Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
298517b3ee1db050a1e5fb3c529bdaa7_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
298517b3ee1db050a1e5fb3c529bdaa7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
298517b3ee1db050a1e5fb3c529bdaa7_JaffaCakes118.html
-
Size
45KB
-
MD5
298517b3ee1db050a1e5fb3c529bdaa7
-
SHA1
4d8a068b8ee6c328aa064c306d21ad2da563969d
-
SHA256
2577b31b8a9f97c7c266e1285fa17f9eda70444af2d5014f81d433d68349313e
-
SHA512
6e5a4c9a50e0f940c9dc0ad5b8c6bfab8a3c65246b5ca4b2de96e577de4217a90c98e5681d36cd91cabe537a0d212cd6e0217e0d327b3f6e56926aef66720aff
-
SSDEEP
768:wSjINq7K02V0E3vgcnQqH2q6mCynkki1E9Qvb:wSjINq7K0UBME9Qvb
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2304 msedge.exe 2304 msedge.exe 3536 msedge.exe 3536 msedge.exe 2552 identity_helper.exe 2552 identity_helper.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe 3536 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3536 wrote to memory of 3156 3536 msedge.exe 81 PID 3536 wrote to memory of 3156 3536 msedge.exe 81 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 4684 3536 msedge.exe 82 PID 3536 wrote to memory of 2304 3536 msedge.exe 83 PID 3536 wrote to memory of 2304 3536 msedge.exe 83 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84 PID 3536 wrote to memory of 3404 3536 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\298517b3ee1db050a1e5fb3c529bdaa7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8103546f8,0x7ff810354708,0x7ff8103547182⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:22⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:3404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:82⤵PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:12⤵PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:12⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:12⤵PID:208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17447117859862953549,659548445671201678,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4524
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD51d76011ca0730fe2576024b9a20aeb50
SHA11dfa3a97c974b98a309873c67f523bda502054b7
SHA2564962e6fa6b97931b0aa770f70954e99bcfef08c8ede088f74bde4a1a70fdd429
SHA5123bdfe0291a540c6be4610a41fef0d2027e94016179323fe588ec572792bc6a803760ab4c457a2de6b81b21842215841bd3a1d37d1fb73da610dad37aeb608717
-
Filesize
914B
MD5aea7fc29e62758bc01045a0ef1c3be6c
SHA197b7e5399ce7fec84be4a360c7176eb311aca89c
SHA25680d2341aaab8f77a2e3a67f82b1126ab187d75616cb0d6ed047dc1e63c6b1224
SHA51210c8a6f9d6d1e946f11bc8676a6f79f4f4c262f77049e430ba9428650e455fecd7a61195e02ab955ec4de3992ec2ae66f9d9f7402754d76a51d55999b545919c
-
Filesize
6KB
MD58d167d36691bf7fea1825bb16fd3f5f9
SHA1e87207b1a845368dbb51895e12a447de38e1c32b
SHA256bc5e06f592f9ff1f205d75d6e0038312d10538e7a23c032661cbbe474012b089
SHA512524da3cba191dff61cfb38869c7a0c0c895081bea2a2bea10bcfb0b0d5b9c6861b11ade37dc13f6ebd14150f9a563548195990a5d1edfd95987fe820ecaf53de
-
Filesize
7KB
MD5a2983515e225acafa1a5da59d6c5e5f5
SHA1f8f7dfce512c5fe40b1bd3f36e8b3e8f89f64a3a
SHA2566f3dad648079857c3f0e7c2d7a2ad5f5ab4ce4afe608d55656faea28c475c510
SHA512d1e001228227aac3ac8a6a46e1b6898e11b00c098f9b003b119f26f755cc82e4f69baaad66ec7a73d6f3f8836d86f887241866f1a4d6dd322313e8c0b8184dc8
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d71dd9554107b9f4b67c2432a134a980
SHA11aea708aa5cc7b318ac5560f9336fdcd9f28c754
SHA25676b519c1ee7c384c1284949bd0c8ed351b992017cb0df85ee278489afe75eca0
SHA51265ed5a52b1a18241bd2a591e1a13443d99c1ef38d3fa6ee4b74af610d24cc2e0b7c2b252a7c9bfc81245491384fe79da92373528cc1e1a0908c3bdcf50bfb672