Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 21:02
Static task
static1
Behavioral task
behavioral1
Sample
7a844d4cee617767fdf12ef95c57379c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7a844d4cee617767fdf12ef95c57379c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7a844d4cee617767fdf12ef95c57379c_JaffaCakes118.html
-
Size
42KB
-
MD5
7a844d4cee617767fdf12ef95c57379c
-
SHA1
c395c594745214104fc6a4f1f97ba8cbbf967f91
-
SHA256
9a7c606bb7e0c63c1ae0d3575034f1df2b53dd69771a6216b147496ed858b943
-
SHA512
f49ef74f9be80e35be80f402a0529d6c055d5413713edc368e6910b537d00b5c73bc8251c26304735560bea147fc7416dd048036ad3ae0609dd18fd3ea83f42a
-
SSDEEP
768:wNa6pC+hgVCEgG078oNKRyfnfaBbZ80Y1vnE+RaoNKRyfnfaBbZ8eL9+KMtw0PGX:idCLCECAgM9cKMt4X
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1632 msedge.exe 1632 msedge.exe 4064 msedge.exe 4064 msedge.exe 1928 identity_helper.exe 1928 identity_helper.exe 6124 msedge.exe 6124 msedge.exe 6124 msedge.exe 6124 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4064 wrote to memory of 3440 4064 msedge.exe 87 PID 4064 wrote to memory of 3440 4064 msedge.exe 87 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1644 4064 msedge.exe 88 PID 4064 wrote to memory of 1632 4064 msedge.exe 89 PID 4064 wrote to memory of 1632 4064 msedge.exe 89 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90 PID 4064 wrote to memory of 1876 4064 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a844d4cee617767fdf12ef95c57379c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e347182⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:82⤵PID:932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:5384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:12⤵PID:5392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6390731314507733968,10731705554180262168,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5280 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:6124
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4892
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:32
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5f875ce6d9076d6c63f3061aa20c046b0
SHA1dc8e56be32ae2ce5230937bc08c7930a5d0bd244
SHA25641660ecdcd0d139e693528feebeae69c3a5f96abaeeecd2f55f5acf572186b19
SHA5123bdc5e944c286e50d2c46bf58ded601ba72ce5d09b1d53bcbf856ddb91be1ba88fa155d30b64f634d1865717d953b9b6ea73ba2a921fdf77aac139ba817d8c98
-
Filesize
2KB
MD57c5fbc92bd9f13729ce4d45eaf467096
SHA1d4f1369dbeb172135485387d27c2df24c6355ee7
SHA256db7dd17ab677bc364702a13e1caf3db053197178e7d34a4fe26098b4db748550
SHA512b00091bb81db961432f6a4e349bc177617ffb78342d698dfe16996d2b90e30871ccc09534c4253e9d676de06d00cbec1b104d311bc8cf755aaf874ac55838735
-
Filesize
5KB
MD5b8f5acc874234c4053de5ce3d3104ec9
SHA12bc0aecf15b4629b2a59078c83c0129f0b23e463
SHA256b0640b6350977be4e5e61412163616371206bffcbd42dede6adad0393b7b171a
SHA512a55cdbf2d0f3977c8ab97a86f71c6340d29d980f43453e2be21255259ec38ced4280837f817d31ce591e24114e7eb42fc79d14ccaa756ba0749748134ad03329
-
Filesize
6KB
MD5f50910455c0e4df184405065b1263c33
SHA125883ec422243f90eedb40c4a2420d66e603a28f
SHA2564430b6d3ed206db9c4d25b9196fb29ef47b9774bdf4b0dff21e84e92587f1575
SHA5125774c76df6259fb0cc05f14101e012b95c64a47144b919a49272d8508ff4db4dd61bb564509239cc218ff3bcc1fbcc6b47815cb7b46fb3cea0ea5592624a070e
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5101c6a5ced404c4ef4aeb1aaf2e14339
SHA1128b38456865974a8a282467c833cfe647b24e78
SHA2569be57ac70898dbb6efa6a772f2f461a1b534a3ad4a3cec90517366e57bca617e
SHA5129d75cc6e796e3d0a5cc05403d0037a21c0c6efa741e9a6d9ad6ce2ca6ea32d7266550fe3dfce5b6d8f88b473e5695f9d5dd06d691f00c9eed34e54b337f3291b