Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 06:39
Static task
static1
Behavioral task
behavioral1
Sample
eac6a3ad80c29fb8666a5bd9b6e7588d_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eac6a3ad80c29fb8666a5bd9b6e7588d_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
eac6a3ad80c29fb8666a5bd9b6e7588d_JaffaCakes118.html
-
Size
63KB
-
MD5
eac6a3ad80c29fb8666a5bd9b6e7588d
-
SHA1
839ba54b8371fd050faf3265321520ff3c34aa48
-
SHA256
54db795fdbeb0d6c5834db0a032fe659c46684c622273817152fb52eeca1472d
-
SHA512
11f086b28ff8c7abbe0ab660c012ddd45d84dc6b90a6bbb8e769aee2a6fb4c9a6082bfe84837266c6bb22fc390deb1209115ca65568db758ce7016fc5a14655d
-
SSDEEP
1536:Sd2aYT//yQzNm9F18Hj9QzNm9F18HVAvB4U1XTK/uj7S500wU3Eac9GG6/XwIC0M:Sd2aYT//yQ4A9Q43sFttZuIC0C0icln4
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2364 msedge.exe 2364 msedge.exe 1852 msedge.exe 1852 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe 1852 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2232 1852 msedge.exe 82 PID 1852 wrote to memory of 2232 1852 msedge.exe 82 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 3580 1852 msedge.exe 83 PID 1852 wrote to memory of 2364 1852 msedge.exe 84 PID 1852 wrote to memory of 2364 1852 msedge.exe 84 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85 PID 1852 wrote to memory of 3156 1852 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac6a3ad80c29fb8666a5bd9b6e7588d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c68146f8,0x7ff9c6814708,0x7ff9c68147182⤵PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:1908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:12⤵PID:2156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4936
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
Filesize
771B
MD535afe827cda194cfb09dfcd973139eb8
SHA1a0cbb94d4fa4de981e636b39b969cc9e065a46a6
SHA2569219c26eb33dc9c2469618e3575fa83ac4132b4138f14ef4b4e6d4db9128e6db
SHA512ef52ab62c611719b38c31591bd9e028445cb111fd6fc70e8defa3559935177f2eb4522e32af174bb420601e415cb23d79333ae04322d3809186d53ae97d9debb
-
Filesize
5KB
MD56d2c3b08b46853bdaa1162fe8a7305fd
SHA1e4589193b9ee6e9bbaeb58982b9fed06f481b8d0
SHA25619bde3f02213808ba51a5b06f737e0c5024bd6f06c69e900e953aa2fcc035284
SHA51283498ccf2f0015756cf10d44e25d32392a9f49099ac63b83596186ef38816907a634052efaf36ae1c8b1808e93e9af931fe8078c84f1b8025e36d8e02549e424
-
Filesize
6KB
MD56a42f6fc7432fad8e66899ec2895950b
SHA15a4ff488a1a2b3242adf5c8bb0c5bb4213856ec6
SHA2560429896668d06f34b9c2d0f0af86ac8c42f667da5bcaab98a3802245a3a23aa7
SHA512f65cc7282cbfee011ff3dc9bc824be2abc0c15a4e1c2410b13a3b85a5746378a324fdf4d913c8e211e02e6328fe21e11e6e0f7f0038875d87af6bd9920a2ec3f
-
Filesize
10KB
MD58f62cf0dbd753db5256e71b2e03e0a22
SHA15e16e406a96e6c223a95070f0e8548089b8ab10e
SHA25631982efba19564bb2a082e99d4945119c7edfbb1d3527cf2f7a2d8a24621928c
SHA512dfb40a568b20234ca459c9dedfbe0da16ff2de2771e2639c5f3d19ec42588ea157a7e2b7b3e6655aea14069aa031b51ff79a011b453abc9a2362a524433b99d3