Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
84e30d5ecff15c16a5a46dbc8284e2fe_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
84e30d5ecff15c16a5a46dbc8284e2fe_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
84e30d5ecff15c16a5a46dbc8284e2fe_JaffaCakes118.html
-
Size
55KB
-
MD5
84e30d5ecff15c16a5a46dbc8284e2fe
-
SHA1
2f1e8335e50025582d76d790373e14b23fb1c9f5
-
SHA256
fd7c3426c0be034cce07b55b5bd7fb4631141dbe652bcb98d303141fe0143e29
-
SHA512
742d3171d88c9d982ca7bc8d064aa98688775ffbabed8cf783798e3cbaba11f4b70be4cdc226e5380dc4f089abf988b04eb481bfcde758c3e2514ae2fe943857
-
SSDEEP
768:+aB/FJboPdTI02uN7gWsHinOdB/ZqB+vMzlUpNcjD0:t/FJboPdTI0XpcHMevMzlUpNcjD0
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2888 msedge.exe 2888 msedge.exe 1052 msedge.exe 1052 msedge.exe 1048 msedge.exe 1048 msedge.exe 1048 msedge.exe 1048 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1052 wrote to memory of 2040 1052 msedge.exe 83 PID 1052 wrote to memory of 2040 1052 msedge.exe 83 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2600 1052 msedge.exe 84 PID 1052 wrote to memory of 2888 1052 msedge.exe 85 PID 1052 wrote to memory of 2888 1052 msedge.exe 85 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86 PID 1052 wrote to memory of 4552 1052 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84e30d5ecff15c16a5a46dbc8284e2fe_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb166d46f8,0x7ffb166d4708,0x7ffb166d47182⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:2600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:4552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1460 /prefetch:12⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1048
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3416
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
Filesize
22KB
MD55e74c6d871232d6fe5d88711ece1408b
SHA11a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA256bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
SHA5129d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD51240f68611c793b3ae781a24c46baafa
SHA1ed91fe8db762839eea17788c7abdb365578b0d4a
SHA256521e2c768cedeedce6029a824f924b56858d6163ab4585df73ba90853ecf9a38
SHA5121437bb092d9bbbee2f495c0a6757df1e91c1e8230c4a1fcfe335d2164945077a5ab1673103a400f5a054118d2bad8ab21cacaa682889348fed3c1ae356db03dd
-
Filesize
531B
MD57530e914c8cd1155efabffca1cf202a0
SHA18e41a3b2516174ca42462e7ed0d2aa9da55754d6
SHA256269a7db3fff35f5dc84c6d1292ae9fb036be67ec319fd717acf853a3e2b35536
SHA51253136e20614e2aff350e1e92e0381381da606643886fc6c3e4783266418b988f756ec9fc7ec98d62b2dfe11cc9ac06bafea1803a6c237189916cbbd6a3592865
-
Filesize
5KB
MD541687d6e2fb03b2c3a929851f7627dcd
SHA12fd46401822aaf5ff475cb9b6d2c702b10bb43e9
SHA256100f2f9d04223eb41b1ce8c5c510759ed8204f1fc4420675ac6af22bdf4f2e1b
SHA5125a32d47a4642e7f1e2239af479a8a01b3d3522752d2533cdd020e6cb5f33a321e16727495370fdbc6ac46fff90d4a72e39ef7c9a6fb2a77b0df036e8d38db582
-
Filesize
6KB
MD51200b79d3fa0fec38041b9f414e1600a
SHA1e2ad0eb76fdf995f8ec8316b3dc14a890a843eda
SHA256777d431a92b853fbb54056950abdc1e7cf4b67e3ae5a07c5d18d42a84de91a9a
SHA512839b7991b55eaa9a1c19b2273727e2fbb827e3c771a048e3f7f824ead2a90043a2b39e279449634cbec090000636e0022bd063e2ca3eb598fde5d174245531ae
-
Filesize
704B
MD57d514e65961d3d121fd1e4762b17b3fb
SHA1f865a662b059cfd2eeb469d13a4a1bd016e3a154
SHA2567f540d47ac44a668ff7e7b541753b96dddcf292be166e6fad02087924dfe4c9c
SHA5121d610d9ca2473128f416212f160d9a7a90c60d62535bea3b8a33b94a19e9349fbc1da560c9d5345bffa859874b98cb6a4e4d0a4c321ebe73455ad7c411be0b3d
-
Filesize
370B
MD58c189520380c92cc14888fb59b91e2dc
SHA15ee5faf8d295ce130461d1da26ed7c46136ec3b6
SHA25666b044a49183c0fc820a5ca30add7daff8c3cb7c9e8c2f94194fdfee935e5607
SHA5122318521781a54530e2189e1c8d5f8f32096bbba703074be1d4d90c269c92e82da335cc6b2a2bb933d370fc61d1d65d93aea8957f0af7b47c52a8c3b73d62d82f
-
Filesize
203B
MD5b2ead8b06775db82f7b2222036f80c6c
SHA1fe1e23700b8ee5fbf46b0ca99385b2a0cc0516dc
SHA256c711110d18a0460f9b37634306b6be4209251127fc16ea4f197207def35809b7
SHA51265f49a7c3acb02a144d0018031af4ea2eddc4ef9b6ab4576ca1e4e94c57e9be9589f7fa76f50ec93b77687980d18c18df13a096a5bd7251557b0218bbb37d342
-
Filesize
10KB
MD5a38f84a5c4d339b8e51a7d9446cfc38a
SHA165b393c4a89f9feeadfb3da0175eb3f96d31e32b
SHA2564d6022ca30dd454369681eab17579f1b524897c431d8b3d59cae45dfa2fad2bf
SHA512cbc79685e0df28128c00916a89169c9d1dc10d92aa6331bd4e1236e3924fdab716e8ef73e4f4fb636f673990d14625ec710063e2410e2b7ca5b6adf5e770be40