Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
472d72389a1ccdec05164178c77104db_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
472d72389a1ccdec05164178c77104db_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
472d72389a1ccdec05164178c77104db_JaffaCakes118.html
-
Size
9KB
-
MD5
472d72389a1ccdec05164178c77104db
-
SHA1
655a6705fdd2f6bcfd792d1a0aab28e04ba70df4
-
SHA256
2bcb7e07acbffb135e8c8a736c795d71de74315fae9f367c4bc655bb49722062
-
SHA512
36c63abc3cc19d9bb5dd4b6f7d814469409651434c536370b4a84ad544b8801091f1b69c959085186eb4661e65927e63be8ea95fc5388f6a975eb071c1349716
-
SSDEEP
192:UxUeRd++jlXr0xVrluT5YyP7x5Rd+iE7RD5NU:eHVl85+dzfHINU
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1664 msedge.exe 1664 msedge.exe 1708 msedge.exe 1708 msedge.exe 4356 identity_helper.exe 4356 identity_helper.exe 4828 msedge.exe 4828 msedge.exe 4828 msedge.exe 4828 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 4276 1708 msedge.exe 82 PID 1708 wrote to memory of 4276 1708 msedge.exe 82 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 4332 1708 msedge.exe 83 PID 1708 wrote to memory of 1664 1708 msedge.exe 84 PID 1708 wrote to memory of 1664 1708 msedge.exe 84 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85 PID 1708 wrote to memory of 2280 1708 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\472d72389a1ccdec05164178c77104db_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5b9346f8,0x7ffe5b934708,0x7ffe5b9347182⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:12⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:82⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:12⤵PID:812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10419899867332528815,3421978265876032215,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4828
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2832
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD51901a44af291c5a44d06a3101184fdfa
SHA1f28cdd96bad0878ccfcad729f53ac49c063148e1
SHA2568fa39fcd26325f382dbcf282e7fae5e45731727cde12c637b14c00495c6f24dd
SHA5122789998bb1b3b01f7a9318913b5a27e229a5f537bcd7713405993c520142f6a9d76f4552954cc271f24daec6f8eff104c03474a2fceac79da957337f3de1febe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5d1aa521726a1f4be853f119f1745b22f
SHA1d8ba377f437e66052c273790955e54a531ca0b9c
SHA2564fed8fc0c7e7bef9e6d5e62d1e0f51456aacd972dc966c224c41ee41434f18fb
SHA51276a23b2e44cb471b2f4edf43cc9b0b81e791866e484d9218e4d9bab4bc17f861cd99bc686b34a454bd234a1a9b2448e691cf57f573c76bfc3bbd42119dd3c63c
-
Filesize
492B
MD5a49f15103a0d7dcd4f4c5a65b79b43ff
SHA1292e71ae342edcf13a815c0b65c8ae122d94a563
SHA25698f806d97345d7dec25bac5aa94240377b1d1f8e623fd133d7fd56788b030b57
SHA51229933bed515cfc5b966306f8bce35963dda247a120074c8ba93e63aa05e6b413e12e38164d20ee2db1c395e528b0e9c152fb35b708e8f066a8fb656cdc92e452
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
727B
MD57194ad93282e87b043d84dcd0eca0576
SHA1c49c2183c6bb7d990ed9cc65901bd32a4c172dc0
SHA256b28dc68798a5d96131fd966001d61826713d951204ad7be2623c873a65407938
SHA512a466fbcc615bbd84e8071b26d117bdf9248e9af54caf0d5ae9b7de5a9215cffd23df9f01a8dcce7598a89d22b5352be1601d15ad4f820729a6da6d644f7015ec
-
Filesize
6KB
MD541e53952100dcb86933c23e99fe0d2ca
SHA1dfa1cbfe4000a2cca7e4e966bf0cd86743382ad3
SHA256be37b10619b489ed9963e66a17eac6158cc2ecedd95f8e26090fca6eccc5c0b3
SHA5125fe50fed13ce76add6331d2c92686b8ed8a857e91b6cc68e64162ded709e9209aceaf81f3737edc124910dfbabde07870ea70ec7f9bc51aee41e1fa2774f88a5
-
Filesize
6KB
MD5c4d08d73908f367d8caa2dd901f60a73
SHA1f49cf63cafb981222f7b1a8ef94c8df6969eb7f4
SHA256c46122013a406addf7925ea92c27f42b13e671c1965a5cf227a06ec30eb56b61
SHA51293e94bbcd875ec70b10667c07336ac69da7e749f060ec78b936220a8e008c1049cc90f904e0b3602a91dac0ea19a3add5755d75e1dca05a4758e1df010cce1b9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a69cfd8390508311e7124986fbcb7b20
SHA1cb4b83c7266fdb0e64b87dda5092d600e7a1cd5d
SHA256ce8d40125d9c70897187cd34a4c35efe49c6bae36f4125361420377ba12d2594
SHA512d7db52d041154156338ccab2c8fc1a3e4d850771dc197d3978f7d57a2ccecfa2398cc1cf8c353f4a16f3f94e2cca8ecd1b1a2fa36bff3ab453506bd7c27ff8c2