Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 15:43
Static task
static1
Behavioral task
behavioral1
Sample
6f04c76848259f38d14a48dd78143857_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6f04c76848259f38d14a48dd78143857_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6f04c76848259f38d14a48dd78143857_JaffaCakes118.html
-
Size
27KB
-
MD5
6f04c76848259f38d14a48dd78143857
-
SHA1
ad6d646e10a0a881a82f67419cab9c3eecbeb190
-
SHA256
67efe1d775ce3ce444bd66eeb21f95d843c8a35c7f631ae6ad890b08ef2cd5e5
-
SHA512
652e58a337926f5e3f44f78aaab45faf75b31c4dd6a2963e7928a4a8919277b1d85277f4f46f6816556ee6e11a5213eb26a2361d14d899a75dc56a5b1e52d104
-
SSDEEP
768:r/164gVSpr0sB+3/Asupgp+w6EEx/kz7rA90rcmYj4h+w:r/165SpnB+3GgHEx/kz7rA90rcmYj4hT
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4628 msedge.exe 4628 msedge.exe 5796 msedge.exe 5796 msedge.exe 3084 identity_helper.exe 3084 identity_helper.exe 5664 msedge.exe 5664 msedge.exe 5664 msedge.exe 5664 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe 5796 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5796 wrote to memory of 6084 5796 msedge.exe 83 PID 5796 wrote to memory of 6084 5796 msedge.exe 83 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 3528 5796 msedge.exe 84 PID 5796 wrote to memory of 4628 5796 msedge.exe 85 PID 5796 wrote to memory of 4628 5796 msedge.exe 85 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86 PID 5796 wrote to memory of 5788 5796 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6f04c76848259f38d14a48dd78143857_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d47182⤵PID:6084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:5788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:5432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2252 /prefetch:12⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:12⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:82⤵PID:4544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:12⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:12⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5664
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5212
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD5472f3d5272e578332a10e78c978181c9
SHA1815a07e68bfa186cba13765eee04d8971faabd2c
SHA2567df36b7ec6e9bbeeb9cd78e25e5cee2342cb5932c0b49c8a3b43a76a29733cc1
SHA512f863e01a9852513dc735c8f80d0904f864d3a1a4ff79bf0f764abe9efd327301270a4bf637f19627109e4e0dae586a2c211b6476e48b7117e577ca5a318392e4
-
Filesize
338B
MD5db12fea3fea42b700f86340887feeecb
SHA162a01ba2e34809b43accf4f69c6baa71e44c05b6
SHA25647f8a9e5483a71a21c635a36943dd29a4d1e28b618ec38e7c550ffab3048bc5e
SHA5120a06b50bb744fd4bacca01e1185a2274b85e356c0111000b580d44e469f045ed6836b9ae5c208b3e4b02bd0a4ab090eaf2abeb497aecf4f75309db9a8b02a1b4
-
Filesize
5KB
MD56f008c98c9d51ba2eab2cfde48bf4d71
SHA19bf180b4c9074068c76897504a4807148279bd04
SHA25660fb5f63fa6bf2b9e55538df843c3e8fa50e06d3ea2cb42dba2ee3030f6e23ec
SHA5126d5eabc972280e9954ca60baa9bb69a1d50d54a6ec9ddd30155d9ca8c88ebe117c6e840c2611626cb38b6642d22398b36705a482221bb8012a8c8db480e73cf6
-
Filesize
6KB
MD57d52a7a72dcc7452c340311f2889ee56
SHA1fcbcf133fa6a627c27dd2d584b538c62f7057de1
SHA2567e5f0aeb072518a08b5189c04ca5a53cb346a8deaff354df9c850ed40229e3cb
SHA51263d0b35a214d8b5f9d4bbf4cf33d2c316537479baef60a1e0fe91505ead1287efecc041a3cec024a6ca7c6d358d088a90303f66e50b138efaa73956021af97b3
-
Filesize
371B
MD56d4bd49571a556c1178c471318566059
SHA1f6717ca862e6ed3a3811e79157c7fcccf58e46bc
SHA2568e66053c7a92e2a6ba127220fea62be17ad0fa797685cd3a9387bb21c8fd3cea
SHA512877ae9ccfc930f38ea6f0f224bf69f0205fabc6278c46d5a3ab8f4a03d5afa013ab72784b63b32e8304d96e48549e9234a84088e63f574931d44d722c188bfd8
-
Filesize
371B
MD595ffbe44c6f1969d0fa76a60a7522c4d
SHA1fd01ef333b6ed8e4cefc99424fe9a4b96111706e
SHA256520848431b130d8c4db7c84908f40caa928a84d64d8c5ac4b9760d4a1cacf9b2
SHA512e56285fa4fa7c02c2c492327097218844cbc9fd22a08338509f7c1d9745673951c170674bf4254f6435a0d7caec521dc66bc4619879306f5bdcda166c339f023
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7f7c785-29e0-4670-ad61-02cd0847d74e.tmp
Filesize6KB
MD508de874438dcebfa4017cc6e5ed8219b
SHA106c24dc91621bd2ead8208772b10f824656123d0
SHA256793c43260086110e121dc27456d6cbe26f6af2b2fcc14a6a16f5fbf51036262d
SHA5124db5d4c3ead74ac956dd54da6d14605edf996d213762efdc2b69cafbc6db246eccb09a596b7c3cb9d625790715bc636fbf987c449238493e641082c9308ac573
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d5c6551c31bc54f2acab694df3997826
SHA1024e03bc3c7386375f3a47ea0112386ac94b5887
SHA2562d017270b1362a2b8bc7b5f692b4b96d4ebcd5b159963b67d5cbc79b2ea402a8
SHA5126f52570174ea9d38246b437c7a4f3b37e9ea501a1b58aa62d337df9d90e1858efede2823a1277ef2805d9d5156c0166ae424ff510df5c0221b4f9c9462854e5a