Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
e062594036a6f9e586be5f8e37c1bfdc_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e062594036a6f9e586be5f8e37c1bfdc_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
e062594036a6f9e586be5f8e37c1bfdc_JaffaCakes118.html
-
Size
57KB
-
MD5
e062594036a6f9e586be5f8e37c1bfdc
-
SHA1
4064be43d0ca74f2f8d79af68444d5b5f45b043a
-
SHA256
53ce115e45a2bb5c9446254f65b96b3d177ace6339c2dc2f76bcc0f94f2f2478
-
SHA512
3c32e2e4d498db018b216eda509aa00034f8adcc5c23cfefce80aab7ea2e7fabb3695b18495891a58dba1c4c877597406542b6c0e8896fcc1a569d654cb57947
-
SSDEEP
768:KedU9z4ys47kM9qw0rlv55YF4ISY4yoPPF6gLm0Qp:K4gS6h4ycaj
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4000 msedge.exe 4000 msedge.exe 1604 msedge.exe 1604 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4000 wrote to memory of 2072 4000 msedge.exe 84 PID 4000 wrote to memory of 2072 4000 msedge.exe 84 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 2160 4000 msedge.exe 85 PID 4000 wrote to memory of 1604 4000 msedge.exe 86 PID 4000 wrote to memory of 1604 4000 msedge.exe 86 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87 PID 4000 wrote to memory of 2696 4000 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e062594036a6f9e586be5f8e37c1bfdc_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83db846f8,0x7ff83db84708,0x7ff83db847182⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,1580412995958344885,10474219049199453313,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,1580412995958344885,10474219049199453313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,1580412995958344885,10474219049199453313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:2696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1580412995958344885,10474219049199453313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1580412995958344885,10474219049199453313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1580412995958344885,10474219049199453313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:12⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1580412995958344885,10474219049199453313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:12⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1580412995958344885,10474219049199453313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,1580412995958344885,10474219049199453313,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1888 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3848
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3568
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
5KB
MD5739cbff264b6a4469dc1af0c471b137f
SHA1d18dd656587a8351a7fba099cea1f21098440947
SHA256d1267e0d551ea66485185639674fb48f1625c9f14a70ed9f1f31774bc230dfee
SHA5128e9fc3902970404410a53b963f8c30c508c6b3eefb4b61864168f0426ee08ff7939b3fbfea6b5e08dfb9326724caf42616340d35a5f734b2e700bd63363d0198
-
Filesize
6KB
MD59bb25277f5f39cc692bf3d785410f0b0
SHA10cab983c9faf20ba4debdbf2b8764644368a9c10
SHA256f0bba3bc162a5bddd80f72d586bf0b8cc896566922f2a58d34d0a3789f00ba25
SHA5128d69549afc888fd2f1ec34c01deed17cccc4150902cb95f6db64339f7a42409dc3d38f21b8d1b496fc0b18ec1270862f483430a98841246a28eef2c8ea2ac2f8
-
Filesize
10KB
MD537730d8eaf1e69005d171be8b7fcbf3b
SHA1a15761a345c99fd4b3df2cf0ebc930d189e9255b
SHA256a88546b83478fbb99c2b4634e3191c1214db4d97cea9a3ff5f67df7e4ec5dd17
SHA512f48170d3e7953e6bccf8bd353db7f2ae69469cf30a4f17f98b83666cc0205777b76b3eaa9de54afa7d15d26775ded19e596c258bbcc0a4200b3d81143887965c