Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 01:50
Static task
static1
Behavioral task
behavioral1
Sample
54d23e630e425e64c6ec85740697093e_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
54d23e630e425e64c6ec85740697093e_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
54d23e630e425e64c6ec85740697093e_JaffaCakes118.html
-
Size
11KB
-
MD5
54d23e630e425e64c6ec85740697093e
-
SHA1
2af7cb29b05e4c7c1a87ac334c4236f4d032d316
-
SHA256
7431284b417d1ea93d1ad2a3047eb4e5c3984ac6acf8bbedee623f6085c42a8f
-
SHA512
11406538e5ecf2cf6adaac88d6990453244c2b947e31598efaf35fe87598a5298f24d721c795d00d1fe105dd14947567bdb75afcf62b14046ae9a943e278fa8e
-
SSDEEP
192:2ValIsr0r57M4MxapT8IM/w1wvqVkt1kHauBuLbdU8d:salIcIQ4MxaBM/g8WaguLZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1396 msedge.exe 1396 msedge.exe 2360 msedge.exe 2360 msedge.exe 2728 msedge.exe 2728 msedge.exe 2728 msedge.exe 2728 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe 2360 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 3120 2360 msedge.exe 84 PID 2360 wrote to memory of 3120 2360 msedge.exe 84 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 4008 2360 msedge.exe 85 PID 2360 wrote to memory of 1396 2360 msedge.exe 86 PID 2360 wrote to memory of 1396 2360 msedge.exe 86 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87 PID 2360 wrote to memory of 1432 2360 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\54d23e630e425e64c6ec85740697093e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95aa946f8,0x7ff95aa94708,0x7ff95aa947182⤵PID:3120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:1432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:12⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2728
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD53677a65a642d90fc1d527762970d0726
SHA19aba3934e02a035e2d14ad67e47d8af04153d949
SHA25645bd89379723f1c9c540153264897c831ad082a84106e470391da81bce519cb1
SHA512075dbb328b38c48b4dbd476bb84a9af9b6aaf971e2ea5c0bda8486d5770f17a256b9784ecc652032c096b0e63e770041ee4ef1bd38f6fbc19713be80e002149c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD586d073cfb2f4ecb520ee3c19a801cc68
SHA1e058550cbfc46b831884d8daebb14c58417dbc89
SHA256b7f3954266a8fcbd798d5148d8f615a0058d087d48245a5dc884abdb04eee928
SHA512b1bce4e025421fd54a3c7cbbf31fba33604b6121807d7d2a18d236d3144acbc70e7dbbc5e9d9b862c3f75fad0cc1d3c44f4670848126b764c60efdc497d80eeb
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD5c636cb55f317a2a48bfada5f87174a6f
SHA11bbb2ea446d69d1b8eefcae047754da642dcfb25
SHA2562e6a9128d3f2823231e402eb15daecd186195fa93992699180295dd706738e62
SHA5128bfb286fb32f95ed50d74e1844b6cb9dec19c24ed9acc40a685e54681b7ab9ff53c3d9d693c150d0dcac4b68007aaa67c1e7d6aee9e33dd36ead6f696888a447
-
Filesize
6KB
MD544c532d9948a327559a800334194a897
SHA12d1899ce996921cdced3c715247fe80072036b80
SHA256a4ebbeb8627b34447044ae5cfe18433a1c364c033a193e64a761383c5c75288f
SHA512f7b10642eab2e16d87fb469a893f9aae7c36a166979624399e2696504d1f75a2df36b45fb5355d0b079d7714c03c3322fa20370cd6518e83f8b5859dec0a6094
-
Filesize
10KB
MD5db566f7b82108597a673428084a142c5
SHA127d17957e3d32402f29eb6d5e9a3a9a94eea2c9a
SHA256f575cb5cb594fe65e10c95f3c8a581223db63a6aefa34eb0b50da7f2bc78b9c7
SHA512bb2b57ea4c52f2394998cbd0ae43e883696e06779e7be6199cd5dfe0ac1aee6c24bb007993e522035d8fc9fa2352fee3496f531075d8e23a658a950119d6d552