Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 22:48
Static task
static1
Behavioral task
behavioral1
Sample
a6f7c391b99b90043113e362aaebddcf_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a6f7c391b99b90043113e362aaebddcf_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a6f7c391b99b90043113e362aaebddcf_JaffaCakes118.html
-
Size
19KB
-
MD5
a6f7c391b99b90043113e362aaebddcf
-
SHA1
f12393468dc9baf11953641527491e281e5857f3
-
SHA256
6765c5d29e40e8ef91835749cfbd26ad2206275f5fe700b43b5f56849c81cd30
-
SHA512
51fa08494a1ace57945b5d08fe03e506415207b6828e08118005eaa6acc4103b7f0095e77cbcd4fbc0f56465e8e36473046f58335f565edc77c272c615863af9
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI84QzUnjBhE+82qDB8:SIMd0I5nO9HNsvEtxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2708 msedge.exe 2708 msedge.exe 3984 msedge.exe 3984 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe 1704 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3984 msedge.exe 3984 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3984 wrote to memory of 1856 3984 msedge.exe 81 PID 3984 wrote to memory of 1856 3984 msedge.exe 81 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 3788 3984 msedge.exe 82 PID 3984 wrote to memory of 2708 3984 msedge.exe 83 PID 3984 wrote to memory of 2708 3984 msedge.exe 83 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84 PID 3984 wrote to memory of 3636 3984 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a6f7c391b99b90043113e362aaebddcf_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe808046f8,0x7ffe80804708,0x7ffe808047182⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4876618158583519251,5723807397732854632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4876618158583519251,5723807397732854632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4876618158583519251,5723807397732854632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4876618158583519251,5723807397732854632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4876618158583519251,5723807397732854632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4876618158583519251,5723807397732854632,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4956 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1704
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4956
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
Filesize
6KB
MD57a6d183f571952bf7f1c8479d98a8dda
SHA190eb7f8aefc98573afa970b410a5f4652caeccea
SHA2569b08f05f13df79fc035428447b23507eec55cefe228cc23f5be835a54093f1c4
SHA512c57b4567ef65fd7fd4f492a3b1162b65afee52a24fcf108385923265631ba648500b361e807d7b5c1e052c58c105c221b433893d11dcd7fcd6ac687b64d38384
-
Filesize
6KB
MD5a9754c1ca2efa3e48dc200ef01d8f50e
SHA1bf82ca598075351d8388e33da5880abbaff4f1f1
SHA25642e18aee2ca1efa851be5b68c35cd581dc34e97224cce840d1bae07bec21c3b1
SHA51260be6a411ccb16645423b07e3648ce456e8457d0a91752bbc487244596c19b688dc38d5f07bc220342a47e4f9df159a777a0891530c4f673685699d8a242ae2f
-
Filesize
6KB
MD540d6fbb72fb7acc572f5877fd8b48d29
SHA1f88597d1571969c30aeb4063dfeac9709955baa5
SHA2567003b2b08264cc939eb6ca158823b6aafc36f305e37186a5e46c0ad3e9b41838
SHA51282a3623b0e1cef36d9678dc90672402bd6a28a215f523a320e7a099c37e5c8dc8494c9c3851d51d966fb73c81fc4b96c06559ad772f82b3c8156157f2919805a
-
Filesize
11KB
MD51312bd84358b3dfdca11875bcb5d68f9
SHA1a5c159c4b2f1664fa808033174f8df4164c52a6b
SHA2561dbab23bcc91d16fd540be0d3b0b7512a8d5e2e6638b067e7332b91e6835b011
SHA51246626b6252cbec0985c61a7218716620947b29018e32d579518624c119a1513b6ec3846fbf6c0c8661a3643e153ea8ad1b907b6da1bf46de5d2ccf178d91b710