Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 23:21
Static task
static1
Behavioral task
behavioral1
Sample
7ebef52dc5eae7fa6b0a510726c38a4b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7ebef52dc5eae7fa6b0a510726c38a4b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7ebef52dc5eae7fa6b0a510726c38a4b_JaffaCakes118.html
-
Size
39KB
-
MD5
7ebef52dc5eae7fa6b0a510726c38a4b
-
SHA1
69a222f814365808be0f649cac2790ac8cbbde0d
-
SHA256
4a64afe00a9dec1d0bf98b62cb62265d70d639c27f29a79b590bef5e4b0f6820
-
SHA512
a675f59b25e0c458d18048234955bb0b6d85717194d59b68ac7b0e05289808102cccfddd2d424cbfec8aceb5c7c9c1d3ae2efd7a62cfa07b4784de1f192c9fda
-
SSDEEP
768:Fihhhhhhhhhhhhhhhhh/3wDxvjFNUQTeob:F6ADxvjleob
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3408 msedge.exe 3408 msedge.exe 3488 msedge.exe 3488 msedge.exe 4232 identity_helper.exe 4232 identity_helper.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe 3488 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3488 wrote to memory of 3420 3488 msedge.exe 82 PID 3488 wrote to memory of 3420 3488 msedge.exe 82 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 712 3488 msedge.exe 83 PID 3488 wrote to memory of 3408 3488 msedge.exe 84 PID 3488 wrote to memory of 3408 3488 msedge.exe 84 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85 PID 3488 wrote to memory of 2924 3488 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7ebef52dc5eae7fa6b0a510726c38a4b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa4b146f8,0x7ffaa4b14708,0x7ffaa4b147182⤵PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:22⤵PID:712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:4272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:12⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵PID:2532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:12⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:82⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:12⤵PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:12⤵PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:12⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4739537553028076775,2472217054670725516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5480 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4572
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3564
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD59bb4a566396f216afee859e2e1cfbddf
SHA1a18ccb57f1c07f5dc3772d8a140077f164886bb9
SHA2561934e9cdfce7c7b8044cfbc491b2a64a69768392b5b56ad199a2c3222d41908b
SHA512ff040cc6efac3d1e395cf8412d09acd5789bca290dd477124e9aaf2f53952d586e528364de008616578cbed812f68bd556e3718e163a05655df5c49e065bb608
-
Filesize
675B
MD52ceaa59bd4a77318fd64b5ffa4534709
SHA1776ce1bd260bd7387917fcbe71f07f8a9da676b2
SHA2567bc667c7bab895477520b9ce00f9ccd0812e6d2627338728f5e101cb1b6e6c7a
SHA5126a6377deb66c722ed4b6d3de83091c757bb92022a8ed155138e6fdd08e6d817ff5ff4ffba48c53d65981a16427ec754fa0cf5a3d96769320ca71bd783850b347
-
Filesize
5KB
MD5163f4e60dc6768de50fad2c5b2a91f51
SHA19fc29e07578e0328f197d3085382dff515e452d1
SHA256be306e0968f3f1aefbd3bacd96c333ddd34f9e47fe8851928504671718e42d63
SHA5123561fde431acd16d27fe1b0dfda9d27d84eb387ecc1f8e34058b0882093a9aeec365bcb3f37da773c09d6f3d7eb15b1070a0cd9528801a6dfd92ae97ab24d093
-
Filesize
6KB
MD505caf5e561481d2d6665e85af7b8bd7f
SHA113cae05fdc5f4ed23c400694f08f49eb9de6627c
SHA2567edf10eceff2329f929ea693d06406d267058822dec1aa37b27a947777003f4c
SHA5120573979df82f9542545c2b53451bf8e66b050fc79eaf0da7b4d90fbcd161dae0535cb919bdc26f0b3df54be9655c129a9b8248e1833475f8afe9a48166a8d241
-
Filesize
6KB
MD52bec2cbb91de87311ab64c99133e36f7
SHA13916c27761cc60944f9f35757673e45b1c07c8ad
SHA2565c1359a7aaaf2f7828153d86ab0b1707524efb0b3865b262b644eb7399fc5a66
SHA512971cad3486931e9d19db2cf75b82bd06aea90983a19d5853e04cb7cf4ec6899042769f2c2efe8469ac97f772024e479b737120e833a8cbc19c8435b5fcec6862
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD53fe808449c61ce8789d3e3a4f5c6fc61
SHA1bf134a5b5c893c3ee23b997d8cf2017fa50b6e27
SHA256730a84d38ffb6d776f9763f5ffe25e5a979dd0dc165b5b28939f271a272319e8
SHA512d281947b2226e734fc0169eb16799f81d32c7b8bd7de165fe29f54656b6d8fbcb1c2452626d16db0c0660cff9f3d47eda98865a591a2ce82549853a9a9176099