Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 22:46
Static task
static1
Behavioral task
behavioral1
Sample
07bbc4a8bd72a3be4e48242591d1ef40_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
07bbc4a8bd72a3be4e48242591d1ef40_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
07bbc4a8bd72a3be4e48242591d1ef40_JaffaCakes118.html
-
Size
138KB
-
MD5
07bbc4a8bd72a3be4e48242591d1ef40
-
SHA1
fb8db7b4f8261bcb1f8c8168f7df1b3efd4e65e9
-
SHA256
e8d7dbcc2dd8692266ab37692449e40713169256567e49ddff0d8b14b0427c82
-
SHA512
30563dda087f9810f883d978ee879bcde7dd6b6d2e9a1a4f74adaadcb0aacd2d2c620dcf981c1af86e039830ae7da78d88bdbd4b7ea4dfff29d488d085ddf5e1
-
SSDEEP
1536:Se1m+DBP37layLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SeFAyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1472 msedge.exe 1472 msedge.exe 3168 msedge.exe 3168 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3168 msedge.exe 3168 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3168 wrote to memory of 4916 3168 msedge.exe 83 PID 3168 wrote to memory of 4916 3168 msedge.exe 83 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 2704 3168 msedge.exe 84 PID 3168 wrote to memory of 1472 3168 msedge.exe 85 PID 3168 wrote to memory of 1472 3168 msedge.exe 85 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86 PID 3168 wrote to memory of 228 3168 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\07bbc4a8bd72a3be4e48242591d1ef40_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd73946f8,0x7ffcd7394708,0x7ffcd73947182⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,236451738076739254,5570998464777131727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵PID:2704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,236451738076739254,5570998464777131727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,236451738076739254,5570998464777131727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,236451738076739254,5570998464777131727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,236451738076739254,5570998464777131727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,236451738076739254,5570998464777131727,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3640
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:840
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ab8ce148cb7d44f709fb1c460d03e1b0
SHA144d15744015155f3e74580c93317e12d2cc0f859
SHA256014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
SHA512f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
-
Filesize
152B
MD538f59a47b777f2fc52088e96ffb2baaf
SHA1267224482588b41a96d813f6d9e9d924867062db
SHA25613569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
SHA5124657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
-
Filesize
5KB
MD575f7ddd4f4e96d21c860c287a3a95bb2
SHA192158580345a118c9245cb56d00ea66631928571
SHA25687026e3135498ca1fdcde8a48b254dc077bd79a4169bc049a4dab80aeb70a48c
SHA512929fdd1009f24a70e98aa4db712d7fe23ca1712ac98d2dccbce7013a3a32db71c1839bd2544320336d65e1c928e6e4a67ddcb6c4366fcbaa412641f6caab81ff
-
Filesize
6KB
MD516d23123477375beab3614980e7b28bc
SHA1fc29c6520ae167a49e8fc282d2cc5195b7d6fb3c
SHA25698b5b9e6c09474df222cda9c202f79e0f7b7bb7a9b4bf265e93d0069ad7c4895
SHA512bcc5d671ba7d579619b4fde238dc6ed91b22e13c46f0eb8b21e53a7f9066a834e94f8b68df5d0e0b67f412da0cf2031987bda1c3d53da09c4bf8d62f31e74d3c
-
Filesize
10KB
MD54f5f711a1fb2bce1731439d358d0cb1b
SHA17871863dd43a8a8ee21166586bbe9c1f01dc2e13
SHA25690eabbe3a7afcf4d7f4e145a348e4e0b5029141e5c254941b7fb72d335986efc
SHA512f7e76d9b3f02b03dae5ad568bd40864438d23b514b5f0b3cbdcfcb61a57d50f6a2abcc19d9dfebaebf7afe93d2965a48a250cc5024b37bff43183f85260485e1