Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2024, 22:47
Static task
static1
Behavioral task
behavioral1
Sample
269e502dc92ed09d80a0e8c201b422f3_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
269e502dc92ed09d80a0e8c201b422f3_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
269e502dc92ed09d80a0e8c201b422f3_JaffaCakes118.html
-
Size
139KB
-
MD5
269e502dc92ed09d80a0e8c201b422f3
-
SHA1
32bed9db71637519b44b2f31b5214d8b0c9552b8
-
SHA256
bb5e6356e4972643420ac038dab3855fef4a45ce1b3e31118acb93b5bbf37cd5
-
SHA512
eeb2475bd28f35961d15f47f5be377d710f483176e7d5391057b083259959b8c800b152b5aad37116a10518d81831e78b91a01ee2cc2fee831d06cb1fe0015fa
-
SSDEEP
1536:SSNlsdy3P6wfydTGlisYyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wee:SSj8sYyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2484 msedge.exe 2484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe 3892 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3484 msedge.exe 3484 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3484 wrote to memory of 4712 3484 msedge.exe 83 PID 3484 wrote to memory of 4712 3484 msedge.exe 83 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 4980 3484 msedge.exe 84 PID 3484 wrote to memory of 2484 3484 msedge.exe 85 PID 3484 wrote to memory of 2484 3484 msedge.exe 85 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86 PID 3484 wrote to memory of 548 3484 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\269e502dc92ed09d80a0e8c201b422f3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe649f46f8,0x7ffe649f4708,0x7ffe649f47182⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17970075865544833827,10023836408943942595,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17970075865544833827,10023836408943942595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17970075865544833827,10023836408943942595,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:82⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17970075865544833827,10023836408943942595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17970075865544833827,10023836408943942595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17970075865544833827,10023836408943942595,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3132 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3892
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4520
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD599afa4934d1e3c56bbce114b356e8a99
SHA13f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA25608e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA51276686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
-
Filesize
152B
MD5443a627d539ca4eab732bad0cbe7332b
SHA186b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA2561e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
-
Filesize
6KB
MD5483229b28a8e49734f119d0ad25a5c93
SHA14733440ff35ff9e8b3599bf05c2a6899497f3b36
SHA2561e6bec3e63310f7540229db61d438248cb30afa288845760cf95bef2066d489f
SHA512f6355c1ac8de1cfa1fda49750e4289d76be67751283c2a278f1afc24f816982ad8d9df85db59b3286de225913eee3cdee01718fe64ac07dd999224e53ba482a8
-
Filesize
6KB
MD5db46b56a407eba9b95ae474bdb39f7d8
SHA1eba519b3a89b9c2f5898b429c73adeb24e1cc4a8
SHA25632b7382c5e1aa8814e6b0d16b7e57132e29ed655eed4fd2a63d95f711e83ffff
SHA51293b8ab9d972c01b8a4b38806a26946a4fa153b509824201b041b92dad06dbda51fe768966a4819727ffeb3a4d61db60a142fc71e48a28abcb781b5136d8e1cb4
-
Filesize
10KB
MD54a537123112938cea1c082b1e383ae83
SHA1f839d1c690a9a0b0a5195f722f137647f777c6d9
SHA2568c783053298fc06f79790e65b5ed22975726ccd60de2e9e5acf477690c6cfa67
SHA512f727df868ba83e1bfd165ddbb5f50d65b18a36f452a251b714640e2972402d39dafef9ceacd4630f58a239888f5fa3d8220a3830cfe1c4b1b260a1168d6ecefe