Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 23:25
Static task
static1
Behavioral task
behavioral1
Sample
2733cdbd6b029aed00fcc123e59f9ace_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2733cdbd6b029aed00fcc123e59f9ace_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2733cdbd6b029aed00fcc123e59f9ace_JaffaCakes118.html
-
Size
2KB
-
MD5
2733cdbd6b029aed00fcc123e59f9ace
-
SHA1
0922a82fff6d6cdb0f8cbb9da3253064a8dd0033
-
SHA256
6bf18787f5ae8b06b4a9337b32c4261ecf9d751ed8e408b8619296d892623497
-
SHA512
668ce516f0122ff138c4f482ac65f6f3a16ed192b23f864800a4453bd61bb08fa9991137213c264f78d7713252af62cfbcde99e4855161bbfdc28c69cc3652ce
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3316 msedge.exe 3316 msedge.exe 1288 msedge.exe 1288 msedge.exe 3584 identity_helper.exe 3584 identity_helper.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe 3268 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1724 1288 msedge.exe 79 PID 1288 wrote to memory of 1724 1288 msedge.exe 79 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 2840 1288 msedge.exe 81 PID 1288 wrote to memory of 3316 1288 msedge.exe 82 PID 1288 wrote to memory of 3316 1288 msedge.exe 82 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83 PID 1288 wrote to memory of 2480 1288 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2733cdbd6b029aed00fcc123e59f9ace_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcda8746f8,0x7ffcda874708,0x7ffcda8747182⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:2840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:12⤵PID:4668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:4544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:2928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:12⤵PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6172911609170639588,10292845081987565259,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3268
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2304
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5f1e01d016dba04b534691bcd94e01b1c
SHA1e0bb2f1196935fabac8f0790ee2de405175dc309
SHA25644fc9ea362b471c6667aab8372331a6a60acdfc041326183e4016756adf8b1d8
SHA5129db9557781da3004680982c2528a10d84a35d53b6a946dd78b65998387884b1e64b4d6d2aeb609f2597f57832f74b5cfb6cbe93de212a31c1e1c1c868d91a143
-
Filesize
821B
MD5a047bf5e34766be9f1e73952214687af
SHA15b238af30dc0a1d4d152870bf256cf4e13e80c88
SHA2560302263eccd904911fdb09b79b2b0ca76029fca1f8a94bf578ff558192dacafd
SHA5126c550955cf8099957e48a987788c10a3164a74ac1fc3ca4d1d8a55a2a7b84bad4f0ab438a044ef4f4dd5aeef89bd4d6ee9329db2876fa505b4bf6d1c27a504cc
-
Filesize
6KB
MD569b3e8e9722c37e29cd90edccd084f28
SHA1517407af88a6a251489c9bdbca53ccda7da9ea13
SHA2564b444030331278888948a69db1706698d84dfb90bf24e9028f81964aaa6554e2
SHA512a7426db90e6f3fb8b2d4a72fef6978775ec3cb0e7f0c29252d84fbbc7f3786eafd2f2d7d30209c9d0dd38f9ae17c94b7466de1ec0693c39f765600683224fefd
-
Filesize
6KB
MD51dc4d4cecfc187869f3bf494a9d01976
SHA1100e8edec95e88115859bd9a0ed285833b0ae3f7
SHA2564bacdac516b716ee7db4909321b3ff948d952db9f5aff26fa7c962caa3874ebe
SHA5124c3cdde0a0734ba55cf5a753095df3099427dd145b7fea4ce4ea968f606f87e98b5718d56e82c7cc08f73657d2612d244225b2f9379387536c286dd9d41097b3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d797a33a92c485888d4a90eadf2f2360
SHA1ba2498ac77d365b53bbb5f01c941180cc84bcb40
SHA25602f35a9451cf6dbd1a023f0b7e9bb03170b92b6c630c2275a858e71115c13a50
SHA5123e6cffcdbed654a1daf15b16f693deb3e6bbf10228a19404b630e7684178b0fb6c831b2898727c038b9319c0fc9bca59de1c00953cf24eee68e80875fe64fcfd