Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
29f6f6cf047c5ed517135150c70557b1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
29f6f6cf047c5ed517135150c70557b1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
29f6f6cf047c5ed517135150c70557b1_JaffaCakes118.html
-
Size
19KB
-
MD5
29f6f6cf047c5ed517135150c70557b1
-
SHA1
f34fc89417d837fe54d07d370110d8a03990e497
-
SHA256
1d87fd60573b166920a0c2b4660356e896275cd85c4ab090db01d484e6c2a9cc
-
SHA512
e3c5190d61c27f80c0ec0120b34442179cf2e82f2c0e0e7b3c59d14aa583b9b417f3e1515db28079a09e5bbe0b60b770cb70dadeac237dbd784242af5abefc4c
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIh4/zUnjBhhr82qDB8:SIMd0I5nvHZsvhQxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4252 msedge.exe 4252 msedge.exe 3536 msedge.exe 3536 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3536 msedge.exe 3536 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3536 wrote to memory of 4584 3536 msedge.exe 82 PID 3536 wrote to memory of 4584 3536 msedge.exe 82 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4852 3536 msedge.exe 83 PID 3536 wrote to memory of 4252 3536 msedge.exe 84 PID 3536 wrote to memory of 4252 3536 msedge.exe 84 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85 PID 3536 wrote to memory of 3164 3536 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\29f6f6cf047c5ed517135150c70557b1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f44046f8,0x7ff8f4404708,0x7ff8f44047182⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17608106980489439490,7332164801619741539,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17608106980489439490,7332164801619741539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,17608106980489439490,7332164801619741539,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:82⤵PID:3164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17608106980489439490,7332164801619741539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17608106980489439490,7332164801619741539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17608106980489439490,7332164801619741539,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2268
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
6KB
MD53fc68e475dbf8ba25bdd590e6e81f95a
SHA111d0fb0fd7aeffa2836e5a0354fa19f52588ae5c
SHA256190017809de7e0cbb750c77913903f5bc5b6092aabc8a0f7835818e33e9d4043
SHA512a70ca3134923a18999fb031ea44d3b47d3b74763d4c5130dfe0e998930a517a487c70a9686d3fb0a3c2c02227cde6863b2df86e278735a4d175f537214154536
-
Filesize
6KB
MD5c6e26321de240dd55a73c5af834dc99b
SHA122ae207fababb980a9e390c8ffc28ba0ad2735ea
SHA25650d04bf7690ba01ecce871252d398151f827c55ab5a311112b6a372fbec7235b
SHA512b35460fac6ab75cb569ba5e368620b723b8cd0a28b9e8331243c2c1e9ecefe16878a86a3444ff12d9d3212d9636aaff6b15796466818cf886628a4df990f65ef
-
Filesize
6KB
MD50852d5b602ae378357d5c417a3f21620
SHA1020175f6c5af1231a4369d0cfcf1c111f5b80640
SHA2566b5b32e9b6eb7b02b574f297e2362660f59cc9d1bc5dfd0b967d9efcb0bace87
SHA512de2846f739f5b30a6bbe4f60097279692ff8bb1539ba19771a70cef59bd93029250c7207b902791360a1014cac0b56ce1625a57bf49e329046a8295cef8408bb
-
Filesize
11KB
MD520e4a0d3f8b24c97d7557c1dd43c78e5
SHA1bbd8771d2e761c84e0578de288a763ef2d2c4a5c
SHA2560492f55e8a4b9ae9bdab26633b80f016c5016eadda591734531e80d1c7826642
SHA51295e071c8a431c1bd74f29ab3acef8c0120a01b962ac4f3477d8f8684346bd9f5b46eeec10bb0dc8aa83299a04485e7715ebf2b0f0758bd4a1ab27967a3340165