Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 00:32
Static task
static1
Behavioral task
behavioral1
Sample
766270b1e1e39e63124ff6771aa0c2e0_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
766270b1e1e39e63124ff6771aa0c2e0_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
766270b1e1e39e63124ff6771aa0c2e0_JaffaCakes118.html
-
Size
121KB
-
MD5
766270b1e1e39e63124ff6771aa0c2e0
-
SHA1
aa92f887473441958aaa4ffdb88d2875a27c6abe
-
SHA256
3910311f0f3aa855b1165f98515e65de2d000b413335eb753d05ae4c3bbec4b5
-
SHA512
e21646c5faa8a27788c43f523494a48c2c14c8436273aa9f098560cd34f3421db66275eb487c8686db75509ce562b8a0af7e7ee48b3393489a13d97dffe6e940
-
SSDEEP
768:6F7LNx7n+R+gHIZvqaXVVFPZzbfPvaTdaTtXpjW7ePeTlY1XlR+e7skz6myarI44:wcYgCnTdWeRTx6mDI4l13AvguZ3T3
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1052 msedge.exe 1052 msedge.exe 1840 msedge.exe 1840 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe 4084 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe 1840 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1840 wrote to memory of 1880 1840 msedge.exe 86 PID 1840 wrote to memory of 1880 1840 msedge.exe 86 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 2776 1840 msedge.exe 87 PID 1840 wrote to memory of 1052 1840 msedge.exe 88 PID 1840 wrote to memory of 1052 1840 msedge.exe 88 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89 PID 1840 wrote to memory of 2284 1840 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\766270b1e1e39e63124ff6771aa0c2e0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e75546f8,0x7ff8e7554708,0x7ff8e75547182⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,807486929095295461,80027082911859188,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:22⤵PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,807486929095295461,80027082911859188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,807486929095295461,80027082911859188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:2284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,807486929095295461,80027082911859188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,807486929095295461,80027082911859188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,807486929095295461,80027082911859188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:12⤵PID:868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,807486929095295461,80027082911859188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,807486929095295461,80027082911859188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:12⤵PID:2112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,807486929095295461,80027082911859188,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4084
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5048
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51f9d180c0bcf71b48e7bc8302f85c28f
SHA1ade94a8e51c446383dc0a45edf5aad5fa20edf3c
SHA256a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc
SHA512282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785
-
Filesize
152B
MD560ead4145eb78b972baf6c6270ae6d72
SHA1e71f4507bea5b518d9ee9fb2d523c5a11adea842
SHA256b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7
SHA5128cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde
-
Filesize
6KB
MD573d4991f3ee804ce053d196983ef7a4a
SHA1ee041efb464ee2d3748c4b68d6e0af8923550305
SHA256e65004d4fc8ccc43f7ff517ccb212c2391998579dfd601acb8fea2b0e9d71619
SHA5122a55b228c472bfbce9b04f7ee5de339e5c991b776177101d75730e9842ddadf1129561f84a1a4754175f96e4a48cff7e2eb5ec1fd6ea821d7f31c69c2989ec09
-
Filesize
5KB
MD5e904da73b2ed93702415d8d6c8dd30c6
SHA13fd10710b1ac73c7392b5825d589c25ae931b3c8
SHA25699927291e389c32c196dddf3b5e4774749caaee54eb825b16c8b4af575700bbe
SHA51293f6001e9f42d99dbc5efaa33ef65595d6e3d408d09235ccb8019725976a8177f181abd902caaaf9dc1365a9c268e9625e91d457e53a98da9b514a65d7340067
-
Filesize
10KB
MD5b8194bbfda66e2b12582ed16ef1d1949
SHA15b09c04284b4db1d93b2a1556487e87288f3965f
SHA2560d1d7579c997656faf01d5646cbb37fa87425c4031ed30d67205bf3966c93a82
SHA5121bbd7d7d177a2fcfd3df7e74a6b72d4188a6bd7c865474c3f9222fc180f31488230e92c2bd21cb0c6554969f9e25cd8e1f5df553f95160b643510a558dc6e055