Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2024, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
ee845e1c4cf5e502d63aa4d8eafed35f_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ee845e1c4cf5e502d63aa4d8eafed35f_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ee845e1c4cf5e502d63aa4d8eafed35f_JaffaCakes118.html
-
Size
143KB
-
MD5
ee845e1c4cf5e502d63aa4d8eafed35f
-
SHA1
a9d7f64219216135e99fe7cf04c26835eb547da5
-
SHA256
e7af9a2d0d18316f4df3f9533a5d39ec435a037774f100f6d2d98b923d28e5a7
-
SHA512
a603df3d2300a8313bff4d70dea6351ad2c18127d9a21af53f7339356b3d488607d9cb193d7aae0f0f7e2102a007b4ba9341a8d5b544fb6946cb5fc978613cef
-
SSDEEP
3072:SrVFjunXlGk/2XYGF2LBkjyEls7gviqHZsbjMfZug1YnrT5y:SruGk/2XYGF2LBkjyEls7gviqHZsbjMf
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4436 msedge.exe 4436 msedge.exe 3968 msedge.exe 3968 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe 3968 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3968 wrote to memory of 4760 3968 msedge.exe 81 PID 3968 wrote to memory of 4760 3968 msedge.exe 81 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4008 3968 msedge.exe 82 PID 3968 wrote to memory of 4436 3968 msedge.exe 83 PID 3968 wrote to memory of 4436 3968 msedge.exe 83 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84 PID 3968 wrote to memory of 1412 3968 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ee845e1c4cf5e502d63aa4d8eafed35f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6b6646f8,0x7fff6b664708,0x7fff6b6647182⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14349482746012808211,13237065277627544840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,14349482746012808211,13237065277627544840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,14349482746012808211,13237065277627544840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14349482746012808211,13237065277627544840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14349482746012808211,13237065277627544840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14349482746012808211,13237065277627544840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:12⤵PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14349482746012808211,13237065277627544840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14349482746012808211,13237065277627544840,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3700
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:100
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4312
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ab8ce148cb7d44f709fb1c460d03e1b0
SHA144d15744015155f3e74580c93317e12d2cc0f859
SHA256014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
SHA512f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
-
Filesize
152B
MD538f59a47b777f2fc52088e96ffb2baaf
SHA1267224482588b41a96d813f6d9e9d924867062db
SHA25613569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
SHA5124657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD5076802ef4052c0a328d1551ed9bb6aff
SHA11949dc4c3751f2cb8358f06f9c7b27b469d921e8
SHA25647099827d65d61ff8d79397efeb7d8c7e2276dd4a62156ce1c9a74bf25077600
SHA5123dd3f38e780bb7ea5b5260904843c98d51e7789208c3e223804d5839d15a65784afac56f1f4576794460632b870098f8ae6529d51c95ef22550044e2f727633d
-
Filesize
2KB
MD5e5c9e480fa64f3eb2193fade77810934
SHA1ab5a89030f9d2e7c251c110542e88242f7734012
SHA2567cf1e5680ce33165fc90521d220b31e5597f6d29d7a4a2a73f0ba8df16a35e33
SHA51235923cd89275391eb5a5a177db5d121f7c66a66185afc07d1ea2335ac05c1a41624aeebce76d106aa2242544af2243ec77d5199eff49be4c2fd45e3ce93ffad4
-
Filesize
2KB
MD5c7f5fac4af11f0079f45165e5ac74437
SHA10e3ba7af1d7516e9144566715f4f408b27bbd620
SHA256e009e2494d18a4ba4b848383996c40768c931c6993eb03fc44bc59ee8c5ef0a2
SHA512c7629b4b602e7bed2c9f882a33b0828129f27e46a155107a359015f2d39aa59af57424ac20dc9c00ce88282a0ca2da1012d388239611dfd708b7b228edf9c591
-
Filesize
6KB
MD5fc250cff51e06937dcc0580d1e604207
SHA10b26db97d3f63cfc851ca02342cc9daad9fff1cd
SHA2568621dc823460e17611e1471d81b697580da7e8356def54793afdb62b10ddba34
SHA512984502a680a0f9be675b2221be9073f95864a448d733d8e0e9a6ec139835c3b6244622f2c64c9aa9e9ad0f377819741752e006090b92d7bd67ac6ed03e04efe8
-
Filesize
5KB
MD5c9c48cbbd14181b4d52a981ac609d0e6
SHA1c276010efce68d0ffbe06f708d522d530ba8a6e0
SHA256c126c5f44f0888a600e9ed177d7af37ed41debfd00f2976816267f997b834266
SHA512e68327421049339af7689b6d3e8916f81c8104cf420082c951c7bde59d241fc0359f5150c42cf0eeeef776541a594e62f4c1ff07d7fa1f4dfde9edc8db2fbd3e
-
Filesize
10KB
MD5876d4ce25ebf25c27fccf8ac9718ccd3
SHA110472801d32d9887e0a05f0b7f46e3168405b0f7
SHA2564074b5ff14ed7e655a1f02271f4370969e8101b42257d9c1cfbb3b3f9d742f77
SHA5129834a0bf45ec3ef5f7170b1c35275294b8435c73ebb152abb65c253817f7a6412222717f9d83acac8a5ce2a21846adda9f372dca566e001335184dd0e4466335