Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 13:29
Static task
static1
Behavioral task
behavioral1
Sample
12f111cb8b026d1c1faee0a7732a106f_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
12f111cb8b026d1c1faee0a7732a106f_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
12f111cb8b026d1c1faee0a7732a106f_JaffaCakes118.html
-
Size
147KB
-
MD5
12f111cb8b026d1c1faee0a7732a106f
-
SHA1
8c1999d96250a6539248305d64e0b7308f28db82
-
SHA256
0e89f92e5ce02d3753086418e3de69f96c966aed7683a94a1bd0138a91195a4c
-
SHA512
7cfacc60cd4793afd2d8c212da413c9be08c71aa9787468876c9daa5233f3a986e31087bd4b702612699f9b9280f1aae095d764ff63e3f86238689a11d1f2b66
-
SSDEEP
3072:bLASZ3V2UP13G4k5QhLpOatVR+UFk0NH/fNbYaaLStRXcxWUu/v66sbsGon4G59w:nVV3G4k5QhL8atVAyNffNbYaaLStRsxJ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 704 msedge.exe 704 msedge.exe 4460 msedge.exe 4460 msedge.exe 432 msedge.exe 432 msedge.exe 432 msedge.exe 432 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 4424 4460 msedge.exe 83 PID 4460 wrote to memory of 4424 4460 msedge.exe 83 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 1016 4460 msedge.exe 84 PID 4460 wrote to memory of 704 4460 msedge.exe 85 PID 4460 wrote to memory of 704 4460 msedge.exe 85 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86 PID 4460 wrote to memory of 2988 4460 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\12f111cb8b026d1c1faee0a7732a106f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef94246f8,0x7ffef9424708,0x7ffef94247182⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7412829581680598638,11520239469852005799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7412829581680598638,11520239469852005799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7412829581680598638,11520239469852005799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:2988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7412829581680598638,11520239469852005799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7412829581680598638,11520239469852005799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7412829581680598638,11520239469852005799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵PID:1224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7412829581680598638,11520239469852005799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:432
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1528
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54e96ed67859d0bafd47d805a71041f49
SHA17806c54ae29a6c8d01dcbc78e5525ddde321b16b
SHA256bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d
SHA512432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7
-
Filesize
152B
MD51cbd0e9a14155b7f5d4f542d09a83153
SHA127a442a921921d69743a8e4b76ff0b66016c4b76
SHA256243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c
SHA51217e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD53d1cdd6adf1d4fd06f8222c789317b72
SHA1476a9967a0fcf5bf031b3c82732d165ccbe09054
SHA256570d5fb11107f4d0708385e22bbac7d7eb1f03ce680749525af244676a550f71
SHA512c40fe30410af772f49bcab08c38459358096abbd76b706601c39b90159141e10f64fb9d5783ec7147babe64aa25eb1b1b72d82f6c8c12cd2de460d4ab423f342
-
Filesize
1KB
MD547e922eb2a586727835028fa846707f9
SHA11fddad9a18a4405193f2b8a1b1fc0b30b4586d39
SHA2561b97b78eb74d50324c72004174d1bf633aa105f2a85363e6bd4c1feab1b5b6a9
SHA51287a768367a8384b7a2fde2d345cefbc8fd5251e89a2960b1518126f4875dd8621895cc251fa0107cb393db6f3d50c098fad2d1a3b545ff91f2406c43e9f698ac
-
Filesize
5KB
MD58730d5d3a9f4692aa20985060babbc1f
SHA156381c5d7e25db4fa2920396282cb8760a6f1995
SHA256c0a606e2717d2dfa959f847645757c080ea9189994204ac0aa3d36f2cafbdc10
SHA5127948417b7a10a7380c8f38a48a7d04206ef601e74291ad90e6c9d14f422977848c554be16b749d91947099a76993fc42db2ce01377b56f0c097ab6294f937aa2
-
Filesize
6KB
MD5505d676c2952e51793837dad5e0f03ed
SHA17d5b82f107aa2b1ac5af448ac292d0a2a17138db
SHA25643bcecd8c1da8fab7aec09cd995b42c65371f6c03cde74058ced9cb49aad4ee7
SHA512b47b722a024266d4478c87cb36d6ce481efc4897a89ebba4cc267a2062c913d09c6b12f96f0026e6f36d320f33adbe8bc387c841d4f5ac5d78149c2815568d3f
-
Filesize
11KB
MD5b31fbd966671488f310474af7d2a9658
SHA15851f886d36871cedc675afa33861a83931a5701
SHA2565f1c0b7ba7c79c36f2ef5f7106fdab3567bb8c868e02b38164a11b860996a489
SHA5124a985feaacf365a01369dff6bc0ac0ffdcd5cf6f616ca97ac55df9b03fb6e7fc3582c4bb4ba60ab695091be5c0e18110f6712cbec2876468cf13134b4c8f7ed8