Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 09:47
Static task
static1
Behavioral task
behavioral1
Sample
ef87c9f687aad95584b75641c76e1935_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef87c9f687aad95584b75641c76e1935_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ef87c9f687aad95584b75641c76e1935_JaffaCakes118.html
-
Size
139KB
-
MD5
ef87c9f687aad95584b75641c76e1935
-
SHA1
bb602d51a31e9bfb5e752b85fa961873c9edce57
-
SHA256
b4bfa3f1bb62b55061dcc7d2592fe9165b29dc94e2d9eed24731e7bd8a8de7c7
-
SHA512
c09dc275d47e1a1ba9c7f651755f66392f41dd280e888aed87ffb77a9f8dc48949e7f4c2234798b120c30ade199b574d4055b8743151edd285cf1c186f389065
-
SSDEEP
1536:S44vMXfjRR01aoxlEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:S44kbUaXyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 804 msedge.exe 804 msedge.exe 2652 msedge.exe 2652 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2652 msedge.exe 2652 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2636 2652 msedge.exe 82 PID 2652 wrote to memory of 2636 2652 msedge.exe 82 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 412 2652 msedge.exe 83 PID 2652 wrote to memory of 804 2652 msedge.exe 84 PID 2652 wrote to memory of 804 2652 msedge.exe 84 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85 PID 2652 wrote to memory of 456 2652 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ef87c9f687aad95584b75641c76e1935_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc86946f8,0x7fffc8694708,0x7fffc86947182⤵PID:2636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,10847830003387881903,12009035517416402303,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,10847830003387881903,12009035517416402303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,10847830003387881903,12009035517416402303,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10847830003387881903,12009035517416402303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10847830003387881903,12009035517416402303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,10847830003387881903,12009035517416402303,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1036
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:228
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
Filesize
477B
MD5c6a164252f43c421d9cedb81127bd16a
SHA1986150f627394e96ae7bf0275cc468f907f2b41f
SHA256274d2d598a66479482f00433bdf2eb0660604e2052fa72d0d7413ceed23a35e9
SHA512e53fa932a77426bdb6206a89629335c48777ba81698c0d0b84f40b127a116c4b5b22df4af26e1ccdcbd91cf065090e6796382cd8efc838c5d1ef34ecde3aa350
-
Filesize
5KB
MD5985247d3c981a21d20f9b5bee87f8271
SHA199855ed629377c37b0098bd7b5907507c23de814
SHA256ccdeaad54fd8963cb68ad5038e5be4333bae6cfe063e93a92cf78ff1681ba5f5
SHA512f93fb6d8419f47206b67a9c7a527a4c6f498b4f99e0bc462e423dee0466d6705df1790237b1ad75323bb85d18346131a5f254eb85f585948b8e4840444d27936
-
Filesize
6KB
MD5f8c501c9e3d4060ee063ca76e8376147
SHA11a1afc691834f8e541d96cce0ca2a6609933cb1e
SHA256d15c9cd4795d4a5bc0527901ec90469b43dc0e94b25e09d4340cfbdd073f36cc
SHA512a383e12eab82263886f8187c2715a647ec2474efdb54000d200adfe699c106c3b9b6eddb9ecc41557c2b41efb22193af4aff91ada38b0bc5c09fa721bd4e66f9
-
Filesize
10KB
MD5dd51bb7c51b783b2a9ca2976220e3284
SHA1628429befc1acb5b7eb5bc50939b5a577b1ce0cc
SHA2565a64484b08b03ca4d3225143bd83aed2684a6b6efc8111da8183ac36f31fd781
SHA5121f9acb4dd425f3ffcc586d62bacc5d5594f4faf42a8dfe5cadee7405a5c2e462405d31670c548e62188f6745fe7a7573533f100da9f55d22632675881f5bf1e8