Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 14:21
Static task
static1
Behavioral task
behavioral1
Sample
5f8a25553f683d79d2c1303f671dd0f0_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5f8a25553f683d79d2c1303f671dd0f0_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5f8a25553f683d79d2c1303f671dd0f0_JaffaCakes118.html
-
Size
58KB
-
MD5
5f8a25553f683d79d2c1303f671dd0f0
-
SHA1
9f6a8196fc1a4ac20b3d30d42f6fbdc776340b87
-
SHA256
d61d4bda1519f51883e98aeb98858f9987004c91a8471339c68817dfcb79864c
-
SHA512
a73fd23610ce354f2994a3cbf658a154292f432d4b9c1816f4e164f0cd13389c202b7f4d0bfb221bc681e29e0f34d16561dfdfa2c49fc3aeea64f09eb8202337
-
SSDEEP
1536:Htvhg91i7VCFQGP/mWXDLdPhjy8mksDECUM:HtvS4GnmWW8mksDECUM
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1720 msedge.exe 1720 msedge.exe 2484 msedge.exe 2484 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe 1776 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe 2484 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 1260 2484 msedge.exe 82 PID 2484 wrote to memory of 1260 2484 msedge.exe 82 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1540 2484 msedge.exe 83 PID 2484 wrote to memory of 1720 2484 msedge.exe 84 PID 2484 wrote to memory of 1720 2484 msedge.exe 84 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85 PID 2484 wrote to memory of 3740 2484 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5f8a25553f683d79d2c1303f671dd0f0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbb1b46f8,0x7ffbbb1b4708,0x7ffbbb1b47182⤵PID:1260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12736887753085929088,14180314531864819410,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:1540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,12736887753085929088,14180314531864819410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,12736887753085929088,14180314531864819410,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:3740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12736887753085929088,14180314531864819410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12736887753085929088,14180314531864819410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12736887753085929088,14180314531864819410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12736887753085929088,14180314531864819410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12736887753085929088,14180314531864819410,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1212
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
44KB
MD588477d32f888c2b8a3f3d98deb460b3d
SHA11fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA2561b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
SHA512e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD5796c9b0c79969ef7dbae635a7dd1d483
SHA12da8bbb5a2ab8bc1d54743ccb9b9548801721681
SHA25652c516a97efcb03909faf1f91f3b778e85226e51cd9101f2f402cfcb1fe443b2
SHA5126b1dbb22804393f640e8ef02a4dba2692bbce224b98b36c972b47cfa28b376270f29afef8ec37e950b087531dbb7c7d543b6f0773f00e9b8a969ac1e505cfee5
-
Filesize
1KB
MD5dc5326e2e01110bbf9911edb626b0287
SHA147822964d6dc6e4865abdf17afbe6026723bb7b1
SHA2565e1d5a710af3df1b27d788f512d19e79b8c0350a19e69b6180000db059292ea2
SHA5122718061da68de052153d6d665e558336f634a89b2131e5feed332f83158ccb68947aab3fdc3fee915663fd20719ec2fd0b784e4f7313ca40cfe979982a16020c
-
Filesize
1KB
MD5df8a4fa3be30bd9d25e210922a47a297
SHA15de232127b54bafb2f8570d20b98c0110dc535a5
SHA256296e2beb258d098cb9b854791b6b68bf59dc42321a823807f2ec03968dcb6e35
SHA512b35653a68be98ca35f577bbc8044004cb0dd61f76b8a26405688d326100b2368190a3374bdf2e8dec3a639da03c237f2a5249190d47490945605adf9c3124b18
-
Filesize
5KB
MD5ff3b8a46f70051b352380b941d38e5c0
SHA116af32bb9df3994cf3bbd1cfb1934c18e394cfd9
SHA256bb7e07ab22b5585e79f1cee2d3e7014f082c8b5f9f8e3951d63b3c54f06b900e
SHA5120920016889411f1002d2b912cc6d4b0e9d2b5452293c030af8172009f069bdddbc2646433b03952d0806369e9939bea1097ba4679337a64d9c1fa38a0c03c7ac
-
Filesize
7KB
MD599b7835b482f69cf1f3ac7f6a7b71679
SHA149531437c03fdb1f1da51f3e62cf803535d013ad
SHA2568b1c73c3612f181112a2c89f45c0da53d16a33c5aa9673b1b4f7dd52589be5b8
SHA5123038fb599331d67f0b39e8e3c73063fffa6acbddc5bfd3137cf314382ecf35e5812b775f02f06b60ab97f2b2df2d95d5a7d4cf2610172a45030517f657616a5f
-
Filesize
6KB
MD52c4e8d9d2823d1ba300e37b7bcb2cbf5
SHA1f55b2f2251c1b9644fb477fefb800ce89758d7cc
SHA256a903f00d0c7fa5fb5d10ce5cbef7caf61da1733697a4b44152ce63190925740e
SHA512f839b063b67cc49726515983c8ee9ec618db97a497564c17504d18ec97f1622c607b1e74f7dc2ac9541ace796fb8138f71e822591ae4cd2b9d3cc9c0839602a5
-
Filesize
11KB
MD584ff9a47d8a7df5dfa8affec7edfb7a8
SHA16792c9f7b1246fe804a74b6a9be6fe1c9aec0f22
SHA256f3ae40665c1eb2c8eaaa277bfa287a2eaa86950900166449cf70e4d38483ff8b
SHA51244058ea045a4e990e59a62f0239c5541653f24a46cea261fa812b25dfdd44d236672e4faf13777a57b156927e9b4cf8b6c17e8b1e34e2c00226381698e14967d