Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
b1fc56247bc7fd34d87c8514a006eb71_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b1fc56247bc7fd34d87c8514a006eb71_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b1fc56247bc7fd34d87c8514a006eb71_JaffaCakes118.html
-
Size
18KB
-
MD5
b1fc56247bc7fd34d87c8514a006eb71
-
SHA1
d84f0bcd96b626dee9f45f80e2865b690a2f1f1d
-
SHA256
e7ca399e211643c988d92fca4b2fae730c96cfd4257d66c282d5a01779b688d3
-
SHA512
2e2e15e9fee5b5502f5d1122f6561a3bae607bd0b7149b240e5d278ed6c15396c30008068e0eb7b1f5525de4006f485a32e15512c8af7086c6fbac92030573f2
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIW40zUnjBhg682qDB8:SIMd0I5nvHfsvg5xDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4344 msedge.exe 4344 msedge.exe 4896 msedge.exe 4896 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4896 msedge.exe 4896 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4896 wrote to memory of 2004 4896 msedge.exe 81 PID 4896 wrote to memory of 2004 4896 msedge.exe 81 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4724 4896 msedge.exe 82 PID 4896 wrote to memory of 4344 4896 msedge.exe 83 PID 4896 wrote to memory of 4344 4896 msedge.exe 83 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84 PID 4896 wrote to memory of 4276 4896 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b1fc56247bc7fd34d87c8514a006eb71_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffa40d346f8,0x7ffa40d34708,0x7ffa40d347182⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15357092087810739493,5599416610995291785,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15357092087810739493,5599416610995291785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15357092087810739493,5599416610995291785,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15357092087810739493,5599416610995291785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15357092087810739493,5599416610995291785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15357092087810739493,5599416610995291785,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6108 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3980
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5db9081c34e133c32d02f593df88f047a
SHA1a0da007c14fd0591091924edc44bee90456700c6
SHA256c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
SHA51212f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
-
Filesize
152B
MD53a09f853479af373691d131247040276
SHA11b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA256a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
SHA512341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
-
Filesize
6KB
MD5adff62369b2bdb28f6a46ac48fe00948
SHA1990d187943794d1f30c471dfd399e597d01d149b
SHA256c081b75a6cf4bcd16173fd87e13d11517e2dc425e75c2b006afcb8f82b1c9801
SHA512f2bf95459a9c2d42d765dea1c221052cc7e7c42158f710d074e052225a78c2fc1acc5d2f8eed078b41880bdd81deeb62af87a6d3e235cf7a8a5517cc42015c41
-
Filesize
6KB
MD5872d6610c8d776839bd520e46c93d3b4
SHA1c5b02f361731bb08b0ed619ff82337b7e12defdf
SHA2568b971c7a609937303a208abfa528d6194729b19eda639bb6acd437b208a7f1ee
SHA512287be64edd84978a0c17e556db8eab9cc50e42c6b9f494057c1da5232b78f643d37f3fabe7bfb940e39dae57abc0639ed42db00190cbba66f2ae101c42891deb
-
Filesize
6KB
MD50d65b00d51cfa2f6b336a77f25edff62
SHA12c0a171c80a96f6e30751773a674ddbc2153530a
SHA2560cda8dc5d5372518018e822b27bb7fed6bd067195d1e16d0f6f9cb5e5e27f435
SHA512f0c47f5bdc6bb4bb24e7cedb767e02fed345bb52964b1beae0a0b4af5577ed1279d84b469c38f5116dac83510e41f87d9a25b1d2fb7cb28b5b2daf564c76dc13
-
Filesize
11KB
MD5250a6530ffee9c9a8d6c6d34856c8cde
SHA1edc62cea8c91647f62f9d6ddcc4ade2c5cbd4e7d
SHA256e05016c40f8c577d2dcc4d2dcc0aa4903e1dc2b1e04843e004d8052d60a229ee
SHA512f2320b2f103fcb802d3dfe0a640d5f40e02912e34e6df4ed7d072a34d1b118fba2981655add308e889d265f094a64abd9ca56a5aeb83bd8ccfe8cc916e81a4bd