Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 17:19
Static task
static1
Behavioral task
behavioral1
Sample
3b3b26573ae736ae332159230cf81aed_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3b3b26573ae736ae332159230cf81aed_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3b3b26573ae736ae332159230cf81aed_JaffaCakes118.html
-
Size
241KB
-
MD5
3b3b26573ae736ae332159230cf81aed
-
SHA1
ae55ee818e4ac5748c3950cef1fce860ecfe2ffe
-
SHA256
2af8ad47656ce30dd686299e3a3b4df5992fc6f0fbaf32a294e5d96a9d2a13ec
-
SHA512
a4b2c7f729645b7e69bbf722b2c023b3304e988ffd5af1adc750e88c24788392108158950f39a295b4cef9fff8ca3dc67a9e651a123b3132b57de9adc9dd1365
-
SSDEEP
1536:hdYkmBB2wP+KGtNc6a1I3Z8V+Q6yPr6vTQRGXRKeEWDnuoSfWVM0VIcJMvNg7fsQ:hdYJPxYapMCSRSJkM4NhsZBKt6Keju
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4388 msedge.exe 4388 msedge.exe 2340 msedge.exe 2340 msedge.exe 1416 identity_helper.exe 1416 identity_helper.exe 3612 msedge.exe 3612 msedge.exe 3612 msedge.exe 3612 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2340 wrote to memory of 1048 2340 msedge.exe 82 PID 2340 wrote to memory of 1048 2340 msedge.exe 82 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 3428 2340 msedge.exe 83 PID 2340 wrote to memory of 4388 2340 msedge.exe 84 PID 2340 wrote to memory of 4388 2340 msedge.exe 84 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85 PID 2340 wrote to memory of 2280 2340 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3b3b26573ae736ae332159230cf81aed_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffc502e46f8,0x7ffc502e4708,0x7ffc502e47182⤵PID:1048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:82⤵PID:4736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:5192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:5200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,1929944024999242387,15793956684296522046,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4588 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3064
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58a66f26-60b6-435e-b4e7-df9d56806f49.tmp
Filesize407B
MD55575de0965f3cbde35c7dc79a6f5b1fa
SHA1f54b0445a16bb1206273a8ec42088e4cf4223674
SHA25628391a65c06e689d5828b63b89d8ab04e2be685d547d91a9d2bbf4dcf78d88a4
SHA5122306790035a1f9f23486048955896a5b34f357cf34d65f639da04ec2be13aa820fed87d11c9e7374e8fdd98199cb1bef313c87a232ef01415fcef39fa2a591a3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD58a87a243ea9d4fb5264e891545fb3c0f
SHA15312bdb3d1bd9a1070ddd1aeb312fd2fe44f5120
SHA2560443c83174581e25581f163c48adc7ce6e6c8b6a8636a15eaae5fb43109923f4
SHA5123b8b08775fe9633694d4a36167c04337717780222ea428f4aab64fc2c10e75e9bf3ddcb82bfb60fcf2ca2131324a6930dadbfad0d02412de296e46d375297228
-
Filesize
6KB
MD53b164f4b778c0ede0fb09044721bca16
SHA17cb7e0f748819133e7faea09c2ab53bbda4f5c17
SHA25649bce5310d11b35c0a53dcbf1a0e59e7b4f1ec67e1f00ef7151ac71627346b96
SHA512201148ae21727ff50583f24cbbd08257e76211d13ad100b7e3d2ca3a5903fcd9fe7da70d527f35c3e271697c0f16e4943bff1cb1e8094d6db2573c0a5eeaceff
-
Filesize
5KB
MD555f797017e888102878b8a086c74016f
SHA1db62c12428c2d7ab116f08be84ff8c2ae190e54c
SHA2567197659bfff38136eeb444b1bd96ebe75f32a2815e4d42ddf437aff83f49b3ef
SHA512415c9015dec76e9fd6f0cb5577c43fc3180cced75085fe18018fe685a97df272d32c65d13bd7d7534cf890a40dc32bfab01ca192135a414f09bf1ac575d9fc7e
-
Filesize
535B
MD5f0c177563266f0c8c301d90ff330a936
SHA12979ab247c577d06ddf042bd8ac8e01d1aab4c70
SHA2561ec25b61a3ccdb3a0d47c2f6b283c7319f2e7a69839bb002657fd98d6447de03
SHA512664cdd67dd44382d21e4e3dac112227a5a6baced6c47f5364bcbfd903a0d5b774523b5a45bb379d5adf2e6790a4aeb9bb388b93d4bdfb832545e41524eca4864
-
Filesize
535B
MD5bb979002a1dde9a18b27f68d47c74c79
SHA1ac61d33b00121d9b90ae582d739f272e2d89d8c2
SHA2560a7d174be0e7b840ceab3a2f0bde77ed21944de3ab00bf60a02c05d6a97f0c5c
SHA5128c0e392b14a35a3bae23b2d53b2ec8a9e8d4b94e204672c545537a48b8cdc590bc6d288d5771c53b10e7765caf6f186f1f70e0f3297c2f0421b757c792c741ed
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD54f75ab33cd71b1d660e4840b44f58587
SHA1770468b5dfc85d18b1c04ab4adf153f36d978204
SHA25624ab67c98f435716a474da9c2a1206c9280804be98cd4a564f0d0f4eca54a629
SHA512d8ceb3605550b6170a3347612a86dc2cf2be8b44b11e6f0e6f04d75e306a7656200a28611b5dd2c5299d5eb743853f3f27d83a2cd8871d928517fe5212d425c3