Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
124934ad0499e6086d51cb482a8b179a_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
124934ad0499e6086d51cb482a8b179a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
124934ad0499e6086d51cb482a8b179a_JaffaCakes118.html
-
Size
214KB
-
MD5
124934ad0499e6086d51cb482a8b179a
-
SHA1
f368571e03abbb068c4cb9ecfb91230e0dbbd3f3
-
SHA256
e5597096485f6cbfc37f320a99c8230c0cda15c2c9ecd891cac2fb9462ec1e17
-
SHA512
cfa6ad91a5c5a50489b55d58f6abeac42a6ac6af7eb635ca2375152b2bca7f47abe38e5afe0437113554468d9f44cbb2ee350662081031f0c9a9c340bab9c9fd
-
SSDEEP
3072:8rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJV:kz9VxLY7iAVLTBQJlV
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4252 msedge.exe 4252 msedge.exe 3276 msedge.exe 3276 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3276 msedge.exe 3276 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe 3276 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3276 wrote to memory of 556 3276 msedge.exe 81 PID 3276 wrote to memory of 556 3276 msedge.exe 81 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4516 3276 msedge.exe 82 PID 3276 wrote to memory of 4252 3276 msedge.exe 83 PID 3276 wrote to memory of 4252 3276 msedge.exe 83 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84 PID 3276 wrote to memory of 1552 3276 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\124934ad0499e6086d51cb482a8b179a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9115346f8,0x7ff911534708,0x7ff9115347182⤵PID:556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3825686943220369787,13574180797285953495,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3825686943220369787,13574180797285953495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,3825686943220369787,13574180797285953495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3825686943220369787,13574180797285953495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3825686943220369787,13574180797285953495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3825686943220369787,13574180797285953495,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1968
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:396
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
5KB
MD55f00c0cb57a403a2e3c37f944fe5e30c
SHA184959dbbfc9445e41a2c76182055172a6f5d8df2
SHA25651a053af2e557c0ebbe5cdd0d0989bb2620c320a9b8690df695d90454eb2715f
SHA51299b15b456d88cff34a9b055fa03bd78089fb3b0355404aa1e8cd2ff9330a759f70e0cbe8607cab667998acb0efd7829b4d65fbf0562f984f79d158fd62a359de
-
Filesize
6KB
MD580e4a4c109dd45103144106e510faef3
SHA1e276937148e073c0e437e37b1bce7531cd101f46
SHA2563f4e9130079043aee9af1b6f590d9a5c795f9d201d3cf4ef4b8212b70359918b
SHA512ee9c07180a270c782235d826a58be31ee82dbe537a08001b0f7ce65f4e3eef7c9d2c402f32ebd90719094778236ac3781684bcb960adc8093da0cecd4891ddce
-
Filesize
6KB
MD5e4e705d100dc8829dae82f99e646f204
SHA12b00b035c7f6f1a501ed9d648f65bb360315757b
SHA2567e30ecdd6f82521961fb152276164b40a625c6535c84466ab43578b458f5557d
SHA512adbcc78d2f626653f09188dd9e3b41211ceb535cca86c3aacca56065c172e07bd4c29859d456baa052e2017a9435a64ce142d40e4d5c6f847cb1ecd57e208bca
-
Filesize
10KB
MD58e595f70a64653be2240bff820555739
SHA107a6647b286fab94d865daaa32ccf8cbd2134cd0
SHA2562807209f29b85d6db842f4baeadbcd0be7edb189856c5c763ed11fa210f72e8c
SHA512e07f77b6cbb140150b6c819e9d1d4310829a5ced435838346dedd45c6b336df61876825264673a5093671d57a1b7d7f373f56e449667bb42815b68ce6defa0d1