Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 01:44
Static task
static1
Behavioral task
behavioral1
Sample
32d57748a33c9b91805849dac7052873_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
32d57748a33c9b91805849dac7052873_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
32d57748a33c9b91805849dac7052873_JaffaCakes118.html
-
Size
58KB
-
MD5
32d57748a33c9b91805849dac7052873
-
SHA1
9e6030af114d289a87d48e10a6baeda7ad9c6ba7
-
SHA256
8793c0d975e67ba357b2243345baba61c983ed0f7f6f7d3dcdd66a472cfa47f2
-
SHA512
ef0774a4836748618e9dd25cde7a49377686335e5a75de2cfd0e29295e5c4da2992a87310d48b7e048a23f96572547503599f0f467df249e99f895d6275f54ed
-
SSDEEP
1536:sXtW/PbhxoVDa5gLj5a3gVk/AE/VEdVsoVgtv9VPZVMV0tMVLgpRkV13+Vk+jNjD:MQQa56j5aJAvKpp
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2868 msedge.exe 2868 msedge.exe 4112 msedge.exe 4112 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4112 msedge.exe 4112 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe 4112 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4112 wrote to memory of 2776 4112 msedge.exe 81 PID 4112 wrote to memory of 2776 4112 msedge.exe 81 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2692 4112 msedge.exe 83 PID 4112 wrote to memory of 2868 4112 msedge.exe 84 PID 4112 wrote to memory of 2868 4112 msedge.exe 84 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85 PID 4112 wrote to memory of 3616 4112 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\32d57748a33c9b91805849dac7052873_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9923746f8,0x7ff992374708,0x7ff9923747182⤵PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:2692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:216
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5084
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
Filesize
6KB
MD55896c12008f6942521f4b5fde1865b6d
SHA106f28d6a1368dabcde566ef361986ac867143bcb
SHA256480b16cd09db094890809715c3ccc8d296d98615308b69e2d59d5a64df31c1ae
SHA5129e2f3d2d1daa0e004bd313d79a4194293d91f8cf674fd39edb79d6735f64d6e2196c27eb6ac749e6921a94b04f6a8e75685d42ae99fc3a13353b23b61e2f7977
-
Filesize
6KB
MD5c9ab9869f6bacb6b5236d26028880255
SHA136e478752395ee61756f7650423bde81366f8e16
SHA256c9bb00eef0da9fbf9a597b02c0136de0d29752e8b0c6e2232d8b01771802a20a
SHA512d805b46bc0297b47c965a43275ec37b7403287ca2e1ea4f02247506d2ebb49fcd23ac4c5a9cd3abb139a817fd3e6e15fbd499070f591c6615269d41673abedc8
-
Filesize
6KB
MD5df752de5f023e21a775642361f13c3ff
SHA13e928b27ca516af679d64ab7306ed7ef1c79f71f
SHA25698da40fa22aba46be6d594d2af6ea7d69da38ec251c1da75bfeaa676b5838a30
SHA512e476eb1c53f055a220ae6dba016cc2927ef7b4d7b7b2eb7d6660beec1a548bde3bd149a7e21489fdafc8b5359cb1011b723115078e799c80486772e69b4b2dd8
-
Filesize
11KB
MD503cff6d81460244417be7c315598a9df
SHA19f5ecdf73af989e49c3ab2962d2a0cdd3bb4790d
SHA256602981d571b81741a67312744bb7a91a72979d63cbd30aee61f7e312d076224b
SHA5126e3cf5044a1a33d1536b9997d7b29f2ec644b2c2eada8fdd266c298ccb01ad1db0b1686785d2e2f576d83ba7fcd37bbe6eae3a8c8532de7233e6ae868cccaee4