Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
29ce45e97190593b2867db6050abc9b2_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
29ce45e97190593b2867db6050abc9b2_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
29ce45e97190593b2867db6050abc9b2_JaffaCakes118.html
-
Size
214KB
-
MD5
29ce45e97190593b2867db6050abc9b2
-
SHA1
4bc4d4be09805aa9383b0258f2be3b4f96cb21b6
-
SHA256
0658f22c051db13834ac8963ad34440c00747a941ce5f04da9c6eed39e8f715b
-
SHA512
f13e2c86f34dab2ea4d1ed19957d3302d843fee488835c68729e5c3f0839788e6fa5b82badd24c1f9b5aa3077dc29ecc2333a35fe5919314cb362740be1b87cc
-
SSDEEP
3072:drhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ5:hz9VxLY7iAVLTBQJl5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1636 msedge.exe 1636 msedge.exe 368 msedge.exe 368 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 368 msedge.exe 368 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 368 wrote to memory of 4460 368 msedge.exe 83 PID 368 wrote to memory of 4460 368 msedge.exe 83 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 116 368 msedge.exe 84 PID 368 wrote to memory of 1636 368 msedge.exe 85 PID 368 wrote to memory of 1636 368 msedge.exe 85 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86 PID 368 wrote to memory of 3704 368 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\29ce45e97190593b2867db6050abc9b2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff998cb46f8,0x7ff998cb4708,0x7ff998cb47182⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,15598719668175151983,12472747017847367318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:22⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,15598719668175151983,12472747017847367318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,15598719668175151983,12472747017847367318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15598719668175151983,12472747017847367318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15598719668175151983,12472747017847367318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,15598719668175151983,12472747017847367318,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1308 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3720
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1960
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
6KB
MD59da7c729d39839138257f464c12202fe
SHA1ca8baf6b105cca6a1635b0c35629462fca7f4360
SHA256f3ac97607f5b5290f73e4b60fb3a9f000d8252ff465b0e6c84cf5393489b49e1
SHA512f7a351436e954abf722a7f009a0ad2a36a0980fb92d51d44300e3957d8d581cd570c6b2f5f1b40d2796599e9339d1324943a52764d2935cb0a1bc972b39499a5
-
Filesize
6KB
MD5abbe8a97104c41481d375e01eceeb8b9
SHA1d9a47519d1dabd843ac0c0c34ec99f919bf39cb6
SHA2561e7eeca6b4a96617e6fb7e42e1061cf11bac9836bfdf3df628483fd097b69540
SHA512eae731f607ed8d510f5ecdabc978e4fc96ebf7dd9cc3dbed2bb5dc012ed8ddb4ead6f961dbecc026818d52819036b83208622e85198a212d470fd39c97170865
-
Filesize
10KB
MD5b528cb362e9d6bca1236b1765741b14b
SHA18b2f5ff5d65ee7b87e1fb15d9855bf54ac204328
SHA25639aef533100f5e08d76e22e1216204dc22bfea482eb157511aea9874fd300620
SHA5128152d9bf1e4e17956a47acc63660c803e29176821d8f2a4098d9dda2e2272d27ff41c8c631f8eb21ed385550665f03c2823efa360caecdb8742b36618623e231