Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 06:34
Static task
static1
Behavioral task
behavioral1
Sample
7c07a7ca96954129144d0578b26cce76_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7c07a7ca96954129144d0578b26cce76_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7c07a7ca96954129144d0578b26cce76_JaffaCakes118.html
-
Size
50KB
-
MD5
7c07a7ca96954129144d0578b26cce76
-
SHA1
1e590adcfb57e90ae37a470ba8b63c17ce877997
-
SHA256
5fb1426b96c2341ef2cc79582793b29129524cc15395d7223f8d10b4bcbf0093
-
SHA512
8ed6cace10567667105638c85fd320c9186c32933bbb8b72f47e09982022d4e9c20d31630d63984b6fb38d1d12091a14103a449533bed2103e925bd7f8553909
-
SSDEEP
768:Sm02DueMX/jwfp2LT+ZPO+JFd4z2hsOJtjmj7Yy0QuoK3Rk77o0n:Sm0neM7IIP+9Zd4ChsOJ9mXYyJi+77oq
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4276 msedge.exe 4276 msedge.exe 3296 msedge.exe 3296 msedge.exe 3384 identity_helper.exe 3384 identity_helper.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe 4092 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3296 wrote to memory of 2280 3296 msedge.exe 85 PID 3296 wrote to memory of 2280 3296 msedge.exe 85 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 1240 3296 msedge.exe 86 PID 3296 wrote to memory of 4276 3296 msedge.exe 87 PID 3296 wrote to memory of 4276 3296 msedge.exe 87 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88 PID 3296 wrote to memory of 220 3296 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7c07a7ca96954129144d0578b26cce76_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd952e46f8,0x7ffd952e4708,0x7ffd952e47182⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:82⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:12⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:82⤵PID:4408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:12⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:12⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,15863090310413660981,13722805626606231556,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5020 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3828
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4436
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD57f830abbdffc3e142806242519dd47b7
SHA117bdb73d90a4767e251b44800cc909460328c50c
SHA2566218884a8fedbe2d53b7eb3783187936be8f5ad4231218403653ace6d05fbd11
SHA512d2206fb46488176fbc6b237b1ac5a8a6d034aa06246f428356256d27e00990c6608f2e3fb1cc55dc70d4b0eb42a9ba79c5df79cc53588756f4d7669b564bfa1a
-
Filesize
940B
MD550f8ad4a30fea73130f067ac5ef34096
SHA138fd07cbfc29b1fe122e8a0d64e572db57fd4bee
SHA256993cddbd9c4bb98c8fc392419dc24e19a938cd31ae98ec40a8e0fc9f41e8f94a
SHA5124f81d9f8bd2febd33a296b4eb73ec75c0b9222b826465b5ce2716a810ec233c5c167dcfd8d2e046acb7ed858688f94146c576d95637dd6a4c3a6a82ffd8ba290
-
Filesize
5KB
MD5e989608923e953be1680db099a889f81
SHA127c755eb048f319f9033fa695b6245c318c39dab
SHA25605736566d55071c780764fc4155b097ecb89f417bc9ca94ef6ffa5b2b707616e
SHA512705f74cb89e40e0a69c505e93fa6833bd62055bbc2d3979a6146aeffde40f0ad1e6dfdb439e840406f5fca9b4ff3d8cef91664a06765f4360b69dc21d13ec408
-
Filesize
6KB
MD5481e446be362826a6717391d0c97414d
SHA19b45cd9b62c22f460f82e23198376863cd213eda
SHA2565554dbf08a9b1f1a3155cca2d5155e8930b3fc8003b256a7e914beea9e0dab44
SHA512ef00cb3ae0e34f7c1b5b2d4e09e96c9ab5212402c2f8615e249109472910ed833ecc9e82c4cc087cf85feac5bc2fd83c4e1385ba1749b27f2045a8d9f74c453d
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5119593db934fcb75d8d8c8f78d0af830
SHA1b158e1c031fcb89f4de0428ec05d9c3c5c3c2cf5
SHA2566899cf98c924d48389c65fe3cb5dfd0e2ec17d1e9ae11fdcadbd81d18280304b
SHA5121d6e44265fbbce4798eecb81f34f0a845b309cc29a3dbc5ce15ca88d05c4d74fb910c567c896d867775f74e6d9a7e9678e79300c215b927366ee4436682c4c9b