Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 22:55
Static task
static1
Behavioral task
behavioral1
Sample
d73a29afab6e482cd3a0daef0f600a82_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d73a29afab6e482cd3a0daef0f600a82_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d73a29afab6e482cd3a0daef0f600a82_JaffaCakes118.html
-
Size
10KB
-
MD5
d73a29afab6e482cd3a0daef0f600a82
-
SHA1
569b32093e244ae9a45233a523c8052fcff5246b
-
SHA256
43e35c6dbc1d0c6550fe52a1382d700ea633b87721257fc2dc17cbef492f1c33
-
SHA512
f9454b1fc0f041491e2f2d6244d6a6b2e08794ac6423d58b50a01b4d8633d0662c0134949f5507b733e4e7539b9da1d4e0c2932abaae9d39da951e2bf9ab8e0d
-
SSDEEP
192:TzGicp1WoY4xXyhdd3ua97sxRk9T/kI00F0Et02AaO:TZcpxYhddT/9T/F0K0EtK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2472 msedge.exe 2472 msedge.exe 840 msedge.exe 840 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 840 msedge.exe 840 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe 840 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 840 wrote to memory of 1400 840 msedge.exe 83 PID 840 wrote to memory of 1400 840 msedge.exe 83 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 4896 840 msedge.exe 84 PID 840 wrote to memory of 2472 840 msedge.exe 85 PID 840 wrote to memory of 2472 840 msedge.exe 85 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86 PID 840 wrote to memory of 2908 840 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d73a29afab6e482cd3a0daef0f600a82_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffdef2a46f8,0x7ffdef2a4708,0x7ffdef2a47182⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17268015260101578208,14666997772444371593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17268015260101578208,14666997772444371593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17268015260101578208,14666997772444371593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:82⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17268015260101578208,14666997772444371593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17268015260101578208,14666997772444371593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17268015260101578208,14666997772444371593,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1152
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
6KB
MD5267a911bb580016b0ec67ec4779ffcda
SHA183f8ef79d3073cb9cce5e6158ce97307f4a8e2e9
SHA256c1b483bd5422e3aa27f87f7d894dcc263a7455948467f80889b240fafa422dca
SHA5129c01fb622e8b96f08dc07e78bb68c69d315a64dfd842f6d09b4e1879678b305a84d14a57c9bcb18da04626067d4fb450764611d849aa51f9ba20373afaad6a1a
-
Filesize
5KB
MD5e270c4f8f91087449e4d49ec0c3da6e9
SHA19b890a69a8873bbe2e3466574eabe093bd7f20e2
SHA25664caf63a4611b017369cc821829d607f88269ae3db69e7376d5ae4220a00c5f5
SHA512655e46d7b1206aa5c57277f46ba5d83b0124b713968a5dbc1ea8f8099f46aea86418770e5b9d5f216bc85ea80cffd5044c234f394f2d3028f749ff07e0c817ac
-
Filesize
6KB
MD585bbf8c0b8ece908025e52736794ace8
SHA1d6a0d61e1f237e266f97c870b203fb0c8fa8b785
SHA2561dc545147bc31dac0b9e54ebb7a67b64d3791c95c1d25971cc52363dc0fc4de8
SHA5127448988e0b30cf82e884bb91f657a2211a271f0d8037ed366e51592f46df046a8631568bd6cedd35a808ab330e77c61963ecc6fe4faa01cec98ad04c824b7bbe
-
Filesize
10KB
MD51890d034fda06981b734886294602f10
SHA1c72a1cf401ee3aef6ca2e3df9bf49301b42b6394
SHA25644c1a251974699ae1319376ee8d497d01ab9ae0cfa8e18254f7f1f42354ab998
SHA512ab44a787fb13a6e532f41e73d75d05a99df881ec92a3a87e1e7102373ea1c3ba4cc69615dd1aad5c95ecc41c94d484f0935b9ecb6a88d6d2058e8585a0a9f655