Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 06:45
Static task
static1
Behavioral task
behavioral1
Sample
eac91796b80702b2d973928bb5b57256_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eac91796b80702b2d973928bb5b57256_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
eac91796b80702b2d973928bb5b57256_JaffaCakes118.html
-
Size
218KB
-
MD5
eac91796b80702b2d973928bb5b57256
-
SHA1
a6e128a6c1474e59e4da8eb5b8f12deec2c5f418
-
SHA256
3523c1d713435c12adc07d00905baea63ac28f5256b7b093f5cdcfa50fb7eb9f
-
SHA512
6420b5a4b41e9b0fc7745105add73a45306e929367c5d364bde6bd05bfa5d082b15d155dab79f6b845a353eeb7adb914b0fe87385f532a311abb8d1291aa45f0
-
SSDEEP
3072:SzjK7nPvaK2y6CyfkMY+BES09JXAnyrZalI+YQ:Sy7nBZ6HsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1388 msedge.exe 1388 msedge.exe 684 msedge.exe 684 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 684 msedge.exe 684 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 684 wrote to memory of 1712 684 msedge.exe 82 PID 684 wrote to memory of 1712 684 msedge.exe 82 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1020 684 msedge.exe 83 PID 684 wrote to memory of 1388 684 msedge.exe 84 PID 684 wrote to memory of 1388 684 msedge.exe 84 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85 PID 684 wrote to memory of 3320 684 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac91796b80702b2d973928bb5b57256_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe318f46f8,0x7ffe318f4708,0x7ffe318f47182⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6602786908087573634,35785961663281133,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6602786908087573634,35785961663281133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6602786908087573634,35785961663281133,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:3320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6602786908087573634,35785961663281133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6602786908087573634,35785961663281133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6602786908087573634,35785961663281133,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4124
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2812
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
5KB
MD5bb95f6dc08820066cf0fd74836fdd6bb
SHA1424df10f1b7e294fcbe9e97fd2e8c4e7a3be259a
SHA256acdda4b754b2bdbd7e9421604bc8af266ba93858e0ce0a23dc2be0db1d1eaa44
SHA512300cb09f995496117a3bf0d8c487463140e2c1aa49d6769b084bcbadfb40ac235c829d8a6a9fc88b5278e12c55834f8a8d9db13b2e3eaaf95e35bb96d7c09cf3
-
Filesize
6KB
MD5e6b83bf2c1e2065dfc71e2e5e6b55dc9
SHA1a0cac9f96774daea37b8214951038ffd47270529
SHA256e9be84972b07f174e7f489648f8f1f7303bedcacf9cf310024882d087f39d1f6
SHA512d8250b258693dc9f3643ea220361448cbb8ced3561614a20a7095fb12709f52527df311caac6b90123f90f8d13d11f6e07baddfae59b8322fc0bbb310e2dfc14
-
Filesize
10KB
MD5dc847f010cd0459f9a45c7f035b4414d
SHA173319b69693bf59a0268fd46733d1e1e309e19c2
SHA256602313dae842f901ead13c696975ab80e465f9d6cbebd5c238412e7aeb0e3ac0
SHA51295a3b2ad8d1bd0bdf8cf3adcbf31fe0f34425d9e43e8bf5ec4da7135c7cbba40c1aba7f803c5e6be4d9726703bbf68723732f8aa2bcb243e4a17bcec7f937051