Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 20:03
Static task
static1
Behavioral task
behavioral1
Sample
e0ef950e90cf488ac69c09448cbb5614_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e0ef950e90cf488ac69c09448cbb5614_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
e0ef950e90cf488ac69c09448cbb5614_JaffaCakes118.html
-
Size
20KB
-
MD5
e0ef950e90cf488ac69c09448cbb5614
-
SHA1
3166e8481fe70b24c38b4df86bcd7a3011b91455
-
SHA256
9ef4c5d1086c15accf0d3f982b980081fbf7e514eb69ff8d4c60026b6e6b5145
-
SHA512
d59cca07386fcbb818f7844f49fbcc7d4014375da7ba9586e6490a2d5b7f0cc39fe1b9b97e71d75393897d6f4458c3a2f01cd4fdac580a7910b968d595890f13
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIkoEHEmEtTwg2oEHEmEtTwgioEHEmEtTwgmQ:SIMd0I5nO9H9svrWxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3264 msedge.exe 3264 msedge.exe 5008 msedge.exe 5008 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5008 msedge.exe 5008 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5008 wrote to memory of 2984 5008 msedge.exe 83 PID 5008 wrote to memory of 2984 5008 msedge.exe 83 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 552 5008 msedge.exe 84 PID 5008 wrote to memory of 3264 5008 msedge.exe 85 PID 5008 wrote to memory of 3264 5008 msedge.exe 85 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86 PID 5008 wrote to memory of 1476 5008 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e0ef950e90cf488ac69c09448cbb5614_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8964d46f8,0x7ff8964d4708,0x7ff8964d47182⤵PID:2984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14128478004386434731,6669116580371855303,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,14128478004386434731,6669116580371855303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,14128478004386434731,6669116580371855303,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14128478004386434731,6669116580371855303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14128478004386434731,6669116580371855303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14128478004386434731,6669116580371855303,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5076
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4336
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
5KB
MD5bf61f73255947eec561ae099ce5c29d2
SHA1764eb2a70e3546fa31114b49855fce680cca7aa1
SHA25639f77f323a62f579fff2df9ce8548220339f4a98a9e72097a28dc1576a2e6b79
SHA51203559d8b6e0e52b55fb10b4fdf457032ed7b50fc3f0e543f84b0b06a566c50e848585c5dfc41331e4af7e18a30ddf603781cc3ef28d3d779fe1e00af34f2a42a
-
Filesize
6KB
MD540e645a78abbe85a1d41380649eb48d8
SHA1224d5e55c5ad3fd62314b089bb83bc5acc4665d2
SHA256dc0530903c837ff6efbfa7dbb6f4acb7081872b0ffc204fc989164ab03514f64
SHA512aada02d90f92f8bced8ce4c1b00507353d1dde0417f6b8ae935b3963030f193b0b819057b0fa2b8378fba9da59ebc8773c20bdbd9bf859ff999d0f9335e12377
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdf8e550-a365-45a2-a3ce-296e43d44d29.tmp
Filesize6KB
MD5516fe6dd0a58420a3681f36042ba69be
SHA1f490fbc212b7d95a93ba38ece30f68a87f0b3441
SHA2560f49afa58c6ff418514d37f5e4c2822d656f5f8d5828e944e894dbe7e46d8626
SHA5121bac83132580a95b323bb06395c8f22105f57aab09fc7ebfe21f4740df9639c9e689afd70e0d4c6327aa2afd42aa9a5b42156d48aafade5e970d99afb80e34dd
-
Filesize
10KB
MD53274c3ec3acf479abaea76e5a277d08b
SHA13417a5d0ef25c6fcfab9d659cf35f63c51627b1e
SHA25652ca29c31ef0b4c3635f278fa994f9c0533cb64b582fc1ed6c00e06845d79c18
SHA51278882ea67c62c8fb09e594fa6e23f6f74188a58959568dfad044bb9624c3331c74582b811fcc1762f73cf31faca5fd6b46b249ebb4af9e98dc31355cc0200d24