Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
cecfb98bea011d58bf20290c8dbe95d8_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cecfb98bea011d58bf20290c8dbe95d8_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
cecfb98bea011d58bf20290c8dbe95d8_JaffaCakes118.html
-
Size
120KB
-
MD5
cecfb98bea011d58bf20290c8dbe95d8
-
SHA1
f53fe4e79baa79f83ff2eccbe340085f104c8e5b
-
SHA256
b4176a10db59aeb709b92dae63a193598d968c17291297854aae44895a73f9a3
-
SHA512
e2fc5c64d98ed4da5533cb296d41cf294008d8e8ce08363ec6c83093e21f499495b42fb7f0d798de9f0d807cb25c3a30b9a25721f08311e9a83d52372d84d056
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fcnjqHAIsfLAcaVnzcZf2SEip:sLpiLgzK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1164 msedge.exe 1164 msedge.exe 4556 msedge.exe 4556 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4556 msedge.exe 4556 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe 4556 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4556 wrote to memory of 3080 4556 msedge.exe 83 PID 4556 wrote to memory of 3080 4556 msedge.exe 83 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 4180 4556 msedge.exe 84 PID 4556 wrote to memory of 1164 4556 msedge.exe 85 PID 4556 wrote to memory of 1164 4556 msedge.exe 85 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86 PID 4556 wrote to memory of 3520 4556 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cecfb98bea011d58bf20290c8dbe95d8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb02cf46f8,0x7ffb02cf4708,0x7ffb02cf47182⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13745489381483448615,17196340203694128992,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13745489381483448615,17196340203694128992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13745489381483448615,17196340203694128992,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13745489381483448615,17196340203694128992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13745489381483448615,17196340203694128992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13745489381483448615,17196340203694128992,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1288 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1612
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
6KB
MD50fc0369277e36245d4f9be43492ea9c8
SHA1a3b3a781e7e1a79d15c9f6b8c78c28814cc4b661
SHA256ebc2df763ae358e09edc0240cda7932c57c53cc1e8ac3cdf3c3d87add9b2280d
SHA51247598099bee5788d50c043b0c37b1f7a8fa17c63b548e3eb0021cb7dfb7288600376ec8537ce0081592daf85e8132c9ab2da2d5baed263b79f9a108b1e46e211
-
Filesize
5KB
MD5419e76e0154c1dfd7fb6dfd00347bd2a
SHA17569fd8f4f71f38cb96f3e20d00cbb95eb81f184
SHA2565dd471a28479c20af3ffa3c2808f25275fefbfe996e3a4166dfcfdc0659d9d4c
SHA51271b1d7240514476fd0d442030732f3eb35eee0d9b7b8129868a93f39e79e5fb5624ede4ff4c8cdbac037f1a185217376bdb45973df9b735321aa772a3a4690d7
-
Filesize
10KB
MD517621e52f6b5aa902d197bf9aa03a190
SHA1dbef4f088963246f6d88a24da244708fd9f97e04
SHA25679c4ed2d1a77869f69415e8d0cd976ce56b6bc4d40543f99f0eab39fb41338f3
SHA51250e53063b4c29fac584c7a59166299659332853749975d928a79d1d6a9475dc8b818cf48fbf3493b2f72b997fd88674eb754367034e214691e8694eb187a91e8