Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 16:28
Static task
static1
Behavioral task
behavioral1
Sample
39e4b385074e82c9eaeb1e0b976bb9ab_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
39e4b385074e82c9eaeb1e0b976bb9ab_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
39e4b385074e82c9eaeb1e0b976bb9ab_JaffaCakes118.html
-
Size
115KB
-
MD5
39e4b385074e82c9eaeb1e0b976bb9ab
-
SHA1
9161bc3b47c11924e074f6035d6b4210a77c86d1
-
SHA256
02e10d064676cbf55da84672dc733c6758c3a6dc34cef49c967161265625f055
-
SHA512
5f3f67282b9a27336a89ac22bdfeb492a0aadc6c768b21e081f376e6e30ddfb949ddacdaf4e22dbf5c5b7977e890d2809656a4443baa6a7208144f722273bebc
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcqaLHAqcpLXhxxcZQDHDtp:s03QL5x
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4872 msedge.exe 4872 msedge.exe 2624 msedge.exe 2624 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2624 msedge.exe 2624 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe 2624 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2624 wrote to memory of 2856 2624 msedge.exe 83 PID 2624 wrote to memory of 2856 2624 msedge.exe 83 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 1368 2624 msedge.exe 85 PID 2624 wrote to memory of 4872 2624 msedge.exe 86 PID 2624 wrote to memory of 4872 2624 msedge.exe 86 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87 PID 2624 wrote to memory of 2812 2624 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\39e4b385074e82c9eaeb1e0b976bb9ab_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd1f746f8,0x7ffdd1f74708,0x7ffdd1f747182⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:1368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵PID:2812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1416
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD504b60a51907d399f3685e03094b603cb
SHA1228d18888782f4e66ca207c1a073560e0a4cc6e7
SHA25687a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3
SHA5122a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91
-
Filesize
152B
MD59622e603d436ca747f3a4407a6ca952e
SHA1297d9aed5337a8a7290ea436b61458c372b1d497
SHA256ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261
SHA512f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a
-
Filesize
6KB
MD5fa51fee14cca6da1d889e4edab9eb5a5
SHA1ee730487624732190d7c635ad05600a517eb25fb
SHA256833b41b1c3803e926df4df6502e80e8ac768bc026a4c98b11cd2c9d68b3f25c4
SHA5128ea8eb485f2b19b058df8e49abae9777537798029a44a79816bdd7e5e03671a6ab4fb19b57ca4e1bca16808356b82dd68d95e96fe232ee8a6cbab4c2ebb96392
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bacd56e8-39e6-4833-bf97-ef961a9ec5a7.tmp
Filesize6KB
MD52a73c9cc5765c23fdf327db376af2fcd
SHA1e15db3951db0c33e3e115c26a625bae90984e7ac
SHA2568eb9b5ee6f168eceda8b082a26697a8d2fdf2c2f4474c6bc81b4e7880bae3f5a
SHA512751b78924aa44bf4a6ad92a92af4c0093c84beaa24abba50a2b7aa19ff07d035d71216d863f678aa54ae12d4751c1b4335f9d6eda49d0bff8e820727534eaecd
-
Filesize
11KB
MD597771777579d1b6f6cad53855e8a09db
SHA1f42fb55fa5fb3329141b30700a9979a6ee98485a
SHA256842c27395f53e10ba62fb26aaa45f1564c455a877c18a8e4eefed8f058af62b5
SHA512ac099e7fe212f3bc68ec31d51b1a1bb0cfcb833920f8c0776e2b407fb56e1aa5720c3f224750c8be6ccf8d830ca346259362905b21dabd5a3fc5e446086cb979