Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 09:17
Static task
static1
Behavioral task
behavioral1
Sample
cfadaf589e534d48bc23051e4fa2225c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cfadaf589e534d48bc23051e4fa2225c_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
cfadaf589e534d48bc23051e4fa2225c_JaffaCakes118.html
-
Size
268KB
-
MD5
cfadaf589e534d48bc23051e4fa2225c
-
SHA1
53c8ec7704e936c1939fcc17ad46791b88e1de4c
-
SHA256
40982a4c76b13e79f81ec559fd158ddba668670be9b11e46504e67e1ee39192c
-
SHA512
901b18421a134169f17e1984fbea4b567567cd7e603eacf501c90d6944de9c5eee1a414c01285d071a8eec71a45f2939529c11f389dc9b8be08fb3c1fa2bac11
-
SSDEEP
3072:mp1+cI6uZEsqim0d4XvoWXQ47GK11OvBAuKWdvFn7ySCiTnDtHo/ZocvDWseUy0f:sIvEsqjXwOQ47GK11mBB2StM
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4244 msedge.exe 4244 msedge.exe 1520 msedge.exe 1520 msedge.exe 2996 identity_helper.exe 2996 identity_helper.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe 2044 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1672 1520 msedge.exe 85 PID 1520 wrote to memory of 1672 1520 msedge.exe 85 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 1704 1520 msedge.exe 86 PID 1520 wrote to memory of 4244 1520 msedge.exe 87 PID 1520 wrote to memory of 4244 1520 msedge.exe 87 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88 PID 1520 wrote to memory of 3264 1520 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cfadaf589e534d48bc23051e4fa2225c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd655c46f8,0x7ffd655c4708,0x7ffd655c47182⤵PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:12⤵PID:64
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:82⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵PID:804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:12⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4718547634063067827,14140254677900154164,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1696
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e494d16e4b331d7fc483b3ae3b2e0973
SHA1d13ca61b6404902b716f7b02f0070dec7f36edbf
SHA256a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165
SHA512016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737
-
Filesize
152B
MD50764f5481d3c05f5d391a36463484b49
SHA12c96194f04e768ac9d7134bc242808e4d8aeb149
SHA256cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3
SHA512a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5c58995716d66ea25af3beac04372289a
SHA1d926a35178d01e739c37fb061b05c56bf03790c4
SHA256ebea134a72b0bc47621e287774ccab79b8ce3a596ac1ffe9da17ea18c78dda5d
SHA512ea519c8223ce1f7a1cd1288a893ba54c6a1d9496a77eed08410d5104bb8e902b8191b980628643b8f997fd461526394aac7b3efa6113ed4c0bbb34df032ca581
-
Filesize
2KB
MD5a611a71c2bcd9ea6dfb57cb4469d373d
SHA1fbd7bf9ad9c9f8878e094217008e4c91e517dedc
SHA25640dc86a67f3ca5a8526f3194fd5b9f7d719f0c7569421e59ea091cd297ed99c8
SHA51250baf11137bdba056608a29891b3569c28b9ea3b5a787db4c21f34182536cf02124c7f759343cc215590bdfd468b3f4e0ded9b38ef913be5f348ab2e79e1db46
-
Filesize
6KB
MD560a9161bdab373ee3cb72a48e4d6d359
SHA16de8fdad28943aabfb06e5ca369d7e8b1b89d4de
SHA256d8ae035716c4cf108545a40872e58ef9dcc413b5e304936bf5f588f84f530e46
SHA512fb5c898b211a2aa4a16ae50d54df685ab78ee8311857bf8484960285b70096288492b1351ae2184391b0c3c6eb5a2d119fd1edf569766668a01f615eb56cfc9e
-
Filesize
6KB
MD5d1f46046725cad329a9d24640645b045
SHA1cc56c12c0c3587eaff9224a13e2b089ae33da8ed
SHA256730cccbd53f4d738e468d8dc46fc3d5d2e99654bf6b0dc2c61be0379f46a5912
SHA5122588833e707ee1fed99f84fbe456b6d6d76357f7275eaff7c1bd44ac0a9c18ade74dd4a8a5532ee281f2ec5e2779aab4bb751311e266ada90baa390477e021e7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD536d781f3a8e064df1672bb0a5ec893d7
SHA13cf9c999dbbb71a2a7eef09ab542e00e33dd8d3a
SHA256d9b3af3ce50550cc15ce65a6029d8a3745028414b555453f5ef2ce6b3c4c9c83
SHA51298ee5e0a935dc655bcd5cc9516f7ca13d4a4c4b5f2cb076f6c2805f743a40013c4d810abea06ce69a6b14eafaf43e26af34f01ea566ed664352e72a6a6138891