b90e8aebd5d575ad2e6192e278f808343eaf5e7eca790ba1b3a52d983015d7c37671897b1a3f4ce7ffd7ba12b6992cc4406c31b7d931529c
-
SSDEEP
1536:SlNtQHlOHyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SlocyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2236 msedge.exe 2236 msedge.exe 3484 msedge.exe 3484 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe 1580 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3484 msedge.exe 3484 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3484 wrote to memory of 4028 3484 msedge.exe 82 PID 3484 wrote to memory of 4028 3484 msedge.exe 82 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 5032 3484 msedge.exe 83 PID 3484 wrote to memory of 2236 3484 msedge.exe 84 PID 3484 wrote to memory of 2236 3484 msedge.exe 84 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85 PID 3484 wrote to memory of 2728 3484 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\96e73a8505f5a9265a33fbb205cf4313_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb8,0x108,0x7ffaa37e46f8,0x7ffaa37e4708,0x7ffaa37e47182⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7748138190198220403,11358504515867822743,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7748138190198220403,11358504515867822743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7748138190198220403,11358504515867822743,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7748138190198220403,11358504515867822743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7748138190198220403,11358504515867822743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7748138190198220403,11358504515867822743,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2700 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4568
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD5cdb62465b93ca07d3a5920ec1366d43f
SHA1c45d2f46872d1cd459cb127cab616c32e70ace5c
SHA256e4df8c6fa0b40392dd3d8d1ce4db0f735923c4018e809721e8b83863fc4cf82d
SHA51251a1dfefbeab79c0544642b834cd8c7b10de334c60f3a6966784d4f0b7f619504638fa8539c6f977f5213589a4cee560080f5ccd8cca6e5e4d0277f021b1250e
-
Filesize
6KB
MD5374bb29efed03e39bbf3cd88e9f44776
SHA19a7e797799c9660f3a1ea4b365a2f6da83111c08
SHA256ed74068c967b542b887274787680fa48f8c206e629fa41128c2a1dab171673ab
SHA5122e08032e510db09fe3d467bc79c10ae23a4c7da879ad8f1279c867fa714b57ccdd4ff691938872a546c6a27d3c792a469884e093f23595106841f1c3948817d8
-
Filesize
11KB
MD53e7be5a299fc7b3cbaf969a18f545c18
SHA14499a0b095fb067472a56bba6ce673ea3992bc0e
SHA256b821d7aa8565d9e6a9a22c959c4d0b9e7513b700744bc41d4cb34c5eced0d7c3
SHA512305016e839335ebc19156beb2ed0ca7d42e5b77510cba6a992a7ef957cb376268caba5f2d9ad13d77067a111a75aaa319ef4378ec1fe295a30e30e7cd2551541