Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 10:17
Static task
static1
Behavioral task
behavioral1
Sample
4a95c01c9c1b6526b7e01c26341e15ae_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4a95c01c9c1b6526b7e01c26341e15ae_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4a95c01c9c1b6526b7e01c26341e15ae_JaffaCakes118.html
-
Size
12KB
-
MD5
4a95c01c9c1b6526b7e01c26341e15ae
-
SHA1
8162a3cd8323602fb9cced138a9d748c09c4c884
-
SHA256
0c7721d4df55bb819f38e62a9025678daabf1c05c0afdd950393cce2eb80ad61
-
SHA512
169a1704b14504550b73d2dff67f0f9891d3a2089d03893eadbef35bfec0d0dd2a470c3f64b5406b917379a32f7d30efc0aa56030253cbd37e1f098913e28522
-
SSDEEP
192:CCRsnNSnNQY3kBkFn/NJYkNJY1lMYzYqcx4zIgmPJjEux:1Rs81kBkBwlcyzILPJjEux
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3352 msedge.exe 3352 msedge.exe 2028 msedge.exe 2028 msedge.exe 2908 identity_helper.exe 2908 identity_helper.exe 5324 msedge.exe 5324 msedge.exe 5324 msedge.exe 5324 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 3556 2028 msedge.exe 82 PID 2028 wrote to memory of 3556 2028 msedge.exe 82 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3124 2028 msedge.exe 83 PID 2028 wrote to memory of 3352 2028 msedge.exe 84 PID 2028 wrote to memory of 3352 2028 msedge.exe 84 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85 PID 2028 wrote to memory of 1488 2028 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4a95c01c9c1b6526b7e01c26341e15ae_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80c8546f8,0x7ff80c854708,0x7ff80c8547182⤵PID:3556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:82⤵PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵PID:3820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:82⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:12⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:1612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:12⤵PID:5420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:12⤵PID:5428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3776164970066522132,12283249690812583507,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5884 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5324
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2016
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5ab99d7c45374372dbeaf1af598da93d1
SHA1d264e1eae1d013bbc1e029c0f306c33ad9af593b
SHA256a790b762320eaf4e92e836ca78ad68215e9dae234ae82b2a85c45691f2ad87b3
SHA512abfb112774c0a81360df010a17366b8e9d4102a2ca92f4877c92fb09e3aa2dfbdbb4c84948835d2330d8f1fb44f154b1747eb66e5159e46beb8b929034faf44a
-
Filesize
1KB
MD58c8b8103da96b0d9faef5998a5753014
SHA18835c392eee6d180a12c43c53e64f94861bb224d
SHA256fcbcac6d3202f193734c7cf8496a92b2867281062429e5ffe5bb48c63d000a01
SHA5120ca7853519ac8c464681e313fee3bb750114595ae452dcdca3a5da8ad951fff4140eec8f9ca7221e4730c3628a3960296961ae567b4e9bdbee6a9dca56773540
-
Filesize
5KB
MD5eb733356023b347b6eef2a725b882b1e
SHA1d8797d138bbc199b1086231616e2c6c7cff84d4e
SHA256d8bf99008b92690d354054fb6dd54ea444a7e51a5ad9f33d108b599fae2a2059
SHA512efa5db5adbeaf62904b3fa3c4b51bb8a1d5413947fd246430955c50834d7ebcef8162fee5460e11bed5d945057d6256be005fd9b807fcf94475da55e9ee7a036
-
Filesize
7KB
MD52a00765d4f9e536639a956e5384b834b
SHA108ee17e86af578987aa0d1ed7a06e0bbca6062c2
SHA25681a8506f470721b5de46409e9df312a1e98c589dcc8eb0f2e7c7df218eba1dd9
SHA512458f18ba039b89f247195a19b972d4d985cebb5b48371c00e906c4aed3ff35635ab79faff13c98cf0b8a890c53210f312c5d45100eb229c2b76214480c56f3aa
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f1d712dedbdd476673b78a8b8c7af51f
SHA1b3768790b5c5cc96bc5a605bbe9f81418ad293dc
SHA25625b4cc9f995faf745e2d159dcf75f94338f3e81805eb4035100d8adbac2bf83e
SHA5120b8ed73f5929de6e1b0dae906cdc7a8b0cb57a543e6ed7b19f46a24316885f1cc70965b5d770d2cbe8e5d331bb6e45ed5ce7aa289f82dac6282ba65ce0422326