Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
7e5cf6dff8b3af02461f6a649f690a04_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7e5cf6dff8b3af02461f6a649f690a04_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7e5cf6dff8b3af02461f6a649f690a04_JaffaCakes118.html
-
Size
117KB
-
MD5
7e5cf6dff8b3af02461f6a649f690a04
-
SHA1
605412e8e12c1b998d1e286d3e76bb4e77119132
-
SHA256
2b4e68f963b098a76d861aac9b8dbd455f20294dd257f80ddb46e27c0bfc870f
-
SHA512
06f218a45a5c03242841b197b3134d15887a4ecc101ada4448574d23658c70d9609459ef3a36d9df8ef5bb2b78a6d8143ce6026b8f8fb22afefc8a5685fd1f74
-
SSDEEP
1536:STmWqBfzEBk3srca7HWcsa4e/uTG8vMHocRnD:STmWczEBJW9MHoy
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4716 msedge.exe 4716 msedge.exe 8 msedge.exe 8 msedge.exe 1388 identity_helper.exe 1388 identity_helper.exe 5244 msedge.exe 5244 msedge.exe 5244 msedge.exe 5244 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 8 wrote to memory of 3764 8 msedge.exe 82 PID 8 wrote to memory of 3764 8 msedge.exe 82 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 1580 8 msedge.exe 83 PID 8 wrote to memory of 4716 8 msedge.exe 84 PID 8 wrote to memory of 4716 8 msedge.exe 84 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85 PID 8 wrote to memory of 4164 8 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7e5cf6dff8b3af02461f6a649f690a04_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe401546f8,0x7ffe40154708,0x7ffe401547182⤵PID:3764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:82⤵PID:432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:12⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:12⤵PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5326166935896592299,2104501575278545473,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5244
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5112
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5f3cd412774d2468c306b8e24c870eb07
SHA1ba9b1c85aaf80b57c4fbdce4e855256ff03323ad
SHA256d63059139d8b1992afddd69e4e2ed83c8629383cf70fe8e297a631c30cb38f04
SHA512bc83595880e7ceba0e07ebde2763963861db6cbcd94ca8cc1c39eb12840b7174150bacf5a664cc1823e9479a8ddf1fda11babf4bbf14dea408032c974c5611ac
-
Filesize
397B
MD54f89310843e7df1b23e462f5cba2a2cf
SHA1951ca55cce9801f3bf5643417e906fece85767db
SHA256bb09aaafbca50b53f4f9cf6b8cca083b2c0c78a8851c3332df2ef47998cc91ae
SHA5121a7c4467cfb52d6cd660cc93a4def20aa312087df425963b3d954c98ad0e3927a96f823f6fc3912a81b551f05e85e6954abc6f53642fcfae30dbc00d8c92cf9f
-
Filesize
5KB
MD571592c0213cce75892a3a9cd1d1d17e7
SHA1b822ce2c754418afd25ce1b0c7c4fd100a0c29ba
SHA256649844e3b6817c78a5de212522ba0cb4ae5f3bdca23adf92328a83eba5b9b894
SHA512e3a8e851ba47297e54d2b995fafadcd3d76ac0b1581442cfe2fdf74c036ef67f5bf5c1b1f56ecc7952d7b1f52d5e84cdd6d729aaa29eaad79646dfcbbd9f9201
-
Filesize
6KB
MD545b3904e76604259cd735d4d7577349a
SHA16f27b531b4daf8ad48f9296e67803c885ac9e44b
SHA256fd4be5ef7f3d4f056d7efda5be81cdc19eea12a9d3d08c96dfae396bb294595f
SHA512d853ed4b51945f1dc6d85de0353db6c2d505a52be86eec874ad91ee43e61ef89502845ba92dc8164cb507033d7bf34d64d0f9389249aa6e0c1da55c69035fded
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5e3077bc9b944c12457de3fc10ce5cfc7
SHA15677b7b2b98e6b75282b2f3e1e4f506130e5c655
SHA256c7287096f4ab24272d54e6e3f6d7da7fc283df3b7c4da7b39bce4d1ca38ecd72
SHA51244b3115983f2ee6c51c0308daad78a053e85a9295e1eb80ab17f3c9212577124aff5dede7f64672efb585e35f5a110ae63a98ad4e13f477d96d7f9f46c904178