Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
a756e2cfc533de51a2d1da6c3383b73f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a756e2cfc533de51a2d1da6c3383b73f_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a756e2cfc533de51a2d1da6c3383b73f_JaffaCakes118.html
-
Size
140KB
-
MD5
a756e2cfc533de51a2d1da6c3383b73f
-
SHA1
b927327d642d66415bc794026ab19007c6b00b34
-
SHA256
516d53e3d6ed3d1d9c588863c642170354057397078ed96fdc76334b30be92b0
-
SHA512
193ac973598a523b560fd3547603d2d06f31237130b04192040857f0a4fbbb24bb1772de2cc6d4619bfd5ba4f26248ee074c30035bfe614f65c532cd4e6307ed
-
SSDEEP
1536:SZFdO/9O6efl2bk4yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:SZeD13yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4860 msedge.exe 4860 msedge.exe 976 msedge.exe 976 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 976 msedge.exe 976 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe 976 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 976 wrote to memory of 4532 976 msedge.exe 81 PID 976 wrote to memory of 4532 976 msedge.exe 81 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 440 976 msedge.exe 83 PID 976 wrote to memory of 4860 976 msedge.exe 84 PID 976 wrote to memory of 4860 976 msedge.exe 84 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85 PID 976 wrote to memory of 372 976 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a756e2cfc533de51a2d1da6c3383b73f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bef646f8,0x7ff8bef64708,0x7ff8bef647182⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13899134529489751425,15589670471124516552,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,13899134529489751425,15589670471124516552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,13899134529489751425,15589670471124516552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13899134529489751425,15589670471124516552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:12⤵PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13899134529489751425,15589670471124516552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:12⤵PID:2352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13899134529489751425,15589670471124516552,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3056 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4764
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3360
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5db9081c34e133c32d02f593df88f047a
SHA1a0da007c14fd0591091924edc44bee90456700c6
SHA256c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
SHA51212f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
-
Filesize
152B
MD53a09f853479af373691d131247040276
SHA11b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA256a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
SHA512341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
-
Filesize
6KB
MD5076f34f94f81343a247255bf8ff188dd
SHA1b3db8dc14933f621cb4ba97a8006bb9422514764
SHA2560461332ed4ebf5cc5267830fc3d455510bd8059eb0cc00eb2f6f71e97bff6f37
SHA512841fac8845a9ef05d062a19a4a4447af331ac41b20ef43f36255c38f39965559014edd765d00de0f046bda094dd8688f320afdec865d7c9108ff1450554d7da4
-
Filesize
6KB
MD56f32c4cc9b50b7b4cf87091b6278440a
SHA160d14d6bb1e44c7a830b6c5b20dec32a76b91246
SHA2569bcec88b5a3b56ff03fa1548fddff4d27adcc9a7265f1f6bfbf25fc83dbbc57d
SHA5121ef9082973bb9b7b47317b07d2d398e0825d770015e2c6602308f872dd4a3e41c4e3c68018c764c14075c742cc3a91323b53756a9fe3e56ae95614da8abf1bee
-
Filesize
11KB
MD55210dbc3be20ac79abc0d9a5c6f043f6
SHA15b6dbcb35b354b44f173e2412dacfcb7a457c6a1
SHA256e19e34b7157a67a8b600f47b8d2657833704c7e7994db00773a24f5ced7e9bf8
SHA5123560ee04380ee0a671bc56881cffae0a07bf5f5557af04d10712198a41a9100442cb24df2d5cd0826b0b2725f22670a06f6d6634001ab3a2eefedd4e630e6225