Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 13:51
Static task
static1
Behavioral task
behavioral1
Sample
6ebbca682fafbf728d1195b0e265eee5_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6ebbca682fafbf728d1195b0e265eee5_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6ebbca682fafbf728d1195b0e265eee5_JaffaCakes118.html
-
Size
64KB
-
MD5
6ebbca682fafbf728d1195b0e265eee5
-
SHA1
face530e646fae24d309ac6793f880a354587f93
-
SHA256
f5c72fad454fa433555f45086803e449e553aa68a8c3df198b6a2c9bd4d9bcb8
-
SHA512
8e3a4cf02b1cb540df01dbde2c070d15db6a1a63a3f52e62bd52053b418559f11340b8df5bb1d168951a70b22ebe6fd883ccb8c6a7df991e65d6c55541542447
-
SSDEEP
1536:9MVCWjIVBEwwaaFFPPwwmmmmmIl1s8PIX84hprwLxrieTsvPypxwSiSKsx5pC+iX:RWk8QsmvPqr6el0LGBWr
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4368 msedge.exe 4368 msedge.exe 244 msedge.exe 244 msedge.exe 696 identity_helper.exe 696 identity_helper.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe 244 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 244 wrote to memory of 2684 244 msedge.exe 83 PID 244 wrote to memory of 2684 244 msedge.exe 83 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 3780 244 msedge.exe 84 PID 244 wrote to memory of 4368 244 msedge.exe 85 PID 244 wrote to memory of 4368 244 msedge.exe 85 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86 PID 244 wrote to memory of 2820 244 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6ebbca682fafbf728d1195b0e265eee5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fad346f8,0x7ff9fad34708,0x7ff9fad347182⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 /prefetch:82⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:82⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:3160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:12⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵PID:2272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:12⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16404181686425444845,8459664147877205596,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:940
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2584
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5d1e4a14231517513156ad8fcc745a7df
SHA130b1cd053e3cb130e97f29b9ac43d40a4a1167cf
SHA2568aad6015e6a553ae426db5a6ab6c08e7d0bf5af1f50c20672b461433580742d7
SHA5126c6774994abe57fb8da386814a63329087da705e5e829f36f605040007ca6b62d58675b161c3f851d9837731f7c250e2c57406c74fe5435b14a6aa4d588efed2
-
Filesize
915B
MD544d8635586b63568c7436016ef073a62
SHA1f8cc6fbb858255ab4b8312a4cd7c928ebbc4595a
SHA256d10ad88dc214deb6b0c888f3317544587b9e72ebb842c1479365ab77a90adf43
SHA512f923f704038e7bcf3da54cb26b68c595bf4ec16f4541ce5133a1ba6d1709096439675f21ee7c53b35151e1c458497b387aa31eb50da4c9d7b5ae7f4f21a20c4c
-
Filesize
5KB
MD582abdb94ccd901fcc86a269ab6c9cd30
SHA16fd832bccc752f7975e864f37d270059b360f4d7
SHA25692ede1fea4da243a04e20ff6cef481d944d51df547cf48def7a75ac74ef33407
SHA51260de2450f04c874042161a87fcb6cf051490509c120fc14a2da80264ce0d440397e94314f338947276cc7d89a0b73312262935f006ba4a0b182d236dda677bc6
-
Filesize
6KB
MD5bd671504f9896b5ba2180a0ef5c03b59
SHA1617137f9eb4836ac5a6e71f226a44f22d4ba8227
SHA2568c9960e37483b2d2a997979a399f9d95cd1622db634ca99b6ba775fbabf8e603
SHA5123d92bc616bae7b9d0bbf02118a274d63e1264eb02dd478e608b32725d121b3088694d453fb111857210d345572db902d1219c443eabf55317b88683015001eb3
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD56d0ae270986e8b8894bf0096746c96ec
SHA177bc09a2451e53d0d0f2226062ea8902f60d15fe
SHA2569aa08a0f2670d6e43dca9a5845a9cbf89a83dad91fd0ada1c29053cd2b0a1a95
SHA5123dcf1ed1ac4fda85f45dbf9b2a68c17ac7397adacf52f165932ed8504d5f9e2c092eb00e4d53bed497697d7079a4c0f3c109eb15a2cf8b95dd8edca9560e856a