Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
3c88f8d3e9a71778092116e8e62efb1c_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3c88f8d3e9a71778092116e8e62efb1c_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
3c88f8d3e9a71778092116e8e62efb1c_JaffaCakes118.html
-
Size
139KB
-
MD5
3c88f8d3e9a71778092116e8e62efb1c
-
SHA1
00ebcb6fe5f279508a7f99fbab121f99d059a10a
-
SHA256
b40333d99a5d5cb3e786da6ed1577bb4ae4f8454e1d2cd2e318f5845c7d881d9
-
SHA512
cf31b28a38719875de9f170be13f70f5b7d6edc4e986bece529ff5de37da6204a879a4cc6a0879a81b2e5721d4b099d5784b83d25e7c210152aa99288f045edc
-
SSDEEP
1536:S2HbVM4EbVnp5ARbHMl2yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wee:S2/jyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2036 msedge.exe 2036 msedge.exe 956 msedge.exe 956 msedge.exe 4408 msedge.exe 4408 msedge.exe 4408 msedge.exe 4408 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 956 msedge.exe 956 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 956 wrote to memory of 716 956 msedge.exe 83 PID 956 wrote to memory of 716 956 msedge.exe 83 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2180 956 msedge.exe 84 PID 956 wrote to memory of 2036 956 msedge.exe 85 PID 956 wrote to memory of 2036 956 msedge.exe 85 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86 PID 956 wrote to memory of 5056 956 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3c88f8d3e9a71778092116e8e62efb1c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6cfe46f8,0x7ffc6cfe4708,0x7ffc6cfe47182⤵PID:716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6637238943019714880,3915283500145119386,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:2180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6637238943019714880,3915283500145119386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6637238943019714880,3915283500145119386,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6637238943019714880,3915283500145119386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6637238943019714880,3915283500145119386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6637238943019714880,3915283500145119386,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4408
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2832
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD585ba073d7015b6ce7da19235a275f6da
SHA1a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA2565ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
-
Filesize
152B
MD57de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1010da169e15457c25bd80ef02d76a940c1210301
SHA2566e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
-
Filesize
6KB
MD5ca53f74c54a99db2d9414b3d349c4f94
SHA16ad2a1f45bce093754b8bb6b8aaa6d94cf465837
SHA256dc9033c9a5803015f31355f29d6f391b7e91a7ad0833f9a52feb98cfc463520a
SHA512bdc04c80f35b6e49c46d3a9efe427e2d215796bbb804e25b60a05f6d0fe620860127f7cbc9afeac31ccae9d3dbde7d540601216fda8127c3922461eb99646517
-
Filesize
6KB
MD5cfc43fdf8f704b26241cf1741256bc61
SHA1baed424a076427d5a552054ab4e449b741928962
SHA25614ab5cd095ade025f25529b4fa29bbee4e639ba2f8b72b5bbf9aa188cb1e4835
SHA51273f4c6ffd6e98b74f37740335ddde7276ffcb9f94048cd5a3324196a955e79f4b08313bc5545cb2f267cec2473023e24ad4f32f628cc7e0117ca67ac8f626cf7
-
Filesize
10KB
MD5b395f01b1d61ee2c03c2bfae62dd3580
SHA168b4935ec16ece3624a8a33f4c1be48ae1c90994
SHA256eaa4aa38f1d61e731d944a4ced3dcc966ab9b2fecf77d8f7ec74e91efeeb6beb
SHA5129e5f7260c928d82435cedab909232fbbeb26aba2ff5bd193f05eb84526afccada77af6209eb3d0337fe83a8016f213929cc9f837300bcf40f26a87ea0b39251d