Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
e0465f12195996b50e3d415919ea9627_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e0465f12195996b50e3d415919ea9627_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
e0465f12195996b50e3d415919ea9627_JaffaCakes118.html
-
Size
139KB
-
MD5
e0465f12195996b50e3d415919ea9627
-
SHA1
780f9010f0fed70c99fc5ea265a98a50426aa9ae
-
SHA256
0baa436402a1b719b96bfabc02c0c06a24461139e28f27ca9ea8302c09c2ebb9
-
SHA512
709909d40169c5acc46e695748a663e7ba663139c7935439974c29735bd9d158fb7385128cc8e31276fab47eefbabe2fa312ada06bb2c0ec43e0dff9ed3f5078
-
SSDEEP
1536:SANwhEOevlUtVyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SAcE+tVyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3876 msedge.exe 3876 msedge.exe 3440 msedge.exe 3440 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3440 msedge.exe 3440 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3440 wrote to memory of 216 3440 msedge.exe 84 PID 3440 wrote to memory of 216 3440 msedge.exe 84 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 1104 3440 msedge.exe 85 PID 3440 wrote to memory of 3876 3440 msedge.exe 86 PID 3440 wrote to memory of 3876 3440 msedge.exe 86 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87 PID 3440 wrote to memory of 3912 3440 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e0465f12195996b50e3d415919ea9627_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9657b46f8,0x7ff9657b4708,0x7ff9657b47182⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,1718665939620452673,11508303492398035130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:22⤵PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,1718665939620452673,11508303492398035130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,1718665939620452673,11508303492398035130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1718665939620452673,11508303492398035130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,1718665939620452673,11508303492398035130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,1718665939620452673,11508303492398035130,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3604
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3604
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
Filesize
6KB
MD51d15333b39e44d83086beec1e19cd190
SHA120685380deef06a2ce36de06ea9e27a77fac6ea1
SHA25616b18ef6f2f2b28c58024ee6775cb8afd5365f56ab77181ba3dacc3a67ca775a
SHA51208851a8865ac0b9bbd8cb83eabdc820dc67ec1c39515b5e2e34e6df7f249556a3fa146ec4135ba616177108092ce28a41f28f7835108489bfb213c51c2bc396d
-
Filesize
5KB
MD5aa8ad24c6f3931cd040b7f3e085dff5b
SHA15cd0ec25d1c364d835efdf40d7545d168e8f6edd
SHA256d8b2638515c35c86cac77fd174c4cd6df20066a940bd9c37321ddac5dbb2e064
SHA51256952df15993f626ea704029f2fdac2081270bb11a7cd11fd1e5180b702f4d8aa34b631f032a6ee37d1370407419259e99e7d1bbdacf89df7c8cc27f7303f1f0
-
Filesize
10KB
MD574f9ed8765c253ee9bdc7033d91a9f0d
SHA117ea955f0c4b1965fa1973b7a2325bcf6fb6b322
SHA256a5b59deab29d95830fde1f58a9ec090b4abe06c3a437a3fa247685c95c823b5f
SHA5129419340fc54c85383555fc579988da0fe605fa0f865b024e5eee6d8d4d37db05a6d0d743ea615a7cffa57c8e8d18b28aa2ac406767979484d9a5f8f247cc039a