Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 18:05
Static task
static1
Behavioral task
behavioral1
Sample
35def79e291c3927dde6fcabf4f68836_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
35def79e291c3927dde6fcabf4f68836_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
35def79e291c3927dde6fcabf4f68836_JaffaCakes118.html
-
Size
158KB
-
MD5
35def79e291c3927dde6fcabf4f68836
-
SHA1
e15838b32b6c3861d47134c291b033afbde112ed
-
SHA256
2f787e83920b6ffa7956a89d8d35873ea808354541b6277bd58d3a733d72b7bf
-
SHA512
1065004e579b96f59147be3d654f59f637ea38490a62a67d68705c0c202fa7009c41045092d480d69436b970eccbc38ab0750f25b9997271e0553a88bcd5a982
-
SSDEEP
1536:S1hiMFabSo7lbiShyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:S1USoNiKyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4580 msedge.exe 4580 msedge.exe 3924 msedge.exe 3924 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3924 msedge.exe 3924 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe 3924 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3924 wrote to memory of 3732 3924 msedge.exe 82 PID 3924 wrote to memory of 3732 3924 msedge.exe 82 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 2548 3924 msedge.exe 83 PID 3924 wrote to memory of 4580 3924 msedge.exe 84 PID 3924 wrote to memory of 4580 3924 msedge.exe 84 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85 PID 3924 wrote to memory of 5024 3924 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\35def79e291c3927dde6fcabf4f68836_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffadd346f8,0x7fffadd34708,0x7fffadd347182⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7610019816742869891,13903862561173887972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7610019816742869891,13903862561173887972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7610019816742869891,13903862561173887972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7610019816742869891,13903862561173887972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7610019816742869891,13903862561173887972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7610019816742869891,13903862561173887972,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1892
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3676
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
6KB
MD5793308b0582477b5051d6f5058b1d4a0
SHA19f250010d72ee1da0429fda105a05b3be73480b7
SHA256d83dc6d4a8602a614e8fc4b532dd7277fe2bc7189eb27f7142486b230910b08d
SHA512e3a1910cf8c1c5075a6bd57ee0ee8cc2e93c06007e341145cdd8e89481adb2d7dfaa99944155ce5d13c465eb2da9186d96813c37581711082d21a04fbeeee139
-
Filesize
6KB
MD52d0c1905a905e57786b00ecfc92acddb
SHA122120e4436b145162493b415cb31107081ccdfd2
SHA25607cd77d0ea851a7803aae66e60e12ae3787551746f8d82c5706328b378eb5537
SHA512357f89005ef205c3500f5f817d441e8e8e24ad5f809a4dd06406c0af3516c7634bf9cee143bd10c6c0719702ffc9cd034e20502b1573d99538293db14c56d3df
-
Filesize
11KB
MD5668b972d7328a7ff806666ee195a937a
SHA1515d29d7ff1a7dee8e887500fbaa8dd4ab8c7a57
SHA256bbab5d7cf0fae58b1f275d18736983989c8f7308e02999b1f57107697e6255df
SHA5121136a34578e6540ccb5ac1f8a15d25faea424d3a162f7fef65ddb775f8bf7a1a8d2727b1f58a241920e6e463ac5366fa2e333a71f77ba5fb6a5768bc3eb4ec36