Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 17:16
Static task
static1
Behavioral task
behavioral1
Sample
35ae5e1d80ce7ac618f751c7e3b49641_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
35ae5e1d80ce7ac618f751c7e3b49641_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
35ae5e1d80ce7ac618f751c7e3b49641_JaffaCakes118.html
-
Size
218KB
-
MD5
35ae5e1d80ce7ac618f751c7e3b49641
-
SHA1
1a12542f785b7ece7a96345d417ffb4d004b152e
-
SHA256
858b65d31059c98bccfb30ea56b63061d8fa8c5a52c84bc356d66240c9c07366
-
SHA512
2d353fffe43bbe81ac798bfe3018b6f2c513987750afb3a919d274559c480d554e00f7fb3dcaaef94f7290ab963fa744a4080efb7644ebeee7681a4b050c3f9b
-
SSDEEP
3072:SWwgQzyxajMyfkMY+BES09JXAnyrZalI+YQ:SWwdOOxsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 980 msedge.exe 980 msedge.exe 1476 msedge.exe 1476 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe 4056 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1476 msedge.exe 1476 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1476 wrote to memory of 2424 1476 msedge.exe 82 PID 1476 wrote to memory of 2424 1476 msedge.exe 82 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 384 1476 msedge.exe 83 PID 1476 wrote to memory of 980 1476 msedge.exe 84 PID 1476 wrote to memory of 980 1476 msedge.exe 84 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85 PID 1476 wrote to memory of 1304 1476 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\35ae5e1d80ce7ac618f751c7e3b49641_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea93746f8,0x7ffea9374708,0x7ffea93747182⤵PID:2424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16795102132334350700,4408003492181671215,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16795102132334350700,4408003492181671215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16795102132334350700,4408003492181671215,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:1304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16795102132334350700,4408003492181671215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16795102132334350700,4408003492181671215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16795102132334350700,4408003492181671215,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4056
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1592
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD53895ab245b8b8a9bd9b2f215fada27da
SHA17c1ac08db6473920f816f219bd45e613ff6c0928
SHA2560dc595fddae3ef5c01082a7296f48e8d7f82ebe4be1b6a7b108fac01881895f4
SHA512f56875cc09ac5a091a6adf6dd7ee31da50d5b8d918e1887b27a6f909f2464e3aec03cfea5965f6b84825c03cab249f6cfffae7f83c53655d98e08645435d26a1
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
5KB
MD5504c03d62535fee6029123bb20d90cce
SHA16f1fae66a841a473968aa151302c500a8e4591ce
SHA256f5c8e3fb193271279ce714c0c4ba7bc84625de582342146346ac365e0e56e634
SHA51297fd350568465c2224c6e5f6812c751f20ef9b89e13e0733fb47d7ca773b6f24af873671022296ac7cfcb2e42e89de877cc0d26828c6d2ad4183a103bde1b88a
-
Filesize
6KB
MD508f95fe9a3f90f3f81c242e76c031c71
SHA167786d41bcd55ec8c8582add34b0afb2672295da
SHA256d1cb6d665a91bdf81715ffda00f1ecdfc3eec86c826202d1ffdabb12e4c846d1
SHA512a054747f5690e301a53097766047b1e9c8af5cb7abfaad7c945c3fcfe83083ce14b45ca072f282ed3cde13157d3e17893a77aaf01fe4950358f22ca82b755eff