Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 03:26
Static task
static1
Behavioral task
behavioral1
Sample
08ead6c7fa92a0b8c73ee5dcf631e5f9_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
08ead6c7fa92a0b8c73ee5dcf631e5f9_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
08ead6c7fa92a0b8c73ee5dcf631e5f9_JaffaCakes118.html
-
Size
175KB
-
MD5
08ead6c7fa92a0b8c73ee5dcf631e5f9
-
SHA1
baef557fcd216b56b08e49771d8ffe87d7047fab
-
SHA256
733edb47729c88d2fd763e29431ad9dc2797604bf1bd031fa4b634025154e0a8
-
SHA512
07b92ded2705cba2c057fc0a10192caf97096ace09ba575b9eb349720fc29aeae768859f226a71d3a25dbc5428e73ff98bae5010bb0fc555849210ad58d7f12f
-
SSDEEP
1536:Sqt58hd8Wu8pI8Cd8hd8dQg0H//3oS38GNkFnYfBCJisa+aeTH+WK/Lf1/hmnVSV:SOoT38/F2BCJiUm
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1768 msedge.exe 1768 msedge.exe 228 msedge.exe 228 msedge.exe 5008 identity_helper.exe 5008 identity_helper.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 228 wrote to memory of 5012 228 msedge.exe 83 PID 228 wrote to memory of 5012 228 msedge.exe 83 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 2856 228 msedge.exe 84 PID 228 wrote to memory of 1768 228 msedge.exe 85 PID 228 wrote to memory of 1768 228 msedge.exe 85 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86 PID 228 wrote to memory of 3724 228 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\08ead6c7fa92a0b8c73ee5dcf631e5f9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8037d46f8,0x7ff8037d4708,0x7ff8037d47182⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:22⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:3412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3492 /prefetch:82⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3492 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:12⤵PID:3768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,669221948391346182,15858558060299242254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2812 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4160
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4836
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59dc60aef38e7832217e7fa02d6f0d9f6
SHA14f8539dc7d5739b36fe976a932338f459d066db6
SHA2568a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32
SHA51218371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7
-
Filesize
152B
MD57ac03b15b68af2d5cb5c8063057cc83e
SHA19b2d4db737f57322ff5c4bbddd765b3177f930ab
SHA256b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700
SHA512a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize336B
MD57421305323204cd680aaecd9b1ba28a1
SHA1776d0afce636521f3ee9b8ee80ba8444f7536717
SHA2569c6cf62de2d1b7b8d8523c6b2416999b3aadcfd51f8b3a9f54cc752396b13c5c
SHA512a9c7360b845bf556498d0684c3c824ab39c92373b6a64e7088767f647d8c9d4b64b3ee70fce897f7969018717d320cbba106a98b856387859844dce3621aed84
-
Filesize
2KB
MD58888f5b3336e106b932b5cb564b4aded
SHA14c650931d2646f2858a995dd7589c3913fbca8b8
SHA2563c7924cd216105a7e175f3f429f2914424f5bd1a500aa87ee1c8439fc2bc2caa
SHA5122c82147d54cf87630380e9b50f6597e3b6155fd2af9b02edf57f51633e718af25e3c4a485bf8b883f4049661253d263f0ec308f9a7b9b9de036a0da74c3ca2d6
-
Filesize
2KB
MD56ae3c2f4c14913d56f34843e6cf189cd
SHA1b4962025a776e07f9231705ae98f9f703f353312
SHA25624b712cfac811ef06f7ce26c7ed830a8f6974bc7f8b37e715e1e6c87f31f77ab
SHA5127c0df2634d79a90b096e7cc81c8fd0b2b37cd4503b27e7d489fdd6dc4fa2d4d10055f53a259f3803accf3b9d0c60d8121b52afa74fb224f3d57025294c5452f0
-
Filesize
7KB
MD5c0ec78643a37297cfa94ef8a62ec4b63
SHA1aad3f83422f6397d9655c728264af7f2ef6523e3
SHA256a70a0d94b403d8feeb5be27583633a0ed813ebc04e3c299f8dd27c7ce0c9da82
SHA512b295c93fda70820bdf866a349e7c804eac13057d60581c58874a3ef80004b6a9678a29c9689528b6f0204864c204a89fb3517ea1ceff6305b0f4fd587a473910
-
Filesize
6KB
MD5d08f949211184e71ed774945e3a2de76
SHA1f9a22713b7eadc4b3729404c687442994b43e4d7
SHA25653b772cd622608a378039b75b22cb2ff325abe0b76e8d51c53514439431a6e28
SHA512a09b05d8021894315e14e92b8990082ebd71cd74f898dbdb51bbb3a238217cfb748d6c6267c8dfc556f1f778cdaa08a02c4f240178e5268dcf20b95d69f8e463
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5791461f709446c3bf4ebceeb79326c05
SHA1a06f943265dc82244bed5680fc9e2d4297533028
SHA2566bbf8239683ae99228018e4728a747db4f606f2fa2894ac040a576123a1fa43e
SHA5121f6b0f9603e4a9aed9ff763ffb6d0b085beb764bc979b5445a7c2df2a2a981194bc19a4fe1bc125e5568da80bb0f3cb798c08d80ff75735eaed744f394fd74ed