Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 19:47
Static task
static1
Behavioral task
behavioral1
Sample
4b23a1bf765abc03fbc585a3d8ff564f_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4b23a1bf765abc03fbc585a3d8ff564f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4b23a1bf765abc03fbc585a3d8ff564f_JaffaCakes118.html
-
Size
50KB
-
MD5
4b23a1bf765abc03fbc585a3d8ff564f
-
SHA1
ec87831a99a6c3b7d82141bf182471fa84a542af
-
SHA256
6a5a301fd4ec633c3133577c716f1415318a7bbf268314db91b5bb32f11636f7
-
SHA512
a4345efb39a18a7e3914f511ceb825dab6542e7b4331a78fb16bdb9f35cf5aef8ca45d1293f6240eb23170e688ee409ea5dd20a03a1715222abb22cc3f31c56d
-
SSDEEP
768:SIcSb/C89RK6cLlrlNp7gtbSJ3dn2EtT6CUtoXL6NeR6CHJW/iy:SIcs/C8nOhXpUt6nbt0omBCH8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1512 msedge.exe 1512 msedge.exe 3340 msedge.exe 3340 msedge.exe 856 msedge.exe 856 msedge.exe 856 msedge.exe 856 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3340 msedge.exe 3340 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3340 wrote to memory of 4872 3340 msedge.exe 83 PID 3340 wrote to memory of 4872 3340 msedge.exe 83 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 3200 3340 msedge.exe 84 PID 3340 wrote to memory of 1512 3340 msedge.exe 85 PID 3340 wrote to memory of 1512 3340 msedge.exe 85 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86 PID 3340 wrote to memory of 4780 3340 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4b23a1bf765abc03fbc585a3d8ff564f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef8c746f8,0x7ffef8c74708,0x7ffef8c747182⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:82⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2496 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:856
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3504
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56c86c838cf1dc704d2be375f04e1e6c6
SHA1ad2911a13a3addc86cc46d4329b2b1621cbe7e35
SHA256dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb
SHA512a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37
-
Filesize
152B
MD527f3335bf37563e4537db3624ee378da
SHA157543abc3d97c2a2b251b446820894f4b0111aeb
SHA256494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a
SHA5122bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485
-
Filesize
6KB
MD5a9b8b8490db5cdd9f2eadbb13dbe1bfe
SHA1a5d01b351df322f95c542508ac32f06a1530f53f
SHA256a3a7117c1a18dca0944e19b004dbfd1eb106aebece7175eb2755d70a87338d82
SHA5121804bd715505ec4eb73e1c0c158536715a22870d78493530cb58329a96871cfd3c09abea6b12c9f32a5cbfdf669f6398d37cb977504410413e7d0ec0255d2611
-
Filesize
6KB
MD50aa1a17fe667702661530ab7ada33984
SHA1093acda04af0ae83fb2b4a9bc4502d0cc1f8272d
SHA256e2cc96e61ec06ca34dc7bba2026232c3a2d9153a736aed5b43722c07f5bf6911
SHA51238214f0d2760dab2ffa38d6a14792e13d4c973fdb6fb2c3e16a65a7e22754fb3e1e594e040f1cf1dcf708067fe008da051f5cfa7557861da5f126c8da83ccabb
-
Filesize
6KB
MD5140d95a06e44739c384d7bf5ca0ee681
SHA197ddc27469d64182580ee09ec5fa3025bb9216f3
SHA25600d1950813e16954b9b25c773211046412ff8bbb79c9b242aae5bf362643b2e8
SHA5127bcdab96310d7883152211123d8774b5d714d47439ed46a915247b970c59c5e924223a84c74b7269e17ab3c8b1f1bc02cca7fb898099dc9b74692bdce33823a7
-
Filesize
10KB
MD5b3e81599e731e799a72d1531a3bb70aa
SHA135a10d343114a8d1754b920888f1efbe33eb37b3
SHA25634069341a2ed12541e01250969d95a27ae506489fddc98d0d16cfd28123c2669
SHA512e24211773d86e9e861d7c60036b462672c17e47a7a8e9b06f99ca05ae3a5dda98aa0b30c628112d1fa7834ab51ed1c46bd5772bc1f726ffad003365cd6e0dcc6