Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
fd077aaa7420d4dc930db76a0e046fd6_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd077aaa7420d4dc930db76a0e046fd6_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fd077aaa7420d4dc930db76a0e046fd6_JaffaCakes118.html
-
Size
125KB
-
MD5
fd077aaa7420d4dc930db76a0e046fd6
-
SHA1
f8f82d48774d8fc7c53d02f7cdda6bbcfee390c9
-
SHA256
27ea7ee15fab4b76161cd875e3666ef5b3bd6046711299ff696ec79aa2663e54
-
SHA512
1e78aa8aa39bf9030804d77f2c7f23fdb886e0f184c149cb9530f9e5e8ffb050058175fb3cb4588027eb7b8f8b9b9660029132fb69982cba7c4926987d95df0b
-
SSDEEP
3072:cpntYHyGrHJGuH+GPHdG9HAG+HDGpHTG7H7G+HTGyHTGoHoGrHkGsHpGnHYGoHRe:cjYHyGrHJGuH+GPHdG9HAG+HDGpHTG7/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 640 msedge.exe 640 msedge.exe 916 msedge.exe 916 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 916 msedge.exe 916 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe 916 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 916 wrote to memory of 2796 916 msedge.exe 82 PID 916 wrote to memory of 2796 916 msedge.exe 82 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 1140 916 msedge.exe 83 PID 916 wrote to memory of 640 916 msedge.exe 84 PID 916 wrote to memory of 640 916 msedge.exe 84 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85 PID 916 wrote to memory of 2656 916 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fd077aaa7420d4dc930db76a0e046fd6_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb70f746f8,0x7ffb70f74708,0x7ffb70f747182⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,5209648281708973432,4696156959643419771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,5209648281708973432,4696156959643419771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,5209648281708973432,4696156959643419771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:82⤵PID:2656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5209648281708973432,4696156959643419771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:3508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,5209648281708973432,4696156959643419771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,5209648281708973432,4696156959643419771,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2720 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1232
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3064
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD549571afc7d1574b197a7b241aa972e09
SHA1d2a2324ae1782b1d55c5679da706c58b2d65f944
SHA25688e92bbea34b039f5652057e17740be6e8664d198c5c00d91b53dbaa1e80fe01
SHA512464f829bc49411250b5ef0c5d04267e9239256887d324689ae046521a9736674dcbc48b25acef6f08f870bb0b74ecf36dd25b22fdac1825ba7e9432ad7d0da50
-
Filesize
6KB
MD5ff0e787361f3545bc52709f14856bf0d
SHA1e22ad270d5cbb141504dd492009f0ffaebf280a7
SHA2561ecb8cef179cc820b37888defe9e707b99c855ae152457944872bbb9d41439f4
SHA5129d4b135b9bc49b01de4f6185094b617604aee69a6c5f4df9b6767e58ffd744c033a8d2f7e8c290220a53ba0bd19e2d2420b13cf4a8ac82bc32a9112ef5972cc1
-
Filesize
10KB
MD578691b190b5c0538c3af01e2d2c5a265
SHA1668b83a27edb2bf458304dbc8eea4c3244a6c58b
SHA256117104a66fdbe1dfd34fc68aba9510ae927e1a90adb252042106b0f65b1b352d
SHA512980d7629b47e9976d51e7d3c93c6eb379390d37c71f7b45d4dccc0edaafbb4caceb275be01dc8fb17eaa833b8f01df44c7b8fedf1c0cfcec794a2fe0d411b286