Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
3ee7fbb785fe4191ea94d7bed55de061_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3ee7fbb785fe4191ea94d7bed55de061_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3ee7fbb785fe4191ea94d7bed55de061_JaffaCakes118.html
-
Size
26KB
-
MD5
3ee7fbb785fe4191ea94d7bed55de061
-
SHA1
81354ef1f1743eaaef971442d9214f153eac5539
-
SHA256
0f257510a640102038bbf2d2e20c1e5edc56e7d32af2f5bb878ecc150296a257
-
SHA512
3f41b39c021f976bb0752a1ab80db8d62d7065f107a71d8d9a8dff6955a5eaefe25b310623b28ee76bab2b6cd07286ff074b959d5c2659074dc71c2402a0a8bf
-
SSDEEP
384:SzU8buMnBmOGLg1QqnBMJBMbqHKEDs4dYHnU4yIQjjata0XkQbmZatFye0c/iFkN:SzUwhnBmOG8RnCJCUs4NjDJ9K
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1140 msedge.exe 1140 msedge.exe 736 msedge.exe 736 msedge.exe 1236 identity_helper.exe 1236 identity_helper.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe 736 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 736 wrote to memory of 4724 736 msedge.exe 83 PID 736 wrote to memory of 4724 736 msedge.exe 83 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 2500 736 msedge.exe 85 PID 736 wrote to memory of 1140 736 msedge.exe 86 PID 736 wrote to memory of 1140 736 msedge.exe 86 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87 PID 736 wrote to memory of 1420 736 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ee7fbb785fe4191ea94d7bed55de061_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f44046f8,0x7ff8f4404708,0x7ff8f44047182⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:2500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:82⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:12⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6116 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1436
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5e6870c10f6e7f42ebe087687f6689a40
SHA11eebe8d62f1e1b648d821d8023c756e6ad04cb8c
SHA25654f38d326a83dd5f456a2ae36ac43f890743ee77a01e5d8463949c0df2b512a3
SHA5123e2742c2be0e9002afc1e632a9962ab5f6bcf639f4de24ac88fdf15853aa426fa6d1c7255bfda48719af464cee0123677e1b99f6c2750c98180a41bbc41b694d
-
Filesize
1KB
MD55aa4428dca6cff0e1208eda73284f38d
SHA192707ef2d339b5dbd152a1394d4196f839ac8431
SHA256c5eeba6d0b97b76d9002a190a898eeb995dec1d67fef9de2883a846a03f2553a
SHA512d6b44c2f2402f6d59961aa0812f59ea6b8bb5cb01ff5d44b9146151707901f937f9b7280bdcc190f7d8aa2cc706abd0471e9403741b9d9bab2aa6f3b2e39bd58
-
Filesize
7KB
MD5f40361359f577ec2cfd97aab05fac26e
SHA1151f522051ff7025593d84b144b4b2ba23fbe338
SHA256f0faac7df43b58a9a4b0c906802a5962f65eebcabcff79cd6b576f54a0d86685
SHA512ecea09a80a649b0ba4928ce4c982067ce29794ab2635a148dcc6df218da08d69a0a30195cf15ee48e2eeaffcc54a23d47d9f65ddbd965f413936a981769ba53b
-
Filesize
6KB
MD53f3423d12ccbd0c6133811b671b52ca9
SHA172e2938991ad5fd6a24e3694dff83bb1de5bcd53
SHA25611621502021cbed173215f997779bdfa7c250f59826223e2711186fc411eb59a
SHA5121e9ed0ec41d63931dd43241410f2587eb465e06b6d5248496e1f086b152d6f2aaede44784178d145d1713105480bf1488befdec3a42261147333244f2ce0f6f3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD500193901486aa0620412eed696c62255
SHA10e6a5e8a36cc25005af77c483783444cdb52caec
SHA256c96da563083798e0a2b5f3f90d48175393a67914418062b73c08421cb1a867e8
SHA5127efc197470cb79e3de79ccf1dead1c8619adefd5d2e1e7c8025bee5d896aa2fee428114b2e5b0648b4ed1a0df9a9db432d0bdad682bf196a287a864c76127049