Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2024, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
6ada2fe55bb5e6bd21985a583d43512e_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6ada2fe55bb5e6bd21985a583d43512e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6ada2fe55bb5e6bd21985a583d43512e_JaffaCakes118.html
-
Size
81KB
-
MD5
6ada2fe55bb5e6bd21985a583d43512e
-
SHA1
748bb8c4cb1541c6bfa8043706bd1144b0f38bf5
-
SHA256
4303df4a9b9cb8ccc124bacba10fb3d5e0a851a792054ddec80e719294cd3671
-
SHA512
804dfe88047041597c28a251f53943b6a6070a097e1ba55029298b0cad80795df0dccde7368f2f154cdee22fbfed0d70faaab00ca762833d125567ae05df92f6
-
SSDEEP
1536:tUVGUEnu1CB4yE52+obhScrSoCHDBPDe9SPilYFp9sPNiemEoD8YZG9zE/LxaVw:0D1552+mrSPilYFp9sPNBW8YZG9zE/9N
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5000 msedge.exe 5000 msedge.exe 4176 msedge.exe 4176 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4176 msedge.exe 4176 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe 4176 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4176 wrote to memory of 2728 4176 msedge.exe 86 PID 4176 wrote to memory of 2728 4176 msedge.exe 86 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 1848 4176 msedge.exe 87 PID 4176 wrote to memory of 5000 4176 msedge.exe 88 PID 4176 wrote to memory of 5000 4176 msedge.exe 88 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89 PID 4176 wrote to memory of 3332 4176 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6ada2fe55bb5e6bd21985a583d43512e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff820a46f8,0x7fff820a4708,0x7fff820a47182⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,17756609194493130066,6579929454359930395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵PID:1848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,17756609194493130066,6579929454359930395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,17756609194493130066,6579929454359930395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17756609194493130066,6579929454359930395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17756609194493130066,6579929454359930395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,17756609194493130066,6579929454359930395,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4360
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51f9d180c0bcf71b48e7bc8302f85c28f
SHA1ade94a8e51c446383dc0a45edf5aad5fa20edf3c
SHA256a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc
SHA512282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785
-
Filesize
152B
MD560ead4145eb78b972baf6c6270ae6d72
SHA1e71f4507bea5b518d9ee9fb2d523c5a11adea842
SHA256b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7
SHA5128cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde
-
Filesize
1KB
MD562e6310fe5dacf5f8733b48e47e74165
SHA117c98a8d8fa4de84e7762a2a71f00e92a8a86937
SHA25642f7b65b192f2450828ec288929cc32792b683360103a008ee12c1c4b34a3354
SHA51245b8729c4d4e016491deed539ff65bc4bf3f9371785e7f415a7a5066701f3fd3e1df5c4220dd32d02241f492106feea6c1bf4f45fa3cf64f0a2bee86ea371000
-
Filesize
6KB
MD5bc74b151d9e79f5dee12395531b37602
SHA16102f326722bd26017b15668b062840d815497e1
SHA256342a0a7b22065875febcdd15ed192d214bdc4b067ed7869098627eeac6ee2a9c
SHA5129161ce83fc52efab44c4acbd7f2fd13f559b6cbd7873c04e267ce5dc9686c157dbb32164a577da12cdf05b8ffd7420b58beed4b09b42cf8d324c610f496467ed
-
Filesize
5KB
MD50d44749f3a4e4d25cbf86350fa4d06f5
SHA1ba5320c1b34156169d74d57bf2ef53aa1c18d50b
SHA256d08e191eb0998deef811c72f6712fe7e34ed97bedff8b8179b88f143293af570
SHA5121809887a846e3e0e861b9654d12ac31cc3f6c482fd8348534a5da0691ba573099b16a16fed5eff606c6a3c792e9c22dcc24d45f99e6ebc01edfba2958cc4808f
-
Filesize
10KB
MD58a6c8283e499b52c127bc1c6da8ea711
SHA17b79f4bcfe95f08c3a03376817ecfab04df67abc
SHA25628bb56a4d02cef06f4a3d903d4154dcb3d9ff5ef00200781611545d59911d5af
SHA51205424db1985b7cfa8fcdf60304e105cae6ac8491b507d4b019746790da9869d5c56c7eead3d3dc04306b38b002bf2ce34a68c39c57d4060769d22ee867322c33