Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 15:36
Static task
static1
Behavioral task
behavioral1
Sample
0e9ab75e1baec0bc2a9f9bffd16ddb12_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0e9ab75e1baec0bc2a9f9bffd16ddb12_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
0e9ab75e1baec0bc2a9f9bffd16ddb12_JaffaCakes118.html
-
Size
155KB
-
MD5
0e9ab75e1baec0bc2a9f9bffd16ddb12
-
SHA1
915ed90d8b3b4786d09ac7f13f4674200d7c05f5
-
SHA256
62e310a772df7bd90f97149f2996cbf0cc5761301dbc7601e8eecf98b837ff7b
-
SHA512
971658b75b977ff896220dbbe8b6407670efebb467e6f268e68ae06cf34a963f7feda11e537f0f0418095bd5becd4fa20ce34d675998d860e7e93b772317f132
-
SSDEEP
3072:XUcjvG8rMdcXmNRSSSOx3wfiyHlXBuFy/dEBjLFbAWd:lrXmNRgFXBTQF
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 928 msedge.exe 928 msedge.exe 4424 msedge.exe 4424 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4424 wrote to memory of 4172 4424 msedge.exe 82 PID 4424 wrote to memory of 4172 4424 msedge.exe 82 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 948 4424 msedge.exe 83 PID 4424 wrote to memory of 928 4424 msedge.exe 84 PID 4424 wrote to memory of 928 4424 msedge.exe 84 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85 PID 4424 wrote to memory of 2992 4424 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e9ab75e1baec0bc2a9f9bffd16ddb12_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb171146f8,0x7ffb17114708,0x7ffb171147182⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:12⤵PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:12⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3720
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4072
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5f14d490c4a189ccf9c8ba803ef835bdb
SHA1696ccf7368f54e72415cdbc00443c5ba004b9c9f
SHA2561bb41d44292e1b9d19108a5de88ed06f7a5b76b9530fa3e52f9c8692cc5b9477
SHA51235ed9003eae16640a25e658dbee5d8bb38640c99fdc920bd406280387d94f5ad70836444d6340de4cb0313d888a1672e3ed841d630aa6318886daae6b1e5557d
-
Filesize
1KB
MD5acc3a935b48bcd4ebe76d23b0a539f6e
SHA14863109b0639d41686ea55ebfde8eb3fe1560768
SHA2567b993733f1b242f6efe5e180b874237a202c2d5b819a69ddc61a3de406f55305
SHA5124a87814c2542e83d5a9fb59a2f766ffa55ce5d74f82c386a342368020f19bbdacfc4ea01b46a18874a4df9e2a3b80f9f586b61455321913aca1d14b1b1c969b3
-
Filesize
5KB
MD570daee24446555588e6fe557d92dfc31
SHA16f8c6de21b4d6197648f455e4b3814915f6208d1
SHA25612e1e48718ea9edda08efae742ea729bdec319b8db343fba4447c6c67993f1c6
SHA51212c5081dbafffc268874dde921bce969aed79c514ea2a0bbe9175cef5b9c266053ffb05ca888cae57a7a209ad9187b4409f5a4c7ab2041699d91175d6faa8735
-
Filesize
6KB
MD5b679793c5180efb337cb3db004664115
SHA12fa8417295802e5baf8422b54c8afe8104f695b3
SHA2560b8d8f36d1d8d3010aebfc9cd43239e0b30a4d36f39207c94c79988198d727f9
SHA512a53419148aaa643f8d47445d080e18b4c86d575d652d3442bb12a1235958d10d51602373d85fe046ed529046b8abc215bd6d988f9a035402f8fe78569932189d
-
Filesize
11KB
MD5eb9a725749b727305a3076da198800e6
SHA15d2ebf9a27352b05441fb89c0709b98fef4eb0e2
SHA256b089437f3868cbdfc39e069abd36ee5092be66dc3b36ef01e05a4d44d1dfe966
SHA512c84069e9e07a1c685e012ad2bad44d2f4c55ffac7ffbe0be87deb73caa5b8e63cb81bb5822751c9435d03d7e5bccee2e81905bd66288d918da88321113ce6f32