Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 00:06
Static task
static1
Behavioral task
behavioral1
Sample
31bbfb10f1190fc4358602a38920d653_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
31bbfb10f1190fc4358602a38920d653_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
31bbfb10f1190fc4358602a38920d653_JaffaCakes118.html
-
Size
75KB
-
MD5
31bbfb10f1190fc4358602a38920d653
-
SHA1
07981c77cce43da5e2df5184a0bc86f0ecbe12ac
-
SHA256
3813446a9a99a9102f0024834576471cfa56690894cc2699b7221d2abb835837
-
SHA512
33016cbed024702e733980fc8ff167ff099608033421ea48d0bf3d960c1cd6157b2db5ae4a35627b6671356c0851581f08eea9128828c7a8e7444cd00e315894
-
SSDEEP
768:oKhH3btqeXVVEpGNv0TG8OJBtk93G8OJY1ze05:Xp6pGNv0qBnBY1ze05
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4416 msedge.exe 4416 msedge.exe 428 msedge.exe 428 msedge.exe 3960 identity_helper.exe 3960 identity_helper.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe 3460 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe 428 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 428 wrote to memory of 4584 428 msedge.exe 82 PID 428 wrote to memory of 4584 428 msedge.exe 82 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 3852 428 msedge.exe 83 PID 428 wrote to memory of 4416 428 msedge.exe 84 PID 428 wrote to memory of 4416 428 msedge.exe 84 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85 PID 428 wrote to memory of 5004 428 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\31bbfb10f1190fc4358602a38920d653_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d9547182⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:22⤵PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:12⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:1292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:82⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,7979087033912904403,11672904770846399598,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2912 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3460
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4864
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD50f7cd04c49396da367c084b78167d8d0
SHA14d4a8fa0aac4c3bd6dcb41a091442b40bbdc9d03
SHA256f6b96f3419f3a43e2231cabee3a836b705eb98e05f4036b536cd24530a4ad0ab
SHA512fe3ff9b5b18c77db1f20607478e8e84cd10f1cba164417c55f1c52e3310159ec130519dcf9fcd2b3b6fb595649c74c27bbebe74d22a207eee29081eb31dcc457
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
1KB
MD53b4736262020c29fffe64d992635526e
SHA1d9e93569a5471a883e462d719b5eb36a617c5ffc
SHA2561ca8bdadf44d55cd05f5fd24ec649b4d99bcc0c26e39a53f6955167ed6cf8660
SHA5123ae1482334af3ef21a12b387b2e93e1b2bf37450d08e8b2e16bf6ef5289c8c4ecfc2b7fc0cb0b5dc9464bc0854807e44c722cfb3598bdc90c317f7d129a9c5e3
-
Filesize
6KB
MD5dd3b0436dc55526bc54bf58ad7c418a1
SHA171f7c6b00118b508ba0f7e281868afd47e87c4c0
SHA2567c3d77bf5737695a7eccedb396a68911e80b43b3f326c55ed1b29dc183839f16
SHA512fc2c602995a83f7db0b69f2519ffbaa752c993a7cfdb44ff937bfc67b3f3f5b279724e4d4a0165659633e41536cffbbb76dfbb581444ec34a710e79cede9c569
-
Filesize
7KB
MD575d1ad37cccccbd291ddee63e30f7190
SHA1c9f4fb5acda5998247787fd39ec2c253afa9beca
SHA25693918191e4bbd1f689948ba1356c9cba08201e42c6f7d123ff458866f58ff467
SHA5126ac436b0199d05442726d3a70c9c275aa9c45ec6377a43e19f68af50c18ef1f685a14ba534d2173d9cfafa4d1b20e053bdf7bedc82e2477c3d60c35ef41a343d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5343ca8b0bce7cea02c7ead879e2938a1
SHA1c3ce9bd8e6e48950db65f9a66a2f892f534721ee
SHA256b845d9e7fc0fdf67ff07f17754c90a497549405eab1c7bd6ebfde73ed9aabcfe
SHA5129a7a794347bcdf0ca622ca747d5111e14fb847f5adc1fc4a931f3dc91044430b3376a95eaa475f01b3693b0af08c4512803c48c86031b02dc08d1285af6b1e9c