Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
41264ec2bc1cec0a0a91ec733c73a700_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
41264ec2bc1cec0a0a91ec733c73a700_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
41264ec2bc1cec0a0a91ec733c73a700_JaffaCakes118.html
-
Size
93KB
-
MD5
41264ec2bc1cec0a0a91ec733c73a700
-
SHA1
8f97a6b7bc5af90985b929cf4514ba9e0c11ee37
-
SHA256
73ed9f1b8cb4c21898560bdb8d0e5bc462cc7ce145642a06858e2599592921f4
-
SHA512
2b0080d4958035e4c95101a5bb55ccd6c6a05a97eee1533c1644377e36fa5f3e77925cc5117394b184f951ff9fa7c8c7e7a2a781f16dd5232489c1b54cb6a32a
-
SSDEEP
1536:grKS6ZybiAU2xUYy1odyh29dVw08rj7OFntkZQ1h:grb64zUFodyh+V8rj7OFntkeh
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4368 msedge.exe 4368 msedge.exe 4328 msedge.exe 4328 msedge.exe 2480 msedge.exe 2480 msedge.exe 2480 msedge.exe 2480 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe 4328 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4328 wrote to memory of 212 4328 msedge.exe 83 PID 4328 wrote to memory of 212 4328 msedge.exe 83 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4888 4328 msedge.exe 84 PID 4328 wrote to memory of 4368 4328 msedge.exe 85 PID 4328 wrote to memory of 4368 4328 msedge.exe 85 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86 PID 4328 wrote to memory of 4024 4328 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\41264ec2bc1cec0a0a91ec733c73a700_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fad346f8,0x7ff9fad34708,0x7ff9fad347182⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,15539819317678408784,6465577486116264282,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,15539819317678408784,6465577486116264282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,15539819317678408784,6465577486116264282,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:82⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15539819317678408784,6465577486116264282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15539819317678408784,6465577486116264282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15539819317678408784,6465577486116264282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,15539819317678408784,6465577486116264282,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3032 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15539819317678408784,6465577486116264282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1492 /prefetch:12⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15539819317678408784,6465577486116264282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:3956
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1524
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5de7be8ee2484a742aecc113846e13141
SHA1644a110b89d87b021e7a79307ada99b9fab094b7
SHA2567079f5764e9b125e9173cc5f0568df233b554d567a1d2c4918171031b6b586de
SHA51229a54c0c30f230380010e6e8072ec4efb9ecb8596872af51c6edd9d7ede0fe31f18e25f633e842e1084156030dd818429d53730b5d6baa46a70cd7e5314c4276
-
Filesize
1KB
MD5d0a5c228fcd601f9e52461bc4dc94c9a
SHA11771a0a7bd19a2f92ae4b7eac06e6c0ec8af16f2
SHA256ba1bb025f5bad42461d16b0c1761b1b678a3ea4153c2bab464cfb222e783bd74
SHA512ceedda9477639c31ea81d6e985bfb50c22a4cb262cc3e11464f6502f414ca0a2491376bb99072c2af4d4440bb37a9521b1a6b41bf2cd00d6831f01b398e78e4e
-
Filesize
5KB
MD58e3ea872f5b83c4b9783a07cbfab6c8c
SHA170cf24d2279cbb4e701c40c5887bbf1a88640b49
SHA2560c8f2918329b6db85321b33718f2afbab02fdbb042ebdbce172d43d282b38a6d
SHA5122b6669510361425906a54778405bcf0f502b0ae33bcaa26b323b847cf2afbd5f940fe714ea1d6431c4ee75f9c2c4aef2667a390242251507815b3c9b3a5b052f
-
Filesize
6KB
MD5fc4c191b64612f49d39acfb1e7c151d4
SHA16b514ff7c1845276c84f2b0073d09b374681fdf9
SHA256db736f29c33771cd599e4e61ff6795627e91dd2c3c55a8838c099064b74c4919
SHA5123cc4c2ba2dcabdfcd44a8e6f675ce874a125498f93acceb4614a50b41879799a9b2db243105f6d4b82eb9f46cc0a4ddfad29f3c23e425f4ce3dd900a9a2db45c
-
Filesize
11KB
MD5cd2e0e42b66153c12a5e0b37084c8ce3
SHA17e54a2a27b9be21d1f692c8b30f8073841a5bfb1
SHA25625c0c3fb39d9b9a6eb94b099bcd2d67edc1db61d1154d5140a3b09b61c8a58de
SHA5129bee29e7b8638bf23ac9c1ebb486b4d44367aaaef5c01e149ed334a2b4c18afdf813fa601cc293be23782abc08c8077b5580cd0f666f26240bdf40752ae8cbfd