Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2024, 23:05
Static task
static1
Behavioral task
behavioral1
Sample
e39e44b21d469e0562f9343dd45282dc_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e39e44b21d469e0562f9343dd45282dc_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
e39e44b21d469e0562f9343dd45282dc_JaffaCakes118.html
-
Size
173KB
-
MD5
e39e44b21d469e0562f9343dd45282dc
-
SHA1
8c7e0b6231d6e2681a02647f990595caca8dc35d
-
SHA256
949df089691caf1c8cf94ef3b388266582910228de8a2bbd1cc7fcb399109b77
-
SHA512
5d3be8f121051a5affaccb1c57d32e7f5f3650ff2e60c7a925a58a0d3d515ecf094f2f23b6a1f90db3e0e3b80a12bf7ea82b096923d61458af5046d504397edd
-
SSDEEP
3072:SqRcVhIVs2LQegU0Dzvj40MZEPjLpUxAfYxslxNcl8CLcXmNRS/HDYlY983Sq7ht:LcjJ/jXmNRiy
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1760 msedge.exe 1760 msedge.exe 4776 msedge.exe 4776 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe 4468 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe 4776 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4776 wrote to memory of 4076 4776 msedge.exe 83 PID 4776 wrote to memory of 4076 4776 msedge.exe 83 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1868 4776 msedge.exe 84 PID 4776 wrote to memory of 1760 4776 msedge.exe 85 PID 4776 wrote to memory of 1760 4776 msedge.exe 85 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86 PID 4776 wrote to memory of 3996 4776 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\e39e44b21d469e0562f9343dd45282dc_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff997246f8,0x7fff99724708,0x7fff997247182⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15200969699814770742,2515854231642813686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15200969699814770742,2515854231642813686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15200969699814770742,2515854231642813686,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15200969699814770742,2515854231642813686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15200969699814770742,2515854231642813686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15200969699814770742,2515854231642813686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15200969699814770742,2515854231642813686,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5116
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD585ba073d7015b6ce7da19235a275f6da
SHA1a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA2565ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
-
Filesize
152B
MD57de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1010da169e15457c25bd80ef02d76a940c1210301
SHA2566e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5904cd5db885d49878c4437fef074cfc8
SHA1dacf2b817ee37e5edf01c9401c68e49de077db6b
SHA2563f2456a7122aeb76a03c0dff408b74e43486c46ea6ea47fb9219c377264481c4
SHA5124d71677a566c4d1bd412af7a3578ec1c14dac1b17c781bee42eaec6295b1cbcb6e0c46a107690c35bb99ba1ff3a2a4ef367490b99486e63c3c7b9f5d7f28fd91
-
Filesize
1KB
MD50e84d77e9b909ace656d67c8720b052f
SHA1371d50fc5013fe334203641bfa664b0ff2bba0e5
SHA2560b679d95fa197b8af285104f3b0af911e084e01b8a11b76093967337ae98d41c
SHA5122f520d1a044cc334eea10269305ae59308faff4343f29602d17fdb6d4021d02d8aa5258bcd6316d2caecf660a502005884b1ed4bf71dd012effebd6d4355fc0c
-
Filesize
7KB
MD503b1f32fc976fb8ccf494dd7728f8a98
SHA1ab1d77cd8293e77f3522303d1c0b5645aaa131f5
SHA256c2d9125031350e557f00eb7891a76a5f0f79d00ff02dfeafc81bae6f510c59a9
SHA512ba6d3303f6f6e206079e2c7cbbe06223e467118038cfa884413804eb088209271c31bc2960a5968922e5efad86804a27e57b3ecb1d71c3cde744cacd48f804cc
-
Filesize
5KB
MD5def5c10f0741a9caaf0539dbedad5e17
SHA1b1d4b4b58cc956d85e592f8f400402f5725cb465
SHA256350df1379cdc9a1e023a54b0fabb26ff8ec33d7316d92fe3fa6ad2983bdb4d96
SHA512e720ee9eba44b06dac9733bb49494596c65e9b3aac92ab8dcf6a8228b0553a1f6b1bd2cb524493c27bf1d2c35d38c00b9b4cb99934b87e5047e2cdfdba398655
-
Filesize
10KB
MD5b4ce63a0a21eaaf17467f0b28ba027b5
SHA11f4fbc4ce28fbefe849998d82cb8a2e5f822f957
SHA2567f5d4f8db4df08e7361ec9294d8c2b0887fd872d049581bb192e4b8047039360
SHA5123e9d55649a6cc86d182f002a7083b99ef7828a0fa0e7aa09e5ce9896a9d45ffeaf3ba2ad4f22160ac30f8385924d4576217a757773560f63def854bfe527b158