Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
d14a60082497c144f0f5a0a9e15baf1e_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d14a60082497c144f0f5a0a9e15baf1e_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d14a60082497c144f0f5a0a9e15baf1e_JaffaCakes118.html
-
Size
219KB
-
MD5
d14a60082497c144f0f5a0a9e15baf1e
-
SHA1
710182908a68576591b790d10b8f9bdb29d8c4b2
-
SHA256
f8ec9a636558a738dc0a913d102b0857eac4205493f59515069688c4e10b4a3f
-
SHA512
d0035dca2e8a0e0c2f95c86b538e776a3f40e9ca28a5f3ce2a7808a6597fcba23539a6073a9e4f8318cbd8b3751fe60c16bb1502d3bd2b0374accea9507bf37b
-
SSDEEP
1536:Zi/LFDHGtsKMDNIz699qBVm0/9eR+8XZ5Jz/UF0swo11q2vEN:A/Lr9MAy+5AO2vEN
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1876 msedge.exe 1876 msedge.exe 2828 msedge.exe 2828 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2828 msedge.exe 2828 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2256 2828 msedge.exe 83 PID 2828 wrote to memory of 2256 2828 msedge.exe 83 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 4264 2828 msedge.exe 84 PID 2828 wrote to memory of 1876 2828 msedge.exe 85 PID 2828 wrote to memory of 1876 2828 msedge.exe 85 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86 PID 2828 wrote to memory of 4776 2828 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d14a60082497c144f0f5a0a9e15baf1e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffead0b46f8,0x7ffead0b4708,0x7ffead0b47182⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5578846997585806919,8515670526722921815,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,5578846997585806919,8515670526722921815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,5578846997585806919,8515670526722921815,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5578846997585806919,8515670526722921815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5578846997585806919,8515670526722921815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5578846997585806919,8515670526722921815,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5088 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4256
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
477B
MD544fa9f97c309ac9bf63ecb494b692052
SHA1b8b0ae92cd48644d9f75fa35982ab68fec987286
SHA256dec1a61bc21ba080748dbe4204419a99eeefad326498069028282f2b20874c7e
SHA5125db4375a72ed6c706248ccf14b47a4c7d805900b3528f4e77d5ec8c3e28f456879e05df7b0823fb132a855d55037c897eb268013c86d93673ec2071272b9a839
-
Filesize
5KB
MD5fad65603f6e5c26c61858f692650102b
SHA1025f4de614b6ea32ea52aa7b9a08cea7df0986b0
SHA256ec6bba5b564f17a207f9ce0ee2c130a88b8a2306e0e696bb5dd81686979267ee
SHA512d4a38f55b632aece14cba32a7504d3052442c06b3217cc4634db68082ae9fd21e5a7b8e5b76dd57dcaaa5364c285455beb7cd1baa016ef4529ea6e4662c3622d
-
Filesize
6KB
MD53ab58ca559176485d3aaeeac7565f303
SHA1e063cf0dc47c892587327a186eaeabfdce77034f
SHA256539b836ae9b24560107fcae0c06f98466e0ad9eeb3c0f16eafcf2fa6ab367507
SHA51240f7fd7c5dd9a6826da5ca7ca3f656e88feace25174e0dbeb7c476fc6f1348d72f7d27100a39b848c67f46e6bd10bb285086b721b3e0ad0078276910365c59c8
-
Filesize
10KB
MD5a9a467c72fb375ebe8f73bbd24ceec7d
SHA1e3b5cd6fc80442ce9f318548a43a43fe68b38d9b
SHA256105ebe3fb51601ae7b95a0db39f50f1cad475bf64b1789affd089bf088079d62
SHA512910e390637a28e4bedaa4dd62b314ba13950a7ee01ce404502d4c4700caff590c12437ea5994a0f867439868864784072ac55091a585d54957dd45678c4fab36