Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 14:55
Static task
static1
Behavioral task
behavioral1
Sample
e06c68cfd478ab312a4624f2bd08d634_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e06c68cfd478ab312a4624f2bd08d634_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
e06c68cfd478ab312a4624f2bd08d634_JaffaCakes118.html
-
Size
158KB
-
MD5
e06c68cfd478ab312a4624f2bd08d634
-
SHA1
97f78d13e17e6e4e616f1726c6fc7bb580650c32
-
SHA256
ebf37d60787582a3be85c9e00aa3adffaa3de3212f36f6ad18fb24205bbf1fcd
-
SHA512
d74f2e4932b3398557398fb4fe51de1ae55eb19af00d583a50885ce4574e05a22589b610de01183acfb9995a175353f00f948a0cc62c4eb283d85784a37f6c5e
-
SSDEEP
3072:SnguLWKgR4+QyfkMY+BES09JXAnyrZalI+YQ:SnguCKgpNsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3820 msedge.exe 3820 msedge.exe 1856 msedge.exe 1856 msedge.exe 4656 msedge.exe 4656 msedge.exe 4656 msedge.exe 4656 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1856 msedge.exe 1856 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1856 wrote to memory of 3636 1856 msedge.exe 83 PID 1856 wrote to memory of 3636 1856 msedge.exe 83 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 2012 1856 msedge.exe 84 PID 1856 wrote to memory of 3820 1856 msedge.exe 85 PID 1856 wrote to memory of 3820 1856 msedge.exe 85 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86 PID 1856 wrote to memory of 2896 1856 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e06c68cfd478ab312a4624f2bd08d634_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1c1646f8,0x7ffe1c164708,0x7ffe1c1647182⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2123099544856570559,9905390827416462940,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2123099544856570559,9905390827416462940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,2123099544856570559,9905390827416462940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:2896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2123099544856570559,9905390827416462940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2123099544856570559,9905390827416462940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2123099544856570559,9905390827416462940,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4656
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2084
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
6KB
MD558cd310e6e76a3c2f4507af4e2298d30
SHA17bbcfd32bc48b6584d1d5dcd28116eb13cb2b997
SHA2560cb9d20d64e91bdbf069862d0fa3970674eaeda93e93b918e9545b7e5b17c2d8
SHA51258751fa7a8bc11ccda1a6dcf6d69172bf72170ad549875721c92c51bf75572424a520c9ba7840a9cc20e25e506df7e67e2e288b0f1f17d8e1e3cb594458503b3
-
Filesize
5KB
MD55c7c67f613154826940811fac6f8ac1a
SHA1b0a99a9d84fca06aadc389f8dd63a534b6a01cb4
SHA256fbba3d3bc754b4eb5665f660c472c250dad02bb5c4c211353f044536af7eb036
SHA512e016846d31a3e34cd371bcdfa9135ceac70e55ccb2984db3409b06399b7510ecfb0aba8418ca324d086a3dfe17c85a529bad508c9972023c942514d4da71a968
-
Filesize
10KB
MD5d40c8d76421e11de77576d2d7585a4fb
SHA1b3619322ef2fc9adbd305cd893ef48e99871490b
SHA25671c79b338d457bec49d48397cc76713326b26bd1248343994590f599a2729a13
SHA512a41d11c6ebfc098caa0105bf3101ad4337334ad8dfbc88ad449558a00f8111084295c3ec2f3bd05afdd5242c86308058c595644f1537de45cb614c2bbf1478d4