Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 12:15
Static task
static1
Behavioral task
behavioral1
Sample
c8cc56755b018d241ffe70ed1d56c94f_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c8cc56755b018d241ffe70ed1d56c94f_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c8cc56755b018d241ffe70ed1d56c94f_JaffaCakes118.html
-
Size
87KB
-
MD5
c8cc56755b018d241ffe70ed1d56c94f
-
SHA1
9cbd2a4a93d8519621209becb8b0b9acf57f532e
-
SHA256
17965a12690144eba8627827c3b0592192b0980fe424172f222890c6412086a8
-
SHA512
4d7199cfaf348e903eb7833bfef552c1356acbceeb90aea77da4161f92efe7cf62caecde3d985f6f069f43ad12b11b6f70278e783ad79c96f297dae9f6f64c2f
-
SSDEEP
1536:jcsxjv/XRyGXmNJUzIfPlG5nrJ80U9itenKJPb0WjLERdVGv+:jnxDAGXmNJUzKlG5nrJ80UgtenKJj0W2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5100 msedge.exe 5100 msedge.exe 4588 msedge.exe 4588 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4588 wrote to memory of 3712 4588 msedge.exe 84 PID 4588 wrote to memory of 3712 4588 msedge.exe 84 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 1308 4588 msedge.exe 85 PID 4588 wrote to memory of 5100 4588 msedge.exe 86 PID 4588 wrote to memory of 5100 4588 msedge.exe 86 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87 PID 4588 wrote to memory of 2392 4588 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c8cc56755b018d241ffe70ed1d56c94f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97c7046f8,0x7ff97c704708,0x7ff97c7047182⤵PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:22⤵PID:1308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4784
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD551154abd92ead34f7a305ec40766d891
SHA1011486d7051c19146f1b6b82b41ffc09a5035814
SHA256570e9a3f660eb35852f69c0262a73aeca165edcd6ade4e975a47d98bd6cb93ca
SHA512b22e123598a08d5183c0419720acaf3a73923cc3bfda8894a8b80c573605d2782651877cfcec5cd4525b06f7ee6a4fbee5cc60f6611c3ef8819062768d5326b5
-
Filesize
152B
MD5ab8ce148cb7d44f709fb1c460d03e1b0
SHA144d15744015155f3e74580c93317e12d2cc0f859
SHA256014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
SHA512f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
-
Filesize
152B
MD538f59a47b777f2fc52088e96ffb2baaf
SHA1267224482588b41a96d813f6d9e9d924867062db
SHA25613569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
SHA5124657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5475f379d64cbfc47b0bb7c45099d0a29
SHA1fbf3a1e4eb6d9fff372bfdf6b33d78a97718617d
SHA256e65823971e7088c88358adce9d1ed68a88979b00ea3875b119757130e99df6a4
SHA51282bdf8f7158fc28913ac3d759ea56820f1f27c896a5a30a72ae2ede0853db2ebc000b690bf5c60d56186706935a9a417efa528626a854943137361dbf38f9d84
-
Filesize
1KB
MD5eb5af63eb2ad4fb02d2c5b964f85c652
SHA19cbdc33ddfdd906f8d996d499e40d520e831971e
SHA25695dcba49df070de20f1bc11f94302c1dfc2a73e7cb2971abb851edbbb9e07bbb
SHA5121b64c81fbdb80630ec2d6913e13aac81f7c052c4df8c01b6670114c0217da0a389fb103fecc67a3bc50680bc0bf71a3ab104828bb17040f0de8ebab4dac23b5b
-
Filesize
5KB
MD5e530d491ba73cc97d6f7d7e70613ec2f
SHA1daf03f6657250c3bfc95da604efa7b04ca685365
SHA2563978caa210d73479726a110557bc89ff0563757c9c359ddd40a25c1d00b1632f
SHA512a0e165831d02b3ace1662746630b7ec4398368e1e846e16be72fb4062b52d38be3231a9c36d3dbf961551886421bb057c2e1b0f1582f3ab1742b16ed619ef4f5
-
Filesize
6KB
MD59419e204a66128170faf0ea9b7867ad3
SHA1cd0d4a18801bcfefbd6f6946d576659fb53b71ee
SHA256f4e521853c38333d5d39a74754531e065365c04f9fcea6b329b010533e461b88
SHA51285d67140aca3776af0e76157205199a8b6ef0d0e3b5706ebb7be1ab8be5d256e33d2f2e8c77ed6d474a90b9405235dc9758fcedc68c5694106442da0c2fea7ed