Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 11:25
Static task
static1
Behavioral task
behavioral1
Sample
39d935bb40cbe2590a38b0d23a803644_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
39d935bb40cbe2590a38b0d23a803644_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
39d935bb40cbe2590a38b0d23a803644_JaffaCakes118.html
-
Size
386KB
-
MD5
39d935bb40cbe2590a38b0d23a803644
-
SHA1
4dbceaef0ab63b49529d54f791d19ae55735040b
-
SHA256
5f7126449f9d3ff412b49398c16ba3138ad6f7a4158ffd2763a916bf720a8789
-
SHA512
1a747b9c88ef2d41b86802c949deb84a47a9ac7c4ff35c97ebf291fa95814b0bad23595b3d47b378c3ffe780d91f6d75705b3b695524a1f95a1d13bb4cd1ecdb
-
SSDEEP
6144:Sx+sMYod+X3oI+YIsMYod+X3oI+YLsMYod+X3oI+YQ:j5d+X3M5d+X315d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2620 msedge.exe 2620 msedge.exe 2084 msedge.exe 2084 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2084 msedge.exe 2084 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe 2084 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 536 2084 msedge.exe 82 PID 2084 wrote to memory of 536 2084 msedge.exe 82 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 5080 2084 msedge.exe 85 PID 2084 wrote to memory of 2620 2084 msedge.exe 86 PID 2084 wrote to memory of 2620 2084 msedge.exe 86 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87 PID 2084 wrote to memory of 5060 2084 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\39d935bb40cbe2590a38b0d23a803644_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe41846f8,0x7fffe4184708,0x7fffe41847182⤵PID:536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:22⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4912
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6fd0bbf5-c4c0-4ab5-b177-7d072f2c70d7.tmp
Filesize5KB
MD567cbe4d76403cba89c698c63bcecabc4
SHA1ecb50a80189568a9b86d21b36eef3bcf48d0e5aa
SHA256200d8b29d57b01f282ac06f17cdb5f24757859d3ddd512e0fa3e88fcb1a9829c
SHA512ee7eefdf77b28d784d18ca4ff4130c0700b619abf33b07a3e5721181b884c8f748844bf3913ca054ba7bb01c8ffb4cb8f128c42b3a9a7842e4adb0f9fc7f2f01
-
Filesize
6KB
MD5ba89f2886b5108cd85541bd608832d86
SHA189b7d00b8dd004e8bc24da6b6c533bc4f30c7dad
SHA2569d57d61d416dde7f41bb3c6536df1a99f9cf6de6eba1b4ecc2bd2eac67990580
SHA5124075fff427ab4bc54c14bf43c84544271fd90a0e367af4f01af799c9adf9650620b4af03ee68993ebd7f7ab1f8fc5f5b42250109df11617d0b5fd48a9e07f916
-
Filesize
6KB
MD525226c682ef3758e124c15ef3574350b
SHA1431384ef45c66737ba2a5e01b041716f9526b807
SHA256f71b61fcb9b63b468143267c9ddea2539bd4e29ce1321541ca8599fb63191ef3
SHA512ce01afde4812ec75d312494055e214565474c85761d105d2dd6f139f2ca9d5c4a7cb0fa75c36d70f50985cf2adbb87b0155fcbec139ccb46d47df0f8e7546314
-
Filesize
11KB
MD503d7b7b92354a9f081740c86b3ebba20
SHA141ef69b263706478acb8d937f0211894a22d5f6d
SHA256b0ebe2fc49cec484e846238712a738034b076268a4537d6072ab5f0c34670131
SHA51244eef148464be22c302537326e507a250463dc16963f2429034b1b0668808c20e34ef0e6135dc1f395c520ee3fb2bb54d00c1e799807e889d35217e5c5c35d2c