Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 23:50
Static task
static1
Behavioral task
behavioral1
Sample
0cf8c62fb7f146278bd136ef4b736f24_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0cf8c62fb7f146278bd136ef4b736f24_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0cf8c62fb7f146278bd136ef4b736f24_JaffaCakes118.html
-
Size
138KB
-
MD5
0cf8c62fb7f146278bd136ef4b736f24
-
SHA1
48168ae9ca35dc775a2d73e3179feab6537fd86f
-
SHA256
b4014215136d6dd70b869bd426c044d4de746be5032989df5a9684f2b242cea2
-
SHA512
286d42e0649c7e5a33ab2bdfd5c747d004d507fdf9f040ccbd62af9aeb4473045f1274184b6181bdfba91e59055431647f6d55f790d159834808a960a34f91a7
-
SSDEEP
1536:S2JqNOI7qpGmnm/Bk0HRlTFA15yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1o:S2yr215yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4000 msedge.exe 4000 msedge.exe 3668 msedge.exe 3668 msedge.exe 1616 msedge.exe 1616 msedge.exe 1616 msedge.exe 1616 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3668 msedge.exe 3668 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3668 wrote to memory of 3432 3668 msedge.exe 82 PID 3668 wrote to memory of 3432 3668 msedge.exe 82 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 1264 3668 msedge.exe 83 PID 3668 wrote to memory of 4000 3668 msedge.exe 84 PID 3668 wrote to memory of 4000 3668 msedge.exe 84 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85 PID 3668 wrote to memory of 2676 3668 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0cf8c62fb7f146278bd136ef4b736f24_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93cf746f8,0x7ff93cf74708,0x7ff93cf747182⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8111223226758122411,17677806725259349736,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8111223226758122411,17677806725259349736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8111223226758122411,17677806725259349736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8111223226758122411,17677806725259349736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8111223226758122411,17677806725259349736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8111223226758122411,17677806725259349736,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2360
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
5KB
MD5a9688f8a572a2e85de81b7898c75c133
SHA15a5d511b2c7a44946c1c8e9a1a60b9f1b69db91c
SHA256556fbc4a0993c2092317d6cbb3e2657296c60d6d83904abf0afbf9fac5fd912d
SHA512657bc47190a99f4558e8dadded08096deaf57bab95dab2699bf5caa29930220277b977d6c433785c1f9ec314bf6c7ec326b46232c8953b9bccb8e3b6a62a71b1
-
Filesize
6KB
MD5660712a0e1712d41fcaa2a3e3aba3af0
SHA1ceb69366de6cbc126dd8dbef1585c84183734a5c
SHA256c4e8fece263b812b23986a4d864af8cebfcb22ec477f9ff8e9d3511149e50050
SHA51255bb33c4b0cacbef22d095cf649fe48892c552555c40aa0e7e77c00eac4e7755bba7011138aef4869a529f9f6b5d23330cb0e1ca68af4d9630d14d67ec9a4a1b
-
Filesize
10KB
MD58093284aebe3ec3c4b6aeebd98d9b6df
SHA16cd9e99507d165e7f046170a37a4aec267ae695b
SHA256050de76f081101d3ed75e0f8aca406289776318ee0023b3b48c414b7f58a3dfd
SHA512fa3c4999f5bf66b79065264b18d975befdb200f2d8b72c9f6b1f8addffefb8797d6e001254c45a10ee785cc307815c52a70e4759d00be740325f403745cecb3e