Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 18:36
Static task
static1
Behavioral task
behavioral1
Sample
3b7f158be0c4d16475a7dff27901e54a_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3b7f158be0c4d16475a7dff27901e54a_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
3b7f158be0c4d16475a7dff27901e54a_JaffaCakes118.html
-
Size
139KB
-
MD5
3b7f158be0c4d16475a7dff27901e54a
-
SHA1
9cac6369d02a04fb8994fe2874398e1fc897a4bf
-
SHA256
a58314ddc1a35c751512fa6b31a88814f352db9fe95ce92415f6e6ab5e767985
-
SHA512
3d71eaff8690ddd6950119f361a85a178fcbbf12544036d77470b3cf81774eba5efc1f509a622ecd778dbd7230de82a62dca8361879a1adc6355e8a0c08ac2d6
-
SSDEEP
1536:SUV9wB5wLv/ApUoCKu3gfClEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP9:SUVaryfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2892 msedge.exe 2892 msedge.exe 3720 msedge.exe 3720 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3720 msedge.exe 3720 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3720 wrote to memory of 3612 3720 msedge.exe 83 PID 3720 wrote to memory of 3612 3720 msedge.exe 83 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 4236 3720 msedge.exe 84 PID 3720 wrote to memory of 2892 3720 msedge.exe 85 PID 3720 wrote to memory of 2892 3720 msedge.exe 85 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86 PID 3720 wrote to memory of 2484 3720 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3b7f158be0c4d16475a7dff27901e54a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffa586746f8,0x7ffa58674708,0x7ffa586747182⤵PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,1533990831405490168,8919915922411572255,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:22⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,1533990831405490168,8919915922411572255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,1533990831405490168,8919915922411572255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,1533990831405490168,8919915922411572255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,1533990831405490168,8919915922411572255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,1533990831405490168,8919915922411572255,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4308
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2956
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
Filesize
6KB
MD57893fdf211ddb51f9e773bb7717ce1ef
SHA13cf3244ca04b0bc3d506186e223fd8a4afe11938
SHA2560b132a10aad1ab7a6bcf46879c7e57721f122253668beffcc80b852f57176054
SHA512a865b825ed568fd219001140703be0f3592c1e8197577429179c800447d7cd1958abb84caeb495fac6fe109be2a37e28ba0c43376e367f22b1298e81d8631d3a
-
Filesize
6KB
MD5b2534b302fbd11420fe171db66cc7ff9
SHA1e8628f83d3fddfe264b49c6a2cafdc09c62f6892
SHA256dd809065b254f80980d0e09ddedc6a8c942b393dfce1652317f18b93b06b8ea8
SHA51211debf79de49999225a23f863a2160d6e8f359bbf8cb1daaadacb8d1ae3fe9af2b435a1d31dd9f9d3adcb0d05e89a5b8cc3bc336618dd1c41af37be7ad7608c1
-
Filesize
10KB
MD59a6e82d8b2724b32a680d6172b14e2a8
SHA1c7348c695cbaa528867031711b0b21a43454b37a
SHA2568bb70eed1cd3eba5552ae85a61e5c24b29b2ac5180a3fa33b3484dbd8718c311
SHA5126e608e5bb5781ae9e42b88026e3f60527189b34c69937146fe3bed65a05b9da89f01f4944412b11617bdb96dfe8178591a4d2afd5ac0e831d6133d20de676f1e