Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
5422fe096e3b31b7bfe5bd74ccdbf034_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5422fe096e3b31b7bfe5bd74ccdbf034_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
5422fe096e3b31b7bfe5bd74ccdbf034_JaffaCakes118.html
-
Size
85KB
-
MD5
5422fe096e3b31b7bfe5bd74ccdbf034
-
SHA1
99e22cc795aa551b3d13f05d38fd35f8c2230da4
-
SHA256
f272e60a3facadcabbcca9983cc79847b47c6f4f6939584cdcee637bfc351bcb
-
SHA512
aad3546af56aecb15bef6f062a4c05eef7cc4b346d8e1e27a5d0273e5c8344c11b4e3d9ab62cd9e1a1ec863805aa0a077db8720bb1766f6baedc8722e453f1d0
-
SSDEEP
1536:L+ipVn1BUNqvLKvr7R/anVXWCUZSo0mjiMpbqqvmznhKv++nPLB1VZ:LBvLKvr7RWQiyuznhKv++nTB1f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4820 msedge.exe 4820 msedge.exe 2420 msedge.exe 2420 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2420 msedge.exe 2420 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 3928 2420 msedge.exe 84 PID 2420 wrote to memory of 3928 2420 msedge.exe 84 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4708 2420 msedge.exe 85 PID 2420 wrote to memory of 4820 2420 msedge.exe 86 PID 2420 wrote to memory of 4820 2420 msedge.exe 86 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87 PID 2420 wrote to memory of 2044 2420 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5422fe096e3b31b7bfe5bd74ccdbf034_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0c8446f8,0x7ffc0c844708,0x7ffc0c8447182⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15890055281611951622,5327192860144138658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15890055281611951622,5327192860144138658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15890055281611951622,5327192860144138658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15890055281611951622,5327192860144138658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15890055281611951622,5327192860144138658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15890055281611951622,5327192860144138658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2508
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5fab8d8d865e33fe195732aa7dcb91c30
SHA12637e832f38acc70af3e511f5eba80fbd7461f2c
SHA2561b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
SHA51239a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
-
Filesize
152B
MD536988ca14952e1848e81a959880ea217
SHA1a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA256d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
SHA512d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
-
Filesize
5KB
MD554e25e5def15b35979f2e49a77e53ef8
SHA1124cd1a7e27e89f96a0088389a44d0220fcc894a
SHA2560813696c6e219fc66cd0970907461d25c404280143f0e13633f134b56df101ba
SHA51259eea9ef3369fb636727f587bd7b925b9d96f736cb54e831f14dae57a6b577910e29650311835e8ec0ddda22346bbc7998e3836a37d62669b182a39908a18de2
-
Filesize
6KB
MD59215aad419578f80e9cb0d684b9a07e1
SHA18cd0ee892edda6957973b17e39803d0d2543e158
SHA25677779e87e5b87a5fec5a08dfc475b5b1c9bed229c14c0f1ae4420d4b906cc471
SHA5129f93a145cbe225dce50823cd80bc4f71f12aa0b000fab2ac8feaba6f690de31c943ee8e9ea2a14ed3061c080ab341d3e29a5e5366e7fb2053d38dee826c80b62
-
Filesize
10KB
MD5fe96eb94751fc31d54749cdf69566e61
SHA1cb2c853c98b69be086eea35f03c91602f2230e66
SHA256d9b91fb96aebe09c28fc5c3fcae94bfe85447c43948375293f8c033689199506
SHA512ae23727f0fdc875889d660ffc704956c8797640c60963b869661395a5394bc13a7758e9317434c1458ec4452ce27e50497264f47ac0d831cc460e7c86b5fa2b6