Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
0f53077e4d004d5c0a4b22ff9e37af2c_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0f53077e4d004d5c0a4b22ff9e37af2c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
0f53077e4d004d5c0a4b22ff9e37af2c_JaffaCakes118.html
-
Size
122KB
-
MD5
0f53077e4d004d5c0a4b22ff9e37af2c
-
SHA1
4dfc569e12ab6582bfae94eed62dff89b04fe157
-
SHA256
62b10134b892ce6dc6eb35ed74cbf2979e6c6169d9d7b8a453d1472a492af29c
-
SHA512
745820e72ced59da6e4ad524b84cc5bd5cba5c23721e8fcc053f4afb37f9228b9aac9225f6414215a4147e78b66b6089c262d6918ebf9a86129f974e4cfaed11
-
SSDEEP
1536:27s7x5m8Nsv3aUvFPoIzDX7o4QMmMW2++ZrvP:5TmYWNrQyW2j
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4884 msedge.exe 4884 msedge.exe 2332 msedge.exe 2332 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe 2332 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2332 wrote to memory of 1236 2332 msedge.exe 81 PID 2332 wrote to memory of 1236 2332 msedge.exe 81 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 2948 2332 msedge.exe 82 PID 2332 wrote to memory of 4884 2332 msedge.exe 83 PID 2332 wrote to memory of 4884 2332 msedge.exe 83 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84 PID 2332 wrote to memory of 2484 2332 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0f53077e4d004d5c0a4b22ff9e37af2c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe40aa46f8,0x7ffe40aa4708,0x7ffe40aa47182⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3245164440363575831,11860355663950530485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3245164440363575831,11860355663950530485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3245164440363575831,11860355663950530485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3245164440363575831,11860355663950530485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3245164440363575831,11860355663950530485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3245164440363575831,11860355663950530485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:12⤵PID:2596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3245164440363575831,11860355663950530485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:2752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3245164440363575831,11860355663950530485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:12⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3245164440363575831,11860355663950530485,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4724
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1784
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD5923ebdbb994e8cd647c00e16d1c8a3b6
SHA19a2d9a342c99f609e6e549c76b4dc933a15f6439
SHA256f2ac0461687a6791200209247445fed001b407e3676b4d7cd5df52a37b8ac01f
SHA5129d12df6c3ff4efaddf486d8061fed937f29ef9d96673dd1a1f6cb70c1bb27ee0d99c6f61050663d7b9c104aa06b1d11005acf8ce308474761afc72547085a416
-
Filesize
6KB
MD59b5588329d7c7696c32e16875e071adf
SHA1d9bd431e10a8fa6a1dad7f158dc2301dbf6d8875
SHA25652864d43e21822b8b2ebcedae8fc96e7d2b892bf74eda76d487afc66fdbdfe44
SHA512dc7afcc36000ecf5273f47b4b980f4bb392af49b6430a870a07f1796c0a1c7dc798f1c14aa7b56ccfd1b0fcff987f98f1ce26294f431971a911851685c4f70db
-
Filesize
10KB
MD5bc1b8401c03849b78f1d8ec0c21f2875
SHA17210792ccbefa589a43542400b5f752b9f94d5ea
SHA25667552fe2f0e1c1d499cc15da28b86da6480ee2107e2345f7f4620abd23426306
SHA5127a48468d89f50f2465f1b21701dff134c10dac2f8bbcd68de34a4fdad8a75ca251331c70eb4456f14881a51179f273aeb718fc20c79eb732420befa7638825d2