Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
74955440d55f51f3a86a16bee6776821_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
74955440d55f51f3a86a16bee6776821_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
74955440d55f51f3a86a16bee6776821_JaffaCakes118.html
-
Size
147KB
-
MD5
74955440d55f51f3a86a16bee6776821
-
SHA1
682fa3dac7249a163d0a9ead645407ec40ad72e9
-
SHA256
551860ad8feebfc2a24a563815ede6341a3121a8deed0e812b2ff1a7873c126f
-
SHA512
5b2de23a18241dab83ba5cb615f5e0b88cc9606548ae5f06e58d40d035601a5de70e463c2ff3c8dc3b08ebad9f09df338f46ec4d6c2b24757fcf02bac90f9a80
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fclNcHAkQLZrfZIhcZa9FVLp:sJ5QLYT
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 640 msedge.exe 640 msedge.exe 5056 msedge.exe 5056 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe 1372 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5056 msedge.exe 5056 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe 5056 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 3436 5056 msedge.exe 84 PID 5056 wrote to memory of 3436 5056 msedge.exe 84 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 2656 5056 msedge.exe 85 PID 5056 wrote to memory of 640 5056 msedge.exe 86 PID 5056 wrote to memory of 640 5056 msedge.exe 86 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87 PID 5056 wrote to memory of 1364 5056 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\74955440d55f51f3a86a16bee6776821_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa52e346f8,0x7ffa52e34708,0x7ffa52e347182⤵PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13873362388033744094,7068126038289362881,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵PID:2656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13873362388033744094,7068126038289362881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13873362388033744094,7068126038289362881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:1364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13873362388033744094,7068126038289362881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13873362388033744094,7068126038289362881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13873362388033744094,7068126038289362881,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3844
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD575c9f57baeefeecd6c184627de951c1e
SHA152e0468e13cbfc9f15fc62cc27ce14367a996cff
SHA256648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
SHA512c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15
-
Filesize
152B
MD510fa19df148444a77ceec60cabd2ce21
SHA1685b599c497668166ede4945d8885d204fd8d70f
SHA256c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
SHA5123518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
-
Filesize
5KB
MD5dadbaf30c30cb5863e1843833c07d68a
SHA114cdeed5d72561b42d0e36c6777240fe6c47b418
SHA2563cc42cc9e34c8e702fb959781f8e94c134ea9eed699e081e92ec17f3b5098571
SHA512f103f801bef8b05ccfe5304b846758d5962ce8bd2a2b2ba3ec591860821bc5f48ee15f7a9b564d60fcdacc954e633080451e33891c26000c1dfc981a0bacc697
-
Filesize
6KB
MD50112dc6bb1fb8c2d4f55978d8aa4bb0b
SHA112cc2a2be944cae0e56d18e246fdd232241fb609
SHA256befc8787a9dcd66337b5d426a582b2b5b0fdf1058fe49ce802f1819b7b23bf64
SHA512821cfdc143cff73d3b6bbca5d5bc591a7507c0cc4c75f192a6c27347a1b4a37ba105bf99c431cd3fb591d3419916730989dda484e6e59bb297691be9ae3b6955
-
Filesize
10KB
MD5416c5ed26f0b6f19c8ac3b6274e4362d
SHA191d01c9e9f237a00a6818361cfddb69b43119f1b
SHA256f9843ffbd500ad0ff73971522c18291e474e7a3aa0f872f6b8b03cab1f37ad22
SHA51240472d86fddf25995f2ddf960ec41312babd218d1eaa2a0cb36cdf3082e511d90afa588ebd4db400e7ba1e2b261e96198bd0b4dbdb45f49dfc312c33b552258a