Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 16:18
Static task
static1
Behavioral task
behavioral1
Sample
63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html
-
Size
149KB
-
MD5
63e407e33e914480e3bedcacb2a92f1d
-
SHA1
0f51a62bcb78caaac780f81cf7f8d8ebea6be367
-
SHA256
73f6779093b153b3681cd2d2fa01ba6287dc12e7109666ed7da385bb69531294
-
SHA512
7d9bc6bb0ddc68d27c5a5c3f4337696fea0f738188a9ec048ffb6a22c2611347e5eae2d1ed0e78bd628b98bd6dbe968424bbcf28d80e874f81597169e6d7afd7
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcDjuHAAOLL3JpWcZQ7Lr1p:sV98LCd
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4088 msedge.exe 4088 msedge.exe 4836 msedge.exe 4836 msedge.exe 1060 msedge.exe 1060 msedge.exe 1060 msedge.exe 1060 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4836 msedge.exe 4836 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe 4836 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4836 wrote to memory of 3028 4836 msedge.exe 84 PID 4836 wrote to memory of 3028 4836 msedge.exe 84 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 1480 4836 msedge.exe 85 PID 4836 wrote to memory of 4088 4836 msedge.exe 86 PID 4836 wrote to memory of 4088 4836 msedge.exe 86 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87 PID 4836 wrote to memory of 2216 4836 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63e407e33e914480e3bedcacb2a92f1d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff952d746f8,0x7ff952d74708,0x7ff952d747182⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:82⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17398065685344970884,2461641180053240000,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2896 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3052
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
Filesize
5KB
MD5a1441bdb391c4c932943fba0edb35fe1
SHA19c5ec033046776bd04c65d511e0427497d571f0b
SHA256c6f9844f20796fa61fe6684f4e8141fffc31e1c5c9566323e61cedd969402438
SHA51273c703cdceed55f8c77d8776de26b4f4863741e9bfcfae0594a4b03806f47f8a8745af96e5d6c7965256a6da6b2addd375c4b492dbc5c73e102df2d2628ee03c
-
Filesize
6KB
MD5e67fe1efd0002f7513560e21458ad8a7
SHA1166b6c96bc0af04ad86b5ab58e0e23e9d50a66a2
SHA2564ec59b5136e1837808115d994f42b3b1e866c72546283ccb64492aad2bccf564
SHA51252c99fff66c7d9313e0d9bfa349ef48ec46bb9236dbdbddde646d1e869ff34a3045d2eba1145819a2ab97d6a46301f28ee0b9597ff25ea69f0b9aa63fa0e6e81
-
Filesize
11KB
MD5220b5db46f8273f0325fd5a6113b07e8
SHA179c7d5ec6f5a1953bc0c6f5bc7f7ddb9d046874e
SHA2562d0b47abd03610eb56d79c93f0fa0206b5fc1672071392e43a8814b893fcfb0d
SHA512cd1efd96e183efd6ca61a7c7aebd0c0065772d9a7c3ce495aef529fa316f9af3470962033130efac2c84b6405996d20514b2c12fd9c0d44ad991e1db81508407