Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 21:56
Static task
static1
Behavioral task
behavioral1
Sample
faf91e41a3910aecb96a1dd8c882e2fd_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
faf91e41a3910aecb96a1dd8c882e2fd_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
faf91e41a3910aecb96a1dd8c882e2fd_JaffaCakes118.html
-
Size
213KB
-
MD5
faf91e41a3910aecb96a1dd8c882e2fd
-
SHA1
0f0eb84cffcb663261827dd893df4e1fee9ea8bf
-
SHA256
e7b34641335928c4fbba3758e5a09ff7eae1efa754689697c8c3681d59e34081
-
SHA512
e6e06b0fa5f188a542a390658a24d16123248ada22a0e47f75629b508853c23db3d295738feab6d93f4fcad16f6d8b5a26fa317cd1d226762a87b447f74ef81a
-
SSDEEP
3072:SwK/11PGKBI0YyfkMY+BES09JXAnyrZalI+YQ:SZSOVsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2720 msedge.exe 2720 msedge.exe 1864 msedge.exe 1864 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe 1856 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1864 msedge.exe 1864 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe 1864 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1864 wrote to memory of 4196 1864 msedge.exe 83 PID 1864 wrote to memory of 4196 1864 msedge.exe 83 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 4556 1864 msedge.exe 84 PID 1864 wrote to memory of 2720 1864 msedge.exe 85 PID 1864 wrote to memory of 2720 1864 msedge.exe 85 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86 PID 1864 wrote to memory of 3672 1864 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\faf91e41a3910aecb96a1dd8c882e2fd_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b75546f8,0x7ff9b7554708,0x7ff9b75547182⤵PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16630935165070567278,18317592707789875360,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,16630935165070567278,18317592707789875360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,16630935165070567278,18317592707789875360,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16630935165070567278,18317592707789875360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16630935165070567278,18317592707789875360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16630935165070567278,18317592707789875360,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1856
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3188
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
Filesize
5KB
MD5eac73dbbe86f8d2ffd56503579b67804
SHA118a9788e9bd0b6c9d35c84169cbe86bbcbbff3ec
SHA25649245dc0fb2df3e1023935774186353f44e1f6856ec047bb2965d80f9290955f
SHA512ad52fc7415071fb822fe1e09cb89b98ab47558508f50b16dd1b006186a0e2fc44ebda692ac06ca14146bd2ac6aaa28ac4c6b7da50b367bd3ec05ae3b21d1f0ad
-
Filesize
6KB
MD507c1e59fca5f5c6acda424e4fceacfd8
SHA1ad3ea26a9e206374634803748654f12c2b0c7c75
SHA25698cbe0e4edb92549a92f1b0135ebe47a5aca1d504a3f567653447fddc9e1665b
SHA512b5e4d2b59034346fba5b85f1cee0ca74c5c3ead37461adfc84c6f090cd1309a73b2f584019d210d5a81b88d455d52c51890a493e7034a1266b7983dfb91421fa
-
Filesize
10KB
MD5be18e76db1c81dd93d8e6e821e153414
SHA191e2dac562466e6fd996ce0c154b548a478accc7
SHA256c21e08028eae7720d589d65a11b298f6a26a733d17b3bcc64cd9f572ea0667d3
SHA5126d23333e42256748ad399e4791c581196aad6d5ba3399f2aa990b30439b38119df5fd49c3f3c39b279fa7c1a5e2b4cd7d8cc3d1bc5694912f0badf21afefd7b7