Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 08:14
Static task
static1
Behavioral task
behavioral1
Sample
2e2d1fd3497c46b4b6c7f1448cabd4ba_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2e2d1fd3497c46b4b6c7f1448cabd4ba_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2e2d1fd3497c46b4b6c7f1448cabd4ba_JaffaCakes118.html
-
Size
203KB
-
MD5
2e2d1fd3497c46b4b6c7f1448cabd4ba
-
SHA1
8e211f8c3cd0abf45614f5d32679634af121fd87
-
SHA256
f1b41c0479549ef6a8bd7ec5380506d91f5350d4810e2431afce0a5ae3bfc4b1
-
SHA512
0b1936a0ee1946d78ccb6bc9313adc12a14189a1e0039e951292c30e09d4650b417f2f7c47bfec2718e3a4f5863b04e94f67cd69852d0725b7f2f12a653a4545
-
SSDEEP
1536:wGlh2uZZppG5At2S6a5tr451+XVcZelJ78m2c5Evk2iGcv2zLYYEv6LCl0om5NXJ:weCAI1+XuZwleAn+zLY6omTXJ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2408 msedge.exe 2408 msedge.exe 1524 msedge.exe 1524 msedge.exe 4572 identity_helper.exe 4572 identity_helper.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe 4968 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe 1524 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 1592 1524 msedge.exe 82 PID 1524 wrote to memory of 1592 1524 msedge.exe 82 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 1812 1524 msedge.exe 83 PID 1524 wrote to memory of 2408 1524 msedge.exe 84 PID 1524 wrote to memory of 2408 1524 msedge.exe 84 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85 PID 1524 wrote to memory of 4996 1524 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2e2d1fd3497c46b4b6c7f1448cabd4ba_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5eb246f8,0x7ffd5eb24708,0x7ffd5eb247182⤵PID:1592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:3804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:82⤵PID:2960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:12⤵PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:12⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,18163741414046753644,11144287968569214616,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4740 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4968
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2816
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD54aba91caf33e0b3ebd539877d128ecdb
SHA1fd0cccf2b66abdace47b8c54cc5a933c1f4e99c6
SHA2562d6c9b1419830a509ef75b1d5d6e34cd65c78f64d9cd2ad15c2dd94135fec37d
SHA512f132b2695ae0280d39c438f7dc8231d13a8296ad487c265997524c35e0af0f7d6d2812df813b34d2b761c36f77c2383a72885ccd41ba8af9e1cc0b312e77eb3a
-
Filesize
1KB
MD5f3328cc034032c132f53551da8fc4841
SHA1345ca09a8e137a7e3caa098d30a9e19759708948
SHA2562f9965f3ab6fe5c212a5c480ef0051cb5b0e414558eed232a7c6a505a021a88d
SHA5128f6c7d858a82353513398a4bfd7b8c79c86547985013c72f49238b9607064919ee8d135557cc640a51de7436fa9b1d3afa4072f72bd84a5540701b45ef468da5
-
Filesize
1KB
MD5eae4e350126ce08ef85e957ba279d3be
SHA14fef75466bd57f3a93a4ffc5e56b9583fde1b62d
SHA2566778af4c116012324e7b8be614d7e2922090394794a770dd5e196ec5eb481ad7
SHA512c3b2c7b845c1467ad17862e8fa0073c631dbf9ccc2a1937dffbbf5b07c45bf567506b0ef5d8c30266ecd7191f1ad2553be8dc8efae771d1221ab168026c1e4be
-
Filesize
6KB
MD52a8b029148b078b3ced6ad586b385087
SHA126f919abda48dc03735a4b3a705f92c7e3e86170
SHA25615f87af1673b8ac3fb68fd7e3981082cb6dcac8af7755d8e8f65441b71d434e7
SHA5122e4355a2c1921c905a9900cdb683ff3dd8972602742725348e6a24229ace71ab6195c53f504447b59b9ad4a1845bba55da0f7e20481d3a08060af90980867d82
-
Filesize
6KB
MD59c5ade88d68333eee2675aac8bf32f53
SHA1dcd423de92e9294d43046192eca69b945191d3f5
SHA2561b3f762792d77b374816fb7405e1a7ad7327f27343aa929ff3c51856f55e5608
SHA512a4aa45e02610981d83c6ae4a173d6ec29bd8d1b9c942d39a97f7dd95f62b9af8fad85ee2538219f5a5f2481a597d58fd710adec6d05c781099950345445b7213
-
Filesize
7KB
MD519d9ab9958b36222bdc3ebae39b061a4
SHA1600cedb500847ad2cb69312d2bd087c97d498413
SHA2568de9d564517b1a8b489703fc04850440326f54264bb2ead934e26cf9716a1975
SHA512154e07f7304325759d8b9fd5e780876f1cfec5fc2c3febc11f0f5b424001ce1dec11a46081884c4ce5f198abdefb9af2d3221e23934ea3ce69655994c39fced1
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5df5da13fc2dc0969c698ac5a4e48e111
SHA17d12540b45ac11d79fa256dae36ee29df03b34cd
SHA256c951094aa2ba9d4cd206cf1a0c0e907c216a298a366fb1be76d178db784b52ac
SHA512f1f7d34028f73961f5e0098f58b086992c38f282a0e71d525f738cc6a1776c15486383bf66d9c5f2358563c02b5094a29da748c2e29f00ea5d3b5ff01ae3348d