Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 17:43
Static task
static1
Behavioral task
behavioral1
Sample
425ddc2d93651874e6bf05f1a93f7208_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
425ddc2d93651874e6bf05f1a93f7208_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
425ddc2d93651874e6bf05f1a93f7208_JaffaCakes118.html
-
Size
64KB
-
MD5
425ddc2d93651874e6bf05f1a93f7208
-
SHA1
fc5a9a3266104e75e30226c1f7c41466b294e4be
-
SHA256
f407f8177e5c57a53bfe585415f801f86c86db30cb7d520f7bd7ef1a3b419b57
-
SHA512
451a75897d51cd51c03c57bf258c7750aa9f708bd72d9165c6762f7345c3bece8c66d6c0076e20f1d592b00e423eba9864b120c2593243614a0327236f499269
-
SSDEEP
1536:y2yBXf9vQWqPqAqxqEqgsqiqhq4qHqQCqaqdqcqXqkFqOqZqoqnq+6qzqUqRqEqK:lEXf8z5AmouBrLFMzyUdJqv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1052 msedge.exe 1052 msedge.exe 4724 msedge.exe 4724 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 4080 msedge.exe 2152 identity_helper.exe 2152 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4724 wrote to memory of 1852 4724 msedge.exe 81 PID 4724 wrote to memory of 1852 4724 msedge.exe 81 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 2440 4724 msedge.exe 82 PID 4724 wrote to memory of 1052 4724 msedge.exe 83 PID 4724 wrote to memory of 1052 4724 msedge.exe 83 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84 PID 4724 wrote to memory of 1220 4724 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\425ddc2d93651874e6bf05f1a93f7208_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0ae646f8,0x7ffc0ae64708,0x7ffc0ae647182⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵PID:3240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:82⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:1324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:12⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9413493058761110079,15685125988137478202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:12⤵PID:2352
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4704
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5544b109f3d381686095e09fc087a63ab
SHA1ebff6a93821b91ad934e0812c79aade045b2a27d
SHA256d3037bf8a88fe99b1e352e1d4113bf99eb9c2c78a9cbcddfd63d3bcc8850d278
SHA51238d2c3cbc28934850c9863f3f0bc1773dbac0feafbf953ec591a5d6267fc5c81a8aa42f59b08378c185ca5a1930a98f5af7c9b941803bba34c4a316121a2bcb3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5e4a455e6a4c82fb83a02750980b864b3
SHA15a9e8d1146d83fb973eb1e1a1c4999115575329d
SHA2565c9b0058bc8c438585a7bf722eb02a32a3da57dee8dadfe94adc712d130eb129
SHA5128eb344e060ad45d194028f6ef7eeac6a7aeea2ee7df896e534db2603645672cb6c85b0f237019048791389b6c5e12df3c1a9587815c260e93e269c7587b2dc64
-
Filesize
1KB
MD5513fedd912a346087424e0738eef4cfc
SHA1708292712eaf859accc50f13af529fafe6c2cd49
SHA256c072b522131656c4ccf24443b701cd61ff22847a2ba371e6116637d90e32f8c9
SHA5127022a42a8bb5fe1e55a575d083623ce09bea382840dfbb316f28cc59aa3e9759b74c031760ad3797baf6a06701f9c6d63aa12e6613cd0b22b5a9371af9652c95
-
Filesize
7KB
MD5ff1bee65c108beab2a8551a2f801e8f7
SHA17867a249f9563d65ec1ab05612829a94688c624d
SHA2567e59df60ebc6361c39665875ee1756c9639ba05ce04b8353f2bb8524b814cda2
SHA5126716a980f8bfb2f1fe30eaa6cb98ff558178f7e2652c5ed3fbed6fbe271be002af083de63569f987079156225f5de503afe2f451ec8bcf43e0d75606980fd254
-
Filesize
6KB
MD5ff95e917433c441d4e73b3acf86f06c3
SHA17b38ca8692bb3cf7f0780dbcc3320d98cbd6f319
SHA256bbd27e05fdd424533d707c25a310ac28a30da0b3e63724e0d7e1f668f3f32f23
SHA512defa68820247f6ab47a84f40602c9818e6f2a9ae3044570ab11ec0375dad3822dd6034d762191939564141bae998ee3469f2760507a313d7d2d789a06b48d82a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5fbf789d9edf188d245f37397c552ed24
SHA1a9999e8e99b4f0566c55474a763c1bce81821ddc
SHA256e4a3592ef8fc4d2f11c16565602ff4e3a6fda0ea4c0c1ccfe2f52ade38b59f88
SHA512e8808c4ce87a6d4014d7b750b20ffcbc921e75e4657aef44ef3e07616fea555167caaffdfb2d3aa5f26d66646dbf05d59658e7bedcfd5300d43a28dbbe94dec0