Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 23:59
Static task
static1
Behavioral task
behavioral1
Sample
43ac0d548175a59f3366d86aa4fa8074_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
43ac0d548175a59f3366d86aa4fa8074_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
43ac0d548175a59f3366d86aa4fa8074_JaffaCakes118.html
-
Size
70KB
-
MD5
43ac0d548175a59f3366d86aa4fa8074
-
SHA1
975972ad481a577536f349343caa8003102eb1e4
-
SHA256
1c15ef5701a40e5e137f11e026e5162309bb92046dad58e11e21a8e798c4aea3
-
SHA512
7e14d1224325fc9e08fb660683a5591ce6cfc750d317816c7571fc984b35b086ceda6e7b1777488cef3274f70bcb3acb3d6e0c87ae5f9bd34b549dbf277d8ecb
-
SSDEEP
1536:gxiMlZi9W5YYU0EeaOeKeve9eBKGk2bOYmAa9k98gPfJnV8HUBspsS7c4O:gxVLi9W5yQReiCh9bOYm79k9XV80BspA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3744 msedge.exe 3744 msedge.exe 4724 msedge.exe 4724 msedge.exe 4412 identity_helper.exe 4412 identity_helper.exe 1700 msedge.exe 1700 msedge.exe 1700 msedge.exe 1700 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4724 wrote to memory of 4296 4724 msedge.exe 82 PID 4724 wrote to memory of 4296 4724 msedge.exe 82 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 456 4724 msedge.exe 83 PID 4724 wrote to memory of 3744 4724 msedge.exe 84 PID 4724 wrote to memory of 3744 4724 msedge.exe 84 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85 PID 4724 wrote to memory of 4012 4724 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\43ac0d548175a59f3366d86aa4fa8074_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6dc846f8,0x7fff6dc84708,0x7fff6dc847182⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:22⤵PID:456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:82⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:12⤵PID:1500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:12⤵PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:82⤵PID:2332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:12⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵PID:928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,6819923138179495239,13959947302865963387,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5668 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3056
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD587366aa4397a9775ade2ca6366dbb530
SHA1e5ab032844948383263a23b48258261a937d54c3
SHA2560f0074f703927d43f1689eca8a1cfbf5f960c580f7c922c4ea17a6d83247d6fe
SHA51270492033bc3951bf005d54084bd4f60b22fe4730e369e4a9c26ab79df1e448090ec85fb2dea87e349147d7fa8c972b5b4936c33b9e23fc683d6db388e6c8d780
-
Filesize
1KB
MD5e7df541a3693f7f9771bcb832677bad3
SHA117b3a1e2e09d21e0c7431fa1d07a85eb558b5eed
SHA256d4e17cc92bfc3f7a4134fe0344ed9e7424a1d1f137c1417ce16d5391c3e44d98
SHA512d904ecab257581c137d93b21d50616dc635235192424e9d9dfb4b6d070a140d8b537fd226f368323715e4bf25f7f0e47cb7e34a0b39f95367f2a746b302a5331
-
Filesize
6KB
MD501fabef21dc7f68340922d7d9efef1b9
SHA16b4c42278ca4a2022f4b8c1a8d68fd7af5d20077
SHA256cbcda94e2dfece7433dbcd269ded312fa11fa26b830e3f0f2abb710b488fb05f
SHA5127fa30f34597f5e59c43de88d983427458bb797f98ab1252b50c5babe3c5225f24d80b1dfdfe532048299d37b128a359d63e2bbb054c5f38bb0e6592055dd54d3
-
Filesize
6KB
MD5757c9128a00b396bb18b87643309d7a7
SHA1d45e7d8472f0071eb6ae49fce2ab46e32e1a3ab3
SHA2566abbe5fbccaa3b6f1f5afb5817a0be0128879db0cd34b96cb905f43b74d3448e
SHA512d74f2e8de443545cf9e8d239d77f2c0fa41d74943f47084ab8b83a3b7ddff8ffd2dc289f4b7504108a1ab644573053876d81de8d167e123b8abcd247dcfa102b
-
Filesize
6KB
MD5c98c12a3cd99c389300eb589aee60355
SHA193cf56449ccf3e8df6f095f68a114859e2716cb6
SHA256bb7703a606ef1e0c1fd89c8a040527ae3c00a71e7f7c5bfb8a6f44483855c06f
SHA512262ec509919537ac5590f3ff73b433f0bbc900378b5b98a7f3e6cfb15cc9734186e93c7ca6313562c6061c46dc37dc99d5b40bbf2c498801b72bcd14c6e7cb78
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5c7486fe7042355f58f104e0ef418383c
SHA150576417706814813f54b7ad636cd0d5347d4b41
SHA256fd0024bd01d056fea6a9605eb4d921524d97a133fae10836884ea5a196057aab
SHA5123281f1a7fbe1f63159f01e12c9b51a16f89a9d04cbe67f96514e5404dd2f94e1cb8c9923b78d616f7db4364a91f00d926068f11e89cd7dc9b3f62b3f9fe155d4