Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2024, 03:14
Static task
static1
Behavioral task
behavioral1
Sample
98dfa0186c8b62625e42e046a955ab80_JaffaCakes118.html
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
98dfa0186c8b62625e42e046a955ab80_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
98dfa0186c8b62625e42e046a955ab80_JaffaCakes118.html
-
Size
88KB
-
MD5
98dfa0186c8b62625e42e046a955ab80
-
SHA1
b8a7f482fa08b45c4e86fc90330b3e676b033cf8
-
SHA256
73a425e4537e71a2eed7f7c2e29cc067a977e11417bef6e7d8a5fbd99c10ebd5
-
SHA512
cd7051c245e1ffd071ffe49793200f136f18ea7a4078403676b8aa09d65824edcf8c26e551ae7500ebdce7af22e26fa52067e21c70eb4082877c3f07053639f5
-
SSDEEP
384:S0p9uEbkOTxje3hYzcYlbzKTM72gxvlB1OiYX77dcfvFMBROiYXcglBhvLXX/HB9:S0p9u+T1yzw23Yn6r441pEjT0KP14b+t
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4456 msedge.exe 4456 msedge.exe 464 msedge.exe 464 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 464 msedge.exe 464 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 464 wrote to memory of 2096 464 msedge.exe 83 PID 464 wrote to memory of 2096 464 msedge.exe 83 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4256 464 msedge.exe 84 PID 464 wrote to memory of 4456 464 msedge.exe 85 PID 464 wrote to memory of 4456 464 msedge.exe 85 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86 PID 464 wrote to memory of 3012 464 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\98dfa0186c8b62625e42e046a955ab80_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe72d046f8,0x7ffe72d04708,0x7ffe72d047182⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5153440819709190690,7076464278759787038,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5153440819709190690,7076464278759787038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5153440819709190690,7076464278759787038,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:3012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5153440819709190690,7076464278759787038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5153440819709190690,7076464278759787038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5153440819709190690,7076464278759787038,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1012 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4380
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1856
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD599afa4934d1e3c56bbce114b356e8a99
SHA13f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA25608e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA51276686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
-
Filesize
152B
MD5443a627d539ca4eab732bad0cbe7332b
SHA186b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA2561e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d07bf65-a6a1-4091-ba3b-021a7a025640.tmp
Filesize5KB
MD52bd20b4aa8f661425d4c38578996c9e3
SHA1adbeade8a046bd6d49d8dcb979fda3a45d2e55b2
SHA25617073a53190d250cb85fe4ece74d79c8cc2c03644b38f6426fdd27c0a8ba2c10
SHA5123baa6566fc69387674464daa87edfac0dd295c7ed1c9826ae74020a68758265c87e3298714e5f0776d567a8f10702385efdc729b33187614337b3435c8736d27
-
Filesize
683B
MD5faf8960b1dae60f77bde2267cad80092
SHA144bc984655422f13fd3d7b54eb2c30211c9199ac
SHA2564680ee38e410bd3fa234c348e86b5287b95a2975197b6da7b944ab3ec77e65e9
SHA51262dd7bbd21353697123afde6480e2d0987625f311941f0fcb3c92f8b9298f32363853063b1d872c132bcdec1cd7e157f87da4075c7ef75581b62f921dea39a26
-
Filesize
6KB
MD5214a5476ef15ef5b220d9b6fcb60e94f
SHA15374f7ebf296d9495627f78487bc2fbc82372668
SHA25648158d2f4ddb6cc28a5f628b1f84b03b5c013de9898a53b5411be56cdaa939e5
SHA51235e6bb90d67e821ce3667253f37afea45e7ced071d301edaa46751fb2fd359ccd0abe20f4b1c672fff8cfc6f3938b6eef033da3c6af68eeabc7a09ebd827aeee
-
Filesize
10KB
MD5bf7edfde3f0ec5b34f6e1e123f0412cf
SHA125bb4f8419d521dba419abb3bae283ebb360e4ba
SHA256298d6ef4eccfa1a41d662e22e484008bf06f182f46964e55c7445427876a6a1a
SHA512b5e7885d3318625636871471be6bc520ce352528340bffbf63a49e29ab74e5a5b578a46cd148fdebc5f263eee001ac453dbb2f528355d5ceff59c83ca2731a2e