Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
f6280ef2a2513e0c0a376710dfcc63a4_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6280ef2a2513e0c0a376710dfcc63a4_JaffaCakes118.html
Resource
win10v2004-20240910-en
General
-
Target
f6280ef2a2513e0c0a376710dfcc63a4_JaffaCakes118.html
-
Size
137KB
-
MD5
f6280ef2a2513e0c0a376710dfcc63a4
-
SHA1
2bd712d7b4c33cf1807ecd919c1e512d728ca342
-
SHA256
5486a9e9bbe3781c5f13be9178c1315a2d56c2c2541b3adf24e7b668e1d1e63a
-
SHA512
b5676a920d73eae2dc46ebafc6223d77a522d7dec6d396cba85f1b60090c934de96c38abc4b37b4abbfc1c7916b3d3de6d82475b69bdd586b2d8f594775efda4
-
SSDEEP
3072:f+ZIw1fPuQj4x+6W2QU88zuHHWay6DW4K3bG2:WZIwVPuQNH2aO
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 2308 msedge.exe 2308 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe 4548 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2308 msedge.exe 2308 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe 2308 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 908 2308 msedge.exe 84 PID 2308 wrote to memory of 908 2308 msedge.exe 84 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4404 2308 msedge.exe 85 PID 2308 wrote to memory of 4440 2308 msedge.exe 86 PID 2308 wrote to memory of 4440 2308 msedge.exe 86 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87 PID 2308 wrote to memory of 1544 2308 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f6280ef2a2513e0c0a376710dfcc63a4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7e6f46f8,0x7ffa7e6f4708,0x7ffa7e6f47182⤵PID:908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:22⤵PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2584 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1308 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4548
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3900
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57006aacd11b992cd29fca21e619e86ea
SHA1f224b726a114d4c73d7379236739d5fbb8e7f7b7
SHA2563c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814
SHA5126de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d
-
Filesize
152B
MD5b80cf20d9e8cf6a579981bfaab1bdce2
SHA1171a886be3a882bd04206295ce7f1db5b8b7035e
SHA25610d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1
SHA5120233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
2KB
MD50aaf5c5ac721c28d6a75fb4549cea721
SHA1e83008539ee597dba78ce38070d838c2a427273f
SHA25655e19a57ab35593540a2d42837a20ba3f8f3285ddef5e696672a927127812db2
SHA5121dad08aa2ba67c4a855d40b50937e3ba502db582747546ef60b92d707ceb2ec4779a29033a8f917990508bab662c7c979e5979eb82eccd4d247339e997e275d3
-
Filesize
5KB
MD5ece41c308cf3ce3da757357eede89d46
SHA136502f621f9b638c9730a2a563c8e5c24a3fac34
SHA2567352391d1bfbd2c8e46814c49679c053aeb7e9667abd986f7213f8a76e144b85
SHA512b2b6a53fcde9630c2d28a70255c49b0695c720bd5f7013e3b5b1aeeffeea6bfb0ed771b6ad50a70b9e467ba838dc4d76184e0f7df46f38923244b4c26fedaefe
-
Filesize
6KB
MD5e543c4015a00c60589265b65c687383a
SHA1a8af1bffe50b13d2bca0611a708715415841251d
SHA2564d5411e3533fbae1e10d9bd7a6605123adeaf0dc875603a3448d56edb6b02cd1
SHA512c8f667e9bddf13356e7af60d302d3fe77bd2979e0308c0c2394bfb0c61bf3ea8fc4bbdf9f31a141ebc1a54e8091e5d47b8a30dc25ed6182e182e1cfef95a9a65
-
Filesize
10KB
MD5cda5f43f69cafecc2cf9210a93c4d140
SHA15300dfcf7d53e49d1b73643cb13695bb88bd0b2c
SHA25679f7f45008a379b876fa701e783c817c10d7888f489fc94007673e7115a4cc4b
SHA5121a3c8f5b82cee3a1ce96a24facde33a7d3be04305268500401cb9ce2bdc182cb98eb7bc5e0d12b514645e5975753ce5ce94fdd2e250241682923ce4b19dafca2