Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
3189ccaccd3b2520c234aea3991debf4_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3189ccaccd3b2520c234aea3991debf4_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3189ccaccd3b2520c234aea3991debf4_JaffaCakes118.html
-
Size
12KB
-
MD5
3189ccaccd3b2520c234aea3991debf4
-
SHA1
15880f2b92ca16320c35300cf98455bff5643e19
-
SHA256
c134f36092af503fe964d8b23f02fb33806afbb9c2c4fc0c8b7b19fc8f3fad8a
-
SHA512
ee0fbeef993f7a79a21ff908305bada44a35edf3ed399944a674b81a58a37476cdb2a105f9487be7470ae9944afac21919185a2b835c62647a3fed74c7fe2044
-
SSDEEP
192:2V+lIsr0KXyJnVCBN54J8k/w1wvqyX+BX9ZXtnX7XuXUXnXw011AuBuLbdU8d:s+lIcEVcj4j/gcuBtZdnrek3A01AguLZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1604 msedge.exe 1604 msedge.exe 1428 msedge.exe 1428 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe 1688 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe 1428 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1428 wrote to memory of 4112 1428 msedge.exe 81 PID 1428 wrote to memory of 4112 1428 msedge.exe 81 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 3228 1428 msedge.exe 83 PID 1428 wrote to memory of 1604 1428 msedge.exe 84 PID 1428 wrote to memory of 1604 1428 msedge.exe 84 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85 PID 1428 wrote to memory of 2216 1428 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3189ccaccd3b2520c234aea3991debf4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9923746f8,0x7ff992374708,0x7ff9923747182⤵PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11321261359644883807,13850042820445841607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11321261359644883807,13850042820445841607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11321261359644883807,13850042820445841607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11321261359644883807,13850042820445841607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11321261359644883807,13850042820445841607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11321261359644883807,13850042820445841607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:12⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11321261359644883807,13850042820445841607,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2908 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3416
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5f014d3ecc014fe08c6bf4f0a72267c94
SHA19c38001144d3aa5184803c96ecae4da82eb7914a
SHA25611017533f307c77fe2998f525bdac7152adc61706dc45fe673ae8954164ca50b
SHA5120a8f02154d0af2926a79a3c3b8adfc969a1c670c51796f72827858d23ae5dc2fbdf7312a16d5280d509da53f646a749fc162d2b6ce1226c43dda48b757128ec9
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD5afd88120a9b96db835363fa9ba58602e
SHA1e14b6dc89e700042199e50022c061b7e73348f52
SHA256565e07f48baf765b5fb9c466bcbcbdea4d24795f05d429bed7f357e69d6c0c4d
SHA5125eea4b29e713877c65932c1d7162335eccc163a0fb3595e05ddf2bcc12f30d602756eba0b329867c36378a32945735ef6fcb3ac217d6dcf49e1942fefa6b436b
-
Filesize
6KB
MD50ab2636957b5658b05d7bd88a67df907
SHA1fdb8b01c57f71c41b0797c09162fe69baf1aa521
SHA2568907974fa1446cd355ab668b77d0c3541f3cadbc127a1ae6143486ae76eb35e7
SHA51291a3d7b519bf8146d27435ac800c998aeb8381838f288623a9f830a0e6aae6a4cbc4553e6032ead6b6c9786568d0a92d2667ad1cc4603f8bffc0b3190ec765a6
-
Filesize
11KB
MD51855063abdb1c947dfe6878743fb9e79
SHA1b5210a4d5a1bcc270b7dab277a1cc24d20a7d914
SHA2561fc22efeb8a6cff3f4311be40c13a284b1b38b5f22ae5f845cb5292802153f0e
SHA5128ee1db958b76eed43e3f1cd6eeeb28629b7eca7e530d79edb946d1535d919cf1bd374368d42d23bc370791b7dc1c921f3375f692b61b6d10d859396caac8fd32