Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 19:38
Static task
static1
Behavioral task
behavioral1
Sample
3bbc47861c03ba28dcacac03f9fe103a_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3bbc47861c03ba28dcacac03f9fe103a_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
3bbc47861c03ba28dcacac03f9fe103a_JaffaCakes118.html
-
Size
139KB
-
MD5
3bbc47861c03ba28dcacac03f9fe103a
-
SHA1
61036a71efd28554b2da828d6984b9c323b128f9
-
SHA256
7c0c71d7cdecf778a980966de512ecbf821de302d554daf1ebdc83418a0afe79
-
SHA512
c3a33289af33426908fe965f69cb61019a0edbc367a699a17b12e75e782e549b26a743a3bb8ab2f177a65b9079702537631f596acb46dc3ff5a9f9a44bccc65f
-
SSDEEP
1536:SawvW00a6mDmaYJl3C6cy3AaATmyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EXe:SawojC5qyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1824 msedge.exe 1824 msedge.exe 2140 msedge.exe 2140 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2140 msedge.exe 2140 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2140 wrote to memory of 3916 2140 msedge.exe 83 PID 2140 wrote to memory of 3916 2140 msedge.exe 83 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 4420 2140 msedge.exe 84 PID 2140 wrote to memory of 1824 2140 msedge.exe 85 PID 2140 wrote to memory of 1824 2140 msedge.exe 85 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86 PID 2140 wrote to memory of 1036 2140 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3bbc47861c03ba28dcacac03f9fe103a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec77846f8,0x7ffec7784708,0x7ffec77847182⤵PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,9160699030286085052,15913709283245380872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:22⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,9160699030286085052,15913709283245380872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,9160699030286085052,15913709283245380872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9160699030286085052,15913709283245380872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9160699030286085052,15913709283245380872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,9160699030286085052,15913709283245380872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3708 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3432
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2484
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e55832d7cd7e868a2c087c4c73678018
SHA1ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
Filesize
476B
MD53bf48340a38cea45d61ebb7807db63fa
SHA1e6f058552efcce23195b3ee220d7ec18042c4a69
SHA25651742bd7fa6b2dbd0d2a5aaf2de119b68fc7fd45c8dfea760d516fa2722cd984
SHA5128cf6dcc804781b1159b82db5f667eef5f37fc28eea1d8fd706b63ec38d6a195d4f33ff5db8071dc085080b677257703ece821882d4981ec59d2f2bf9fb4c07ef
-
Filesize
6KB
MD5fdda6cef12b556c7301b400e2294d70f
SHA1bafe17bd6c5c2a699e174ab7e0286252ded19cb9
SHA256371066d9c9e3448dcee52cd4e8c9492b0a371d782ce98db06b259ceab5c8d0e3
SHA512c803b762e7154337aeeb4fe4b77b8aac5f53821effc5981e3699b3d6103bec447f8d05efa7211a4248c5143bc964e5771bb21a319053d719b82aa1d9cf1582cd
-
Filesize
6KB
MD5bbb51f9e8a23b6299d304d30e7cc3536
SHA1059e1cc84d119d39b155418d85112e1f2cd42d1a
SHA256f47a77b6ff3bf6607a76fadef2e017b04d4045610e2f92e4a5f6a47600a6fc5c
SHA5121e392b8e127b3521d5402b827861e6fd5b7ca22bb1a641c9ee35ccf5a061cebc6d960408d3a08438af22185a7dca78cfa3dbc4c8b4a7a06c8ee90ea19edb7309
-
Filesize
10KB
MD5fc20158fa96e441fc0aa5df17c9bce8f
SHA19f79fa208d0879e03ab94324c41c8827443a71eb
SHA25687567f3268f763c4714ff727eb06b50477294339e557b0ab19161b962dcc8380
SHA512af781383e5af162ca011d52e4c8b4b34859af6124fc5eaa877ea4739773ab5fcf04d10a5f808b89b526495a0032731d7670262a2842921b8a0b7ecee52fabf69