Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
52cf4a069f2537fd920061cda86d60e4_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
52cf4a069f2537fd920061cda86d60e4_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
52cf4a069f2537fd920061cda86d60e4_JaffaCakes118.html
-
Size
17KB
-
MD5
52cf4a069f2537fd920061cda86d60e4
-
SHA1
358bfc7fe40927dbd2ded2874c200eedea2ad92f
-
SHA256
1ad1712cddafdd1cea6f6734a26cc6f2e63eda78149bfe45dddcf96051f59509
-
SHA512
fc580bbb667e2d68fa93c29e264b335034e305d33e9694ddb5b48f879cb9970541f3f2a7848e5453646eefc9d8bd9cec1757e7bd0fbf6d58277c426a90afef5c
-
SSDEEP
384:yIC8vgfXHqWALypIPPIjQbXB9MvFRmPW6OWY:yWgfYOpsZXB9kEPOWY
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4308 msedge.exe 4308 msedge.exe 4068 msedge.exe 4068 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4068 msedge.exe 4068 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe 4068 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4068 wrote to memory of 3136 4068 msedge.exe 84 PID 4068 wrote to memory of 3136 4068 msedge.exe 84 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4776 4068 msedge.exe 85 PID 4068 wrote to memory of 4308 4068 msedge.exe 86 PID 4068 wrote to memory of 4308 4068 msedge.exe 86 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87 PID 4068 wrote to memory of 2712 4068 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\52cf4a069f2537fd920061cda86d60e4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf10046f8,0x7ffdf1004708,0x7ffdf10047182⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,24083449328491529,16935129369249373581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,24083449328491529,16935129369249373581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,24083449328491529,16935129369249373581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,24083449328491529,16935129369249373581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,24083449328491529,16935129369249373581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,24083449328491529,16935129369249373581,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2764 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3488
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4028
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5bffcefacce25cd03f3d5c9446ddb903d
SHA18923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA25623e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
SHA512761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7
-
Filesize
152B
MD5d22073dea53e79d9b824f27ac5e9813e
SHA16d8a7281241248431a1571e6ddc55798b01fa961
SHA25686713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
SHA51297152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413
-
Filesize
5KB
MD5995221a51cb62c5fc5627d96a79207b0
SHA1445deac2e3928c1a45fdc09f52966206995456ea
SHA256dfb099740692cda4b5b03bf9fc4f070b5766feadccb26d4f3802feb048e16967
SHA512844eadb480dede4b123d456cf08ae8c55bb6244f31ab05d70660ef8ddc63ecc459e27f9d48961c8f66b5d517a1baa338d18a38ec01d71c9eed1ea0578b6419cb
-
Filesize
6KB
MD54c1df8ebcbea5cbc18e7913b7fc35028
SHA1d0cdaa6ec8837fc144be3cc723d48a6392b04dea
SHA2566bcf08f7f8db208a462a1ed733bab63788beab83f7bae1ff4181ae2947777e5f
SHA51265ee88c7ef881bc248c6f48e3eaa5610cff5c38828e639dca0ea5d0c6ba8bd25dc99a35084df5dcf225c0992be35cb896a97dd29c9928c60526345b41a1a446f
-
Filesize
10KB
MD5b950234155fddfff0e0c4c0a3caf4365
SHA13d4f33f1647cce31f65efdfb218abc3e2a9d5728
SHA256f012ab4253a09d7fb06af03a7b2fc87269450e63e661ee1037215569835d9d67
SHA512f4a9ec43519d9cc139e51c9f58b400e2b55c11f0fe4283fc83f13eb475b66f31478774d67a3e4f71ec7ca922d1304c72218bf167de7e103939669e2de1ce2a8a