Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
483657aa5f44a81ab068c6212414f35b_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
483657aa5f44a81ab068c6212414f35b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
483657aa5f44a81ab068c6212414f35b_JaffaCakes118.html
-
Size
35KB
-
MD5
483657aa5f44a81ab068c6212414f35b
-
SHA1
6fffe195cf5cc3532cd945cdddce993b871b09c2
-
SHA256
55eabedc58cb7a5314c6897eae9d9438d177713d437317f646c9871a3d9a5851
-
SHA512
8cd07ec07fea112bb97d2f7d2c9800c9126530c4a1a77abafd17ee06bc6412752de44b25740afc8587c4e89e562d3ff3256856f9a8b98e0dab482675ac033f51
-
SSDEEP
768:UFjbR1bj41b2vbEpMBa//9bGtSd6uNoGei01JI4JHYAX2V8n3P:UFjvX41S4pMBadCtSd6uNC4GZGu3P
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3268 msedge.exe 3268 msedge.exe 2476 msedge.exe 2476 msedge.exe 3932 identity_helper.exe 3932 identity_helper.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 3292 2476 msedge.exe 83 PID 2476 wrote to memory of 3292 2476 msedge.exe 83 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 4516 2476 msedge.exe 84 PID 2476 wrote to memory of 3268 2476 msedge.exe 85 PID 2476 wrote to memory of 3268 2476 msedge.exe 85 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86 PID 2476 wrote to memory of 1908 2476 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\483657aa5f44a81ab068c6212414f35b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc002046f8,0x7ffc00204708,0x7ffc002047182⤵PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:82⤵PID:1908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:12⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:82⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:12⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12822196475483206880,9226526546110227337,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5156 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4240
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2644
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD57076a6ab7718f18762584ac374010f12
SHA1da24ef99872b1f08317f326462dd17d8cdd04bc8
SHA25611af94c42ed55b96bde7090d9dd2e6ffddbb47437f4041130cd7b8ffc554db4f
SHA5122196ed41634d4561ca10640db784a3997874e66da274a4e9c39d582ca2c3c1989b301b898b44e27804135eb39fae6de7c4380f564833ad0bd6ad2cb994960f13
-
Filesize
6KB
MD5c1a79a083f030c3a3489c3b0ada6d1fb
SHA11b1eb1a6472c919f79cfa0aad563307115cf662c
SHA256083616a169962240edca91e0977b94e2f61997a980bbdfcba9a754d089b56dea
SHA512e420da313871726db5caac04798ff22f4321bdede4f631aa7fe2af6bc4765904e898d6fddf645917f0931d1bb76516b96d1c799138bb9c598128a2924b70c50b
-
Filesize
6KB
MD5e71cc177dd517325e9e94afc7fac206a
SHA1fa2162332cbac4c7f78211a92797bfdd9952f80e
SHA2569726c2a60ccca925ca6c49dee574101f2a545abd9f1fceb8b1b88a6af8671aa8
SHA512ede5d6a50e24a1e8fac1770c808b967cc7fb510d19971935c95c5aaccfce52c09ec1312b8f47282a08e7ab9567704264c2a542f18e2d4c72e57861a629185af8
-
Filesize
6KB
MD54b4d0b0d6aeaa211efa11f9bc64ac4c8
SHA126c25bd635f2bbba1ebaf356d3df8b92d9ab857e
SHA256472e1dfc746723f23bcbf5152e5922227157760f163558f19e7528863ae95230
SHA5127fa4c76e2b3c5f80428acf11e9bc01f66a6c4c851354d9c5746ddd5a1313bfe20e7601ce2559f10ff5fd20bb7af103172080a93387860e0b82e06a1ae4ecfd28
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD558477f523cc07bcb188ef71ef9e9341b
SHA1534b35917aee4757302c132ad3e48aac645ab7a1
SHA2565402305aeb342582766cf597af6b8cf5c4594c57edd474d4e1f491619478b836
SHA5123fd00a752f599de56bf7f38bb2e515b4d1e14f88efc74ebb68cfc2d2376da5eecea68f01a9a4224c735592836a8a18c988407f62e9b38a57c803f033accf4038