Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
149f354af47e620ff92fce8f70a4e2d2_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
149f354af47e620ff92fce8f70a4e2d2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
149f354af47e620ff92fce8f70a4e2d2_JaffaCakes118.html
-
Size
19KB
-
MD5
149f354af47e620ff92fce8f70a4e2d2
-
SHA1
a0ca37966cf90467050f53c5e9cd96ac604c8a70
-
SHA256
5aac23352bca61132ebf34bb070adf9ce5eb548a20df78afe297a8e4708099b9
-
SHA512
c85e64cfa9666da1668a94c08b5a7399e22f2d434bdc032517675431bae70c57175873c33a7c8cfb27cdd80db20b9d182b4551c94d0263022f067d8126627336
-
SSDEEP
384:HY7u6lKvo0lAtsdg6KrIaYj/aITHoZllFca+iYI8L:3lMtkSvuL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3956 msedge.exe 3956 msedge.exe 2884 msedge.exe 2884 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 3824 2884 msedge.exe 81 PID 2884 wrote to memory of 3824 2884 msedge.exe 81 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3368 2884 msedge.exe 82 PID 2884 wrote to memory of 3956 2884 msedge.exe 83 PID 2884 wrote to memory of 3956 2884 msedge.exe 83 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84 PID 2884 wrote to memory of 4624 2884 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\149f354af47e620ff92fce8f70a4e2d2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a47946f8,0x7ff8a4794708,0x7ff8a47947182⤵PID:3824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:22⤵PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:82⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:12⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:12⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5372 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:412
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3288
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5dcd5aa3db08753a96b4b4b3b8aa2dfa1
SHA1bcce3d76a3cb46d9a54486536b00cb32897174ed
SHA25651f6e9b7ccfdd12d44adddc3cec83d474de979006783fa3acf35026b9e5861d5
SHA512dce05c1601a219f7e46242826a239997d9d3d0c742ef10dc46c9c4da05a2fe2f4a5b2fcb5933f5840ccf067b82f6ad8c387a0e84b4e1a88b00595a4b4a419fba
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
408B
MD57c86a817a3e54854596f78da9cfae40b
SHA125f4739037993a67b46a53e7ba7b1ae4b37f57c7
SHA2567200d3235d085b23368834b50e326008f6b2321d2810d702ed6406b1242f605f
SHA51209429ae2d10a18acb1956f7d060c5c846ddced4456c66ad2fc915fd70672d56cc1e78f07d0420d5daa3e9f21c9dc0d9cbadc33b188bfa703598b73d877deeeca
-
Filesize
5KB
MD554be9ff266e9973625d1d282f737f904
SHA1b5ede55a7c9fd7381ba6242c09fd3254eb0d4a64
SHA2569b5a31bc96ef9c1336e904c196a4f8914c9430b26413cc704910a67fdf0d7b22
SHA5123536ae53c72175d841354849b1944283733f0b24d6ce3c801c94163b8f1d3ae05af7a1dd03353a2195c4586b2e23839c67394ddb0f775a5da121a5da4f08b786
-
Filesize
6KB
MD5fb4945e622c0c452b9c99a38ec43acdc
SHA1997f6bef1d7753712beec783480db19a7bd85110
SHA2560030647bc481c0f597f60aa55bcc38a5244e1b0f6f421851bd547aa254ac4901
SHA51209281984babc289d0ab0d8e9c5500d25090be6402dfc26247d382a47ff42f9a4d1eed719ab5002c02cb55f0571c37ff897ef6b00849ffe834b1e446f00110db1
-
Filesize
10KB
MD52a3f257691b92e2c565adf6da1bdbdad
SHA1028129d6121b0d844a1132c68668e608fc3aa9c3
SHA256cdc57a1730200acf3a2752f4343e30d0c0675dce6fb09338f8ffce7398b18d1a
SHA5126945e74a844b7b791afa0e7652873b5a5020bbb380feeae9c3d99f53cc02c9b628f2e78063856e689c31742b5d0fe2e97a2045d4304de556e6f84f9cb58c6ac5