Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 02:09
Static task
static1
Behavioral task
behavioral1
Sample
fd97e9de8624e9940c9f48b9ed130d45_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd97e9de8624e9940c9f48b9ed130d45_JaffaCakes118.html
Resource
win10v2004-20240910-en
General
-
Target
fd97e9de8624e9940c9f48b9ed130d45_JaffaCakes118.html
-
Size
19KB
-
MD5
fd97e9de8624e9940c9f48b9ed130d45
-
SHA1
79a4acc0c5c352bbe4c4515469e3329682ceec7d
-
SHA256
2587c279db00a0205e95cc5c7b89e887a64a1f16edabf7277f8e04d7446101d8
-
SHA512
6c5b432b066875fe8a766e9adfbe9dfe9abc90309391ebfc935dee8d2a7dada9a7c6d4182943a1bd80dbebaa9b0581d63e950fbf0361daacf76f9bab899d9640
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAIm4yzUnjBhWo82qDB8:SIMd0I5nvHRsvW7xDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 184 msedge.exe 184 msedge.exe 2420 msedge.exe 2420 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2420 msedge.exe 2420 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe 2420 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2896 2420 msedge.exe 86 PID 2420 wrote to memory of 2896 2420 msedge.exe 86 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 1840 2420 msedge.exe 87 PID 2420 wrote to memory of 184 2420 msedge.exe 88 PID 2420 wrote to memory of 184 2420 msedge.exe 88 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89 PID 2420 wrote to memory of 216 2420 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fd97e9de8624e9940c9f48b9ed130d45_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc84f46f8,0x7fffc84f4708,0x7fffc84f47182⤵PID:2896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1444
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4876
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57006aacd11b992cd29fca21e619e86ea
SHA1f224b726a114d4c73d7379236739d5fbb8e7f7b7
SHA2563c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814
SHA5126de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d
-
Filesize
152B
MD5b80cf20d9e8cf6a579981bfaab1bdce2
SHA1171a886be3a882bd04206295ce7f1db5b8b7035e
SHA25610d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1
SHA5120233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a
-
Filesize
5KB
MD50860b558457faf189b2942e27463fb89
SHA178e08e2edf64eadb8d1e3829fa05bffab27b22ca
SHA256cfdde09ddefb27b56e1883787c129457436d42ca28095ab6792cba7e635d07ae
SHA51253746a5f854588d150fe1ba31d31c37d8eec935fb52547616488a0f1d30c80e730f25d4f5b8e47971d6718afaf0c8e966ddcf5e4014c5917a25c87b5330d1932
-
Filesize
6KB
MD5ec9d2408d64cc16347fda0d76938adf2
SHA1534b744a8a7df961b49013a2ca8c74c6ba03462e
SHA256814ed0ed48e0c6c73f29124982074c2079cdb653bae08892eb2ed891273642ea
SHA512c5df70cd2e64c304171822bcb0a93e7cf05922bc3ff72a70124a2b0f47baec0d20c1dd5898cd8d62b46563f37bb10fe3741159e2e1e4ed338b6ec4db783c433b
-
Filesize
6KB
MD5b4a9b06f01261bfb35baa20c904d2cd8
SHA1852f6417a96617d9534667d440d28937ea25afea
SHA2563b4053b03a99273f118656209bb5869d5243f582e58ab7eafcf96e2517cd654c
SHA5121b89e0c0e3c38a5ce7f92f2482c1c09b2a736f33e0c14155469fbcdda6ca114568ad54815e34c7649bf9b51b15250ec8788673f72a94f40588be9af7126c1646
-
Filesize
10KB
MD5b8c9bef07e701f1a41be5abe64339eea
SHA14f5a3b44ee6dbe1613245c545bdfb1c3ee23ff2c
SHA256bddce874c4a45c70372acf63bd7cd516ff5dbee57814f48226e48827f44f07d8
SHA512f7921d5ccccdf7deaffb1a43cdcab331e265d97590491261b8c1f43a46eb0f684d22f5ab5d087ab7e1f361b58ab966d1016907bae2d6d1baf99168717c41e387