Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 04:13
Static task
static1
Behavioral task
behavioral1
Sample
3861708639ab188f7dc1c4e97083b9ea_JaffaCakes118.html
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3861708639ab188f7dc1c4e97083b9ea_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
3861708639ab188f7dc1c4e97083b9ea_JaffaCakes118.html
-
Size
47KB
-
MD5
3861708639ab188f7dc1c4e97083b9ea
-
SHA1
87d07d14010845d80e34f86307d021d0e2db9e18
-
SHA256
8220d396536614845782a84d6ec1112052ac10d86d03394193a69f897a7f737f
-
SHA512
2c5252a6397e7fd5ffd9401c74960a4b78e2dbb171be3680d668ef3f110ccbc04ac54d2988799009091433fc6448ccd91bcb99b39477bb1ab383b1f0c62b3c1f
-
SSDEEP
768:Sv8yiftpimEp/amyxc+lMQWJNHbAbvbEFB6uhPPp/oSVOID5jCYZ2Z1Ykk2WLbyV:wxQWJhRPPp/oSVKYZoWLU7
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3876 msedge.exe 3876 msedge.exe 2108 msedge.exe 2108 msedge.exe 4816 identity_helper.exe 4816 identity_helper.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe 2284 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2780 2108 msedge.exe 83 PID 2108 wrote to memory of 2780 2108 msedge.exe 83 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 548 2108 msedge.exe 84 PID 2108 wrote to memory of 3876 2108 msedge.exe 85 PID 2108 wrote to memory of 3876 2108 msedge.exe 85 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86 PID 2108 wrote to memory of 4676 2108 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3861708639ab188f7dc1c4e97083b9ea_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd22fd46f8,0x7ffd22fd4708,0x7ffd22fd47182⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6447317106244377946,5985160718403010808,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5288 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2284
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1608
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\012e6d91-12eb-457c-81de-86fed00a6e1c.tmp
Filesize6KB
MD550e1e9a1dafd554e54d2b19b7ff01730
SHA1bb9d67e39ba40cb6b83169af1af970c2c8443450
SHA2562784fb701fcb55ff3d0b0b1d2d448fcc65e2c643a40f8f87b1ae9b4e686fd5c7
SHA5127c8fc6f09ee94fa14bd6dba6f644a26f3da294d9b24df6c8f71ac37cb2302bca476569bb14f700574256cc8d1d3fb4c5c9398851a83f47e169c372e886e85ac4
-
Filesize
6KB
MD52ce5ef14aac34faadaf9ffd65aa29fe2
SHA136f659d9d8f9ba3fc90cfe5b5d7c64e2012912cb
SHA25603b218485d505903f8a59f93073634cef4584bbc5f364692b0bbafd239aaf007
SHA51249f217c67667655652d414a836a8feaaa1c24173b42c304cd090d3ea0b0bdd8d7af2ef50ffa4914e3692d94171f2e9ad6c23a978fd9eec2dc2256adfaf6d70b7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5fa2d0727f37ba05f560ed4b442d8a086
SHA11d222f2fd4d16e61d510d0648facf604a10ef569
SHA256e2bb6f6f0e109a23cf8d0749b0df75b54ea07eac0604b51d739a3eb3f38afbd3
SHA512a822e5f904e2e7f52a000b1d5a778c05efc889dbcc944700442810ecbc05096fed0e201de63ad13082660d21d957d4e64f59c4a37bb0042eb82da861f90ce314