Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 17:51
Static task
static1
Behavioral task
behavioral1
Sample
ebe1532b34b9a35ab4327e110aea445b_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ebe1532b34b9a35ab4327e110aea445b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ebe1532b34b9a35ab4327e110aea445b_JaffaCakes118.html
-
Size
221KB
-
MD5
ebe1532b34b9a35ab4327e110aea445b
-
SHA1
97072cc88a9fb33c0fbcdce4470af2b024529d2f
-
SHA256
e4c74d207f962340ade7f387ab89b56a3cb04395a16751fc3f37df4ef6d7914c
-
SHA512
dbe1ca0d01d884b79199e20a6abadc49d022527231663357d0aa619aa121dc476965c07fdabd0952c44b0f9b1ace343a6d26df69558f893483166d926b7edfa7
-
SSDEEP
3072:SjDXT3yCQLP6lKKyfkMY+BES09JXAnyrZalI+YQ:SjPNQsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2740 msedge.exe 2740 msedge.exe 3452 msedge.exe 3452 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe 1044 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3452 msedge.exe 3452 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe 3452 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 4660 3452 msedge.exe 82 PID 3452 wrote to memory of 4660 3452 msedge.exe 82 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 3248 3452 msedge.exe 83 PID 3452 wrote to memory of 2740 3452 msedge.exe 84 PID 3452 wrote to memory of 2740 3452 msedge.exe 84 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85 PID 3452 wrote to memory of 1140 3452 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ebe1532b34b9a35ab4327e110aea445b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb70f746f8,0x7ffb70f74708,0x7ffb70f747182⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1712795002391192333,11746161893288808194,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:3248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,1712795002391192333,11746161893288808194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,1712795002391192333,11746161893288808194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:82⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1712795002391192333,11746161893288808194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1712795002391192333,11746161893288808194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1712795002391192333,11746161893288808194,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1044
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3508
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
5KB
MD54374dc2a96390fcab7c582bef8fca857
SHA1c27594176530811875ae2a4dc3a944c75c3a38b4
SHA256a6c87696a2f419e1aa12c7d8b27e3a4090f1a82a2e4a6f5548fa8e8b71e92acc
SHA512215dfea5cd11ef1255f1e366c0ccd8a18a8edb4c3f507ee9e42090405db906ca2c67bf1340482f488760c17ce91409d73232874f0996de069aae316fa049580e
-
Filesize
6KB
MD592e5d284fad4b327559d36fac936ad09
SHA1e1be0796ac7c056c0e24fb96bd038529f66ece33
SHA256a94f72b040925298118d3ac5c7c6d435cafe7c26c09beac884dd4bda7a565432
SHA5120d1c13d1ba857ba4f3e4b859a4e1ee81c52cff01a6f363a22056597da5b6d83e97091b51ecce851b1f077f9f7005cb3c234a9a6f45456bacd880b10cf1f2f305
-
Filesize
10KB
MD5007837e49d4b66539a6fdca2f5a555ad
SHA16e2c75c4fa2eb6cb57591ee763d26f0196428110
SHA256d9b3e530215eed2ad33625484ea5cf780ed99a993a6eed27aa8605b52f1232c5
SHA512b46a1d8daafdf094b470e5733dc7fe0ebbfd85a3803e40e0743f1085ef931740e6bae870d8dafe15c297fc0cd260a5f86f3c8531da579c57ae7e04353b6b2059