Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2024, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
c798e0179a1b626135e620d85655a8ef_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c798e0179a1b626135e620d85655a8ef_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c798e0179a1b626135e620d85655a8ef_JaffaCakes118.html
-
Size
19KB
-
MD5
c798e0179a1b626135e620d85655a8ef
-
SHA1
8952256acc347a324ba35303c39e71dd8328430d
-
SHA256
c75f7ee314005dc7ed4866f7434209e1a8c82cecab063b8556270b1644cf3f47
-
SHA512
2250c1f24fe5ed6838b9a48b57ecdd51c9b42e5cd24220df393a735f8852722c36648f0bee0fa94dc98f8ed398c1d91fae30a91ad35c57775853aa325aad8106
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIv4pzUnjBhDF82qDB8:SIMd0I5nO9H9svDexDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3480 msedge.exe 3480 msedge.exe 3412 msedge.exe 3412 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3412 msedge.exe 3412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe 3412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 2128 3412 msedge.exe 84 PID 3412 wrote to memory of 2128 3412 msedge.exe 84 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 4116 3412 msedge.exe 85 PID 3412 wrote to memory of 3480 3412 msedge.exe 86 PID 3412 wrote to memory of 3480 3412 msedge.exe 86 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87 PID 3412 wrote to memory of 1808 3412 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c798e0179a1b626135e620d85655a8ef_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb757a46f8,0x7ffb757a4708,0x7ffb757a47182⤵PID:2128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13281598239809020886,14119388070115120853,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13281598239809020886,14119388070115120853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13281598239809020886,14119388070115120853,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:1808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13281598239809020886,14119388070115120853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13281598239809020886,14119388070115120853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13281598239809020886,14119388070115120853,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3640
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3292
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
5KB
MD55df472cf2156c1f9a4321edb7e5333fb
SHA1344435a119c9582478c18210bc0a4c70d82f67a0
SHA256a25bca6e320909fd1a676131edd36c5bb3792456b5f785d8dae4e74bc0c7c147
SHA5126f74ffa220a50c47f568c3c7cfe9eef1ba906f6c7298f658524bbc735079a9b0b7646a15fa950a15f34c72c24b035779653a849d047b96f3f517f8c2ad4f32aa
-
Filesize
6KB
MD5cabff1e0bf1099fea1b976a35123fbaa
SHA13874a5eec6bdefadc45be6170cd430721d90d0e9
SHA25649e00a667643f54bf0d797aa6202eeff5d19671662dd300db55a3916099935d6
SHA5121da640bcfadcdfa01b15fd2d77a274cbea0f5aede31273698095629b417bfefce1758ea777d50dda8b38a36db56a5d3a952f639e56fe50fe063fb8c5436e94b9
-
Filesize
6KB
MD599d01ffcf3338db5bc815d178fc776c6
SHA1e623130be9233b9e0667668d2dc92cb556dcca22
SHA2565fde10355f67aeb6bafdef4fb9c9119935dcdca1846c76f8fc95d1f5abd1b29b
SHA5123981f93a2574cfe52ecbb9396d7db673b754c841c9952980c4d1fa2f0b7f7cbf501257ed1210427ce113588b6174a740e757401a5e6cc36c48881aebf149bf46
-
Filesize
10KB
MD51fa003c4f7e31eab83d9c858f72e1d4b
SHA17452de052350b9867dfc3beb5870cd618e09d7e5
SHA25666b6065661fe545b94b71d6596cacbeffa8e3304bf49fafbd3b82e003f5b6b68
SHA5129a330b08cec505fca24548d155b642e9562aac3362752abed52c16cd31b53972324ac81d20b9a42c908dc88c4c4a15861b82d631f54921bc6468cdb9054a1496