Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
da42e4a54ad04940b8a1435b48be5b01_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
da42e4a54ad04940b8a1435b48be5b01_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
da42e4a54ad04940b8a1435b48be5b01_JaffaCakes118.html
-
Size
20KB
-
MD5
da42e4a54ad04940b8a1435b48be5b01
-
SHA1
8d6007f72d9467b3d800a524d076c9bf4ac6a47a
-
SHA256
8c8a14aa67ec6bca40a744a76c3818efa4b500eb709afbdc8d40ba343da6cb89
-
SHA512
b32ce421524e9c8f637a3dbe5b471a276007ea445ffa743a2035096658872cb4eb9f3fd25ce89462c489362409e14ae95540a0d9849f6c3913c212f9e94db597
-
SSDEEP
384:Q2p1O2vzjLMTpNX9COCunWuwQKiKkRK4McQ35LyGuN6hii0apWW8u88Cp:71Ogz/+jX9COCneldDwLySihxRp
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4756 msedge.exe 4756 msedge.exe 412 msedge.exe 412 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 412 msedge.exe 412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 2796 412 msedge.exe 83 PID 412 wrote to memory of 2796 412 msedge.exe 83 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 1160 412 msedge.exe 84 PID 412 wrote to memory of 4756 412 msedge.exe 85 PID 412 wrote to memory of 4756 412 msedge.exe 85 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86 PID 412 wrote to memory of 2532 412 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\da42e4a54ad04940b8a1435b48be5b01_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffee3946f8,0x7fffee394708,0x7fffee3947182⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,9541619460695296293,2106393105294643309,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:1160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,9541619460695296293,2106393105294643309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,9541619460695296293,2106393105294643309,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:2532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,9541619460695296293,2106393105294643309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,9541619460695296293,2106393105294643309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,9541619460695296293,2106393105294643309,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4732 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3136
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
6KB
MD56b1791098fb6d46d147b1347b5a2411c
SHA1868658719eb7640dc3e0a64eb3948bfda4b027b6
SHA2564bc0ffaae1947e57d9588e52083f1aa31d6755e8c9259aac08380f9186b118de
SHA512201f74362df7349865a6f3f2351f6bc5601e2b795f677db6663b721ea47948fb786a058597d4d2cba588964a687d1dd6d6a428f9f838f7ea1653eb3d5a956052
-
Filesize
5KB
MD530c0468a6341c664b9869253ef2e1ae3
SHA17f1203c7fea750c1c60ed36f394cef72e4f22057
SHA2566d4c610f0f442ded461a59170a08e33203120d9e8526f68f0b3501516d9a65cd
SHA5125960310919e5f3d5a17b66f0897db69e333b8a7b878ab0b17d2ae05d2a0f288600a8fe894dff7e346029120e08ad278a1d4eac1a80b73d02861766a86909de6a
-
Filesize
10KB
MD5a958d933f26e9a938b040fbbef22b980
SHA1c165a8075322e5075d0fc4c3d8929006c0d538b5
SHA25668279976f3b427061f4cd2bd84256ebe5078311634d07d263fc0b20fddb4405d
SHA5127de18bdf593f20ea9ef9574018fc8cda09dd614baded8e2bac6db45cc5d42be9db471c6938acb70232cecdc434e9efc84085790e6522267f473b3320270e520c