Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2024, 20:22
Static task
static1
Behavioral task
behavioral1
Sample
36a64ef65fdcc3482787dd86fbb51a91_JaffaCakes118.html
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
36a64ef65fdcc3482787dd86fbb51a91_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
36a64ef65fdcc3482787dd86fbb51a91_JaffaCakes118.html
-
Size
214KB
-
MD5
36a64ef65fdcc3482787dd86fbb51a91
-
SHA1
c74210e09cce960f010e6527598e85eb1ba79e63
-
SHA256
a59a787f11e490cef0e91bd5cd27a6702c4b3d37e9ba7497ebb99867ea2afb9c
-
SHA512
68bb52a65d88381e5da4ce3fabccae837d4719bda4b512a7f80dda7a19773b1ae7fc17c59076ffd1e8a6216dd8f28601bc54fc4b1dc6b5eb305e3142332704ef
-
SSDEEP
3072:ArhB9CyHxX7Be7iAvtLPbAwuBNKifXTJm:Yz9VxLY7iAVLTBQJlm
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4916 msedge.exe 4916 msedge.exe 4992 msedge.exe 4992 msedge.exe 3992 msedge.exe 3992 msedge.exe 3992 msedge.exe 3992 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4992 msedge.exe 4992 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4992 wrote to memory of 3592 4992 msedge.exe 83 PID 4992 wrote to memory of 3592 4992 msedge.exe 83 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 2852 4992 msedge.exe 85 PID 4992 wrote to memory of 4916 4992 msedge.exe 86 PID 4992 wrote to memory of 4916 4992 msedge.exe 86 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87 PID 4992 wrote to memory of 2076 4992 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\36a64ef65fdcc3482787dd86fbb51a91_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5ea846f8,0x7ffb5ea84708,0x7ffb5ea847182⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11487027367041152704,17271825549703136696,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11487027367041152704,17271825549703136696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11487027367041152704,17271825549703136696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11487027367041152704,17271825549703136696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11487027367041152704,17271825549703136696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11487027367041152704,17271825549703136696,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3992
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1484
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
6KB
MD525d76d743737d93af84cd444408ac93c
SHA1661403de43bd9407f12bb4741ffd51ef45c84679
SHA2569bac39e6cf978ba9a11c86fc409fbe37cb1ed10ffe45a6d920cb3e60cb4be19e
SHA512bbc25fe84cfc5548e0faf9c8e898b29f72d5c41d12c12b08d7c241cb85cffa8538fe24bf4e7862f6103d5b0ba8aa4404d2bcfc2f7dd36d23b2aeded4ee908c2c
-
Filesize
6KB
MD5078d6beb6925caf848e65f335be738ed
SHA1dedda6c94d90fe22c6191a0d8435b28a0bb28054
SHA256de8e497b697198e57392874df1aebfd57ff8d0e8069edd508a931cb1305b58c9
SHA51278378c426c3b6eb28d10254d0f1a17c9feac35174de50b97fcea12cd235a4f4f6bc45051eb002eb5d115ae6f622a05163240582f5d9d47e17076c464d100f308
-
Filesize
6KB
MD59a224d2f87908463a3d5695084550e4b
SHA1e250d372b1ec160ea8cd2496ca3eb0351fc9f893
SHA256a730c60772e4c5f526f66490a5de1a9c424b080fc0eb00f4e81071086c564d1c
SHA51283186bae934ca44179bd8c1403957ec9ecfbd56ed2b322b08645923916df8b3dc59ed49cee95806de2faff873aee2357f415835bd2883b3e3e5df31caf09598c
-
Filesize
10KB
MD53bb98bd1855fcbc7133185132baccbbb
SHA1a595a1b77359b287a3b2351780c581514fd73640
SHA2561e380ebca5be4947b5d277a591dfb8d80f4c67f8861f9409150575e49ca4f425
SHA512d94ab5d40c746ed5237fafe048af2e87c79d5f374500a6f385153fd12448cd5696d4842e1670d97beced24b4f5685d20c1b2d391b31733dd3dfd8ea5bdf84cef