Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 00:42
Static task
static1
Behavioral task
behavioral1
Sample
fd77db7a096be9a795a87652fec6ec5a_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd77db7a096be9a795a87652fec6ec5a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fd77db7a096be9a795a87652fec6ec5a_JaffaCakes118.html
-
Size
241KB
-
MD5
fd77db7a096be9a795a87652fec6ec5a
-
SHA1
2d854db5ead19a1a99d228617640badd80a0288b
-
SHA256
7099a7f024a4318c7fbede8574cf049185dd3f66264f8c3f22c3e7a37a74f69e
-
SHA512
14a1e00be4fbe7885b1935609abb324bac4ef2d7b5f116ba9600cb7570763493af0491c22fd6b148f65be601f03a538778332c475592c77d8ae755bf1ef80769
-
SSDEEP
6144:mM2V0pUcfRaNrXTPmFtcnepIrychZuTd2U3uiOMdmgczZ2HIwhkjqOmBSw/Z1Pe8:aCke
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1504 msedge.exe 1504 msedge.exe 3016 msedge.exe 3016 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3016 msedge.exe 3016 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 1872 3016 msedge.exe 82 PID 3016 wrote to memory of 1872 3016 msedge.exe 82 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 2024 3016 msedge.exe 83 PID 3016 wrote to memory of 1504 3016 msedge.exe 84 PID 3016 wrote to memory of 1504 3016 msedge.exe 84 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85 PID 3016 wrote to memory of 4008 3016 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fd77db7a096be9a795a87652fec6ec5a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffa2f8c46f8,0x7ffa2f8c4708,0x7ffa2f8c47182⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3058605152479864176,4099502808689327929,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3058605152479864176,4099502808689327929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3058605152479864176,4099502808689327929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:82⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3058605152479864176,4099502808689327929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3058605152479864176,4099502808689327929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:1268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3058605152479864176,4099502808689327929,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2608
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2240
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
Filesize
191B
MD5737fae5dc1f150d4cb38f981a0bec95d
SHA19a9f185d46ec72737eb339c716cebcb772846c8a
SHA2568beb45e7f248d61f56d86135a14dfe1bcff93eb70b647664787f2fd0b8e10295
SHA51215b09a2f1fb115f68a82bf2993306e6b9e44ce25336dbfe891500c40c02c7ea511a3fef3792b1f271800da832cf084ad99aaba097f57b53ad5a505306dc724c1
-
Filesize
5KB
MD5611d021f823eaef122f49a6d21401d39
SHA146b40bcad38e04b5e2faf3c067217f49606f2a8c
SHA256defe968ef08637f752ab4d3818c349e40bf99bf827d6560c855184869e787df8
SHA512005bc2a5d152e18246894954289a5242cb747a845ac0abda1b87e40e237ee7931060d047b79135b31a480ee8b148baf42905b40599fa45c6d665c88aafe57443
-
Filesize
6KB
MD50d8ea81ceeb3b3f90e7d804827f30a8b
SHA18d64d233255ae2314780ddf0275bb17650a6d09d
SHA256790b84630d468980b9058bed8edc6d79796fd7204518dfc39b74b13b93f468d5
SHA51234c10aa33a987ab154fa29546ba0d62927fdd0939fb39c20d3fbe3d68a3b57f4bb195faee5d9576a5c8d318fb6458d5b19d7ffc5bc4115440a98227a4cf1fe03
-
Filesize
10KB
MD5b15eca75a0245129a3b734cb7f7c309a
SHA1624cc6e7b91eec68e3e6b30499898a8b5148bc38
SHA256ffef2c9c10910e00ccea540d7262966a8d1998628c0b68f7d9f1c9f47ab31338
SHA5123ace1462ab9269038f0eae2680f3e3f3f782c9a43e81f6113377283ab32fbbddac13f2101cbd5e4a6cade72a1091b6b0c47d883476f80262e5df309288010453