Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
a4cdeff7c1f7ab58296c0151f78267b1_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a4cdeff7c1f7ab58296c0151f78267b1_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a4cdeff7c1f7ab58296c0151f78267b1_JaffaCakes118.html
-
Size
139KB
-
MD5
a4cdeff7c1f7ab58296c0151f78267b1
-
SHA1
4226844af14539708a340fbd1e53fc073dfc72b6
-
SHA256
b74cee1f5d28cb0e6e8be8971284633588b16a4acadf62a9c593414159c8c4be
-
SHA512
c8a3cb1dd84c80cf093d994eff5a2d9493889b3a4defb4ab016c12dc647d43cacbc3f087da77d8ea682e2b2285adfbb245ecbb87bec3bfbedec491b6a6bb8978
-
SSDEEP
1536:SL33rUWd8mln+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SLYWuW+yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2884 msedge.exe 2884 msedge.exe 1016 msedge.exe 1016 msedge.exe 4396 msedge.exe 4396 msedge.exe 4396 msedge.exe 4396 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1016 msedge.exe 1016 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe 1016 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1016 wrote to memory of 2384 1016 msedge.exe 82 PID 1016 wrote to memory of 2384 1016 msedge.exe 82 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 4980 1016 msedge.exe 83 PID 1016 wrote to memory of 2884 1016 msedge.exe 84 PID 1016 wrote to memory of 2884 1016 msedge.exe 84 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85 PID 1016 wrote to memory of 3820 1016 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4cdeff7c1f7ab58296c0151f78267b1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb750746f8,0x7ffb75074708,0x7ffb750747182⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,336119022846926512,10514130104924404715,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,336119022846926512,10514130104924404715,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,336119022846926512,10514130104924404715,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:3820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,336119022846926512,10514130104924404715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,336119022846926512,10514130104924404715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,336119022846926512,10514130104924404715,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4396
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1484
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD581e892ca5c5683efdf9135fe0f2adb15
SHA139159b30226d98a465ece1da28dc87088b20ecad
SHA256830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
-
Filesize
152B
MD556067634f68231081c4bd5bdbfcc202f
SHA15582776da6ffc75bb0973840fc3d15598bc09eb1
SHA2568c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
SHA512c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
-
Filesize
6KB
MD5a27ceec8df948249093d3ca5a78865a6
SHA11b1b33523a7901ba1e0d339c21bb55d7e5716085
SHA2560f91b48ca2f530a61ecb9442856522067b0319ec14abcb5b3b855e8f1fb9c901
SHA5120365e3ca120f63ab8e6446d3e0b6229c31cf7206623897b51b6568ad280eb8bbdc677ef64a9b48f84c1daeb8cb1ebdf23461eb4f5eb8abd91c8f35c0583dbcf2
-
Filesize
6KB
MD5a87d5c854f5dfedb1ddedab3d7833d77
SHA1d2cc941b7cfcbe2033111610bfd51fc1af40e49e
SHA256371b1ae5fc7f0e03ca7168f067965e64c698502f0fee7f57f2ffec0a6483a039
SHA5125c4ece58b6bf526c0dbaf23b75b37e3fb44b51b3b793c1e0299780a8975f79d056047687c506a37e62eba8fae15e579256dd53b9e69fd5a4c906b68e4effdbd1
-
Filesize
11KB
MD57dddd5dfeb919ec4af7568fad9394334
SHA138b5ae3b08cbf50234f9707edde6a88baed810ec
SHA25646dd2d74b882e3456936057d25debaf681a469fcb80c21136bf16f62b82a0dd8
SHA512e106e8db53110bd0d8f53b69ab9f6ed513c9d6b62577489b35806fbf227e45d0406ec0e60c68450f49a7d8896617506ca3899e2fd6a0d20641a467739bc9786f