Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
4c08ed40d85d0fffcefd8f62f6d3fa2d_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
4c08ed40d85d0fffcefd8f62f6d3fa2d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4c08ed40d85d0fffcefd8f62f6d3fa2d_JaffaCakes118.html
-
Size
27KB
-
MD5
4c08ed40d85d0fffcefd8f62f6d3fa2d
-
SHA1
1edd92e8637f1cf27ba683e041eb25bc789469f5
-
SHA256
425d3acf5d8837c5ee0dd4e087acf8ca74e6a32c54180213af5d1773f83ff022
-
SHA512
e57a72f6927c3847b0e07415229c42fc12a5671dd0fb0e8f36b3a94295b25ea4511cf6267e4c48bd828731f0670744a7a16d4e05f0fd18ce64d31ec5d75558d7
-
SSDEEP
768:cKCjf9Ofwn/e5r4CAJB+zmCyRSseMgV3ohnPAIp:cKCjf9Oqe5k+SCyRSseMgV3ohnPAIp
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4828 msedge.exe 4828 msedge.exe 4300 msedge.exe 4300 msedge.exe 3144 identity_helper.exe 3144 identity_helper.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 864 4300 msedge.exe 83 PID 4300 wrote to memory of 864 4300 msedge.exe 83 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 444 4300 msedge.exe 84 PID 4300 wrote to memory of 4828 4300 msedge.exe 85 PID 4300 wrote to memory of 4828 4300 msedge.exe 85 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86 PID 4300 wrote to memory of 1460 4300 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c08ed40d85d0fffcefd8f62f6d3fa2d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6b4b46f8,0x7ffe6b4b4708,0x7ffe6b4b47182⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:82⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:2124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1496 /prefetch:12⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:82⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:12⤵PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:12⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:12⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12926396148045757519,8786928244604027015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3792
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:828
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD55ba92b22f126c2f5d0ab9d629ebb74a8
SHA1f91fa735b74f2573cde3856ec68111a368374342
SHA2567aa1983cedf007caecea563c9d127caf5911d3d639ea6bdd7b6952d487423b48
SHA51257ed5c794d18ebc3d83f9d1974acf21bec53f1eb3ea6d1fd75e569acf27e0cc9088c623d41e02a5ad1cf4ee0844daef56e83089d74ad92f1c0c2d2104cf9c562
-
Filesize
558B
MD5e6edf7243040a0ae9fe025f8df83e1b9
SHA123fd8a6fa636c873dd21e378d30a7778f447c057
SHA25657377bbc9304ccb63c934c42bfdbd34846a99af180bece0b64dbaa24d796840f
SHA51270ad8a73be9923b6532fffc31f6ce990d306ae16b5c39f315aa106ca826bc38a20f0def03b672ffc0757164774969a32bade03a831fe665dff12947643e5e7f4
-
Filesize
5KB
MD59214ccdddb23e6f78dc3e85cf3da3879
SHA1b6b7fc8422a86ce701251323fdbd92f5482a8fdc
SHA25642ed167ce91b390b063a9815899d17f70c884c2db69430eb7c29236fe9f781ef
SHA51228f61d6fb2170858ecf8a92e7617adab712a815efb71678487204d98e3092f8bd5ab588f8f1640384b0266b9ec7e62756830a1aeeb4ebbe9f95f571937dfc5f8
-
Filesize
6KB
MD5e94ae7079044ce109c2f8e3cfd57d8bf
SHA128ba44489a04db5bf7660378b37c1c4c66377a93
SHA2562a2e80458b643279e3e4664803d50f900d8463088de43257698d45b08e001c29
SHA51235606f75a6a4836593583de9e57e90cd6e080d699789a75141131bd235107ff3eee919765c68f7f56950c488ecdb17f9c42122ae6701219cc24d159a1ea56936
-
Filesize
6KB
MD536fe3a23bec61f13cca852313603bd87
SHA105ca0b209c884eb2b04c776552602de137bf1c64
SHA256c84dd2a86711f4d51f7df0dfd26197983c2e1c38b2d19c8ef77bc01e9a56e250
SHA512376c53304a2ca898ae7f7a92263035b096fffe2f99b190dc935a8fdbb87443938aa391c14f1a757ec10135d1d0559160ecf22150c77f229f7735f2a9103086ae
-
Filesize
707B
MD57986fdbf9362fe089cafe940a6cad3f0
SHA16f5ea09c6f0f46b3b0e3775188bec2afe3caae16
SHA25687791c95812a5a847d34e0bb3973aaf274f9c03bd8528c983a1e399f9c97eff4
SHA512aff0c508b65917e70d012020ac47ffd7d6dc3de0ba8048f3b57b1e5ce1437ae0bd4d724e2cf0850c83018dc1a3f8a9cd5c9295d96875d351f1ec5d34f3cce62d
-
Filesize
204B
MD5cd0d52b113f88a4b46c255fe5c415e66
SHA120482469bf4f6735133c6818a53794a8714af66f
SHA2561f338f3e83c93de331596665a83668cb9b73344028066c3ca37c0b8819aff1a6
SHA512f602d226939d23302872e8be0c22fcb4aacd53931ac3404cac2599ae134c58705c9cfcb480883f53ba05b44729dbaed0f7f95c866817650b55bdca3f138365b0
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD590c3643e677ba2ce79350c6fd4bd8dac
SHA1af7706813eabadd58eeba4d0457753a9153d8659
SHA256e720ad707e18170c150415b54d5169349378f1a56f0544caa712be82123b6c06
SHA512236256e263e155235cb412d9bbc97c1f2a0eabdb7962b0887d0cc11ad2be9dc5f773da45b9cef6ad441b6d207ad5d779dff32d835abc6e90684933863e747225