Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
240e0d01de5357f4e03b207909be2534_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
240e0d01de5357f4e03b207909be2534_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
240e0d01de5357f4e03b207909be2534_JaffaCakes118.html
-
Size
138KB
-
MD5
240e0d01de5357f4e03b207909be2534
-
SHA1
1dedc60f2b9e3ce304c2383ab3c31056b8f3f7a6
-
SHA256
7ae86257cda32704c68f059d297e2d7f698f71865f7a47335841fa04ea74fe9c
-
SHA512
ecd74f23eb0362adb9c2f6ff1d18bfe791ba50357179ac2ddfcb3fe968fe8bfecb0336e2f161b6c111bb848eba19b995c42d9900b8c083b3f58c4fdaf534bc1f
-
SSDEEP
3072:SO+BOBOwn6nIGuyfkMY+BES09JXAnyrZalI+YQ:SO+ABOwn6BsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1172 msedge.exe 1172 msedge.exe 3492 msedge.exe 3492 msedge.exe 4456 identity_helper.exe 4456 identity_helper.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3492 wrote to memory of 808 3492 msedge.exe 85 PID 3492 wrote to memory of 808 3492 msedge.exe 85 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 3052 3492 msedge.exe 86 PID 3492 wrote to memory of 1172 3492 msedge.exe 87 PID 3492 wrote to memory of 1172 3492 msedge.exe 87 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88 PID 3492 wrote to memory of 1180 3492 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\240e0d01de5357f4e03b207909be2534_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7fffee9846f8,0x7fffee984708,0x7fffee9847182⤵PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:22⤵PID:3052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:12⤵PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:12⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:12⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:82⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:12⤵PID:2248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,8338801628342279218,11490314858449636942,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3560
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD54600a10c5bb2325f137f3c582e71065c
SHA171585ab2053584e72e8ee5189eb2242282a866dc
SHA256336502176fc28acce8d12f08c014b690c16116c0341e3ecc8d1b9fd8d8f67f6d
SHA512d47c533d50d470b35067f367a07718d8352def002e46f1010d3cecac7936be456b9e937b0dc746c94897d013183d039e4c487b47f6407fdcb66dbc92efe3f659
-
Filesize
330B
MD598d08f5b054e1033500ba1676d6e13f3
SHA1323a55151541688c5da0386084afc2a041cc0f55
SHA25663b79e8ff5945a4f5f5004dafd3b8178870759cd40a6a94f81131e930d90f5ba
SHA5126428b016eda42938ba6b5e204a8b3d332ed560bc4e0b83cdef1ab9d8b04a00346729b1ebca40f9ed074bfe1714765a9078bc275c0bf510eb43f790d7d43cbdaa
-
Filesize
5KB
MD5e14dc08a0f5dd1815160dc3d686365b9
SHA1d5b122aff8ad95e411777069c33a874126b4fa99
SHA2565a6fb1d0a4617c003dee7200362eb91f30b287f18f7be54c3a1e7274026efcb9
SHA512a7db55f57cc611f8415c18573b1de2dab9973e04c8f58523bc9fa4b2b89543034efd007e3065955dc31fdfb432e5a5c21cab05c63ad4f56f5ce3249cf030ab47
-
Filesize
6KB
MD54e6a95c59953b949f8b2973097788130
SHA158f0f3e88d2eab16e6804bc0425f4e56c0e1b97d
SHA2561d01d125b9d69747a98443349decb07fe92b89ab4695e8917885deb2d1e2ead2
SHA512c19dd9d5960dc7ed2002f462dbe40d4cd693abfb5e7325a596f61c9b431e7e7a08d7e4904b1390d360edce01dbdc489669735f5f1cb37d1f4a61af62335998b4
-
Filesize
6KB
MD5ab98e2bd5d4569676276f5108103517e
SHA161d0fe3c0a9c8ba1b9278eb3d3cac80d841fedd1
SHA256dd944381fc0ab61f53a541bce17446b876e7062cd2c3c8bad5d2a41e3afda9b4
SHA5123666781b372a4f040dacb5d7775f58649f84cc9c5ceb4b6c9ed871498600a7fe84bf83bc9554e17feea16218a67b20cb84cfd20d7da0f2205058c0e3a29e35fd
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a285a44d921d0df95e539eb2bbd412a9
SHA19f0f47984383394f101800e0bd6992f9857089d0
SHA2569c6e5da1a72411731aed9968f6ced3644667d1445efc70169de0323ea8dca3ba
SHA5128733d7440b276c6996c39a876ff264fa311408b63cbb8bf3134468e52e6fd874d2897b18d76efb4073743e5e4b352dca017fe9b1739ba3674566d0b035d2c20c