Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
8b7e737d0676be6b0ba558321acb9021_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8b7e737d0676be6b0ba558321acb9021_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
8b7e737d0676be6b0ba558321acb9021_JaffaCakes118.html
-
Size
1KB
-
MD5
8b7e737d0676be6b0ba558321acb9021
-
SHA1
15df6e8a505c1cd95f901080e8d9e98ed6a2842b
-
SHA256
319ea6b5ddd5f886ba7a15625364e454661de06013fe4044b7831d9a1586e7a8
-
SHA512
3bd18ee8fcc4f42fb68cc08d3e06c70bdc0adcf00b0f22f9aa9c859f2d34ccafff60133986afe5e8051920f645dbec908ed398ee027a3bbcdb3dcc00e11eb886
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4648 msedge.exe 4648 msedge.exe 1216 msedge.exe 1216 msedge.exe 4424 identity_helper.exe 4424 identity_helper.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe 1216 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1216 wrote to memory of 748 1216 msedge.exe 83 PID 1216 wrote to memory of 748 1216 msedge.exe 83 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 3568 1216 msedge.exe 84 PID 1216 wrote to memory of 4648 1216 msedge.exe 85 PID 1216 wrote to memory of 4648 1216 msedge.exe 85 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86 PID 1216 wrote to memory of 3224 1216 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b7e737d0676be6b0ba558321acb9021_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0x108,0xe0,0x7ffdf58f46f8,0x7ffdf58f4708,0x7ffdf58f47182⤵PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:82⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:12⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11838736196525515836,536334135460841200,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:812
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD587eff9504d7f11795b77c619ddca53eb
SHA1364558d68ed1e41597949f2ac8b3fc83defa3ebb
SHA256f677ed6304f53e79a0b69e85d18290c045bea4e6f186fe7b8a82494df1109546
SHA512476d17713d940c3bc6ca11fd9f81f789d33bb3ac815c198d591c40011704010a470a076d778814094a7ae14dec77253f069918202791e6455deccf26bc1a8343
-
Filesize
404B
MD569b8d6ec89a4671d6fbabb609ab96b4d
SHA1437503239f85849c1e6518cfc0f37e15ad570f56
SHA256e704653737e44a54400753fbc2b79ae9d7f0d531b4dc3edd429e9073b9cf3fcd
SHA512f12e487afcb42da96157a7c3e0b7db13286312baeb854f02218e50a850ea6f48f178562687f96d98f4a0db5bfde6da495fd4d949777b1a5a9f4b9b8f99c544f5
-
Filesize
5KB
MD587b6d34dd4c72d8bdfb3735752766aaf
SHA1fd16d00fe210b435ec8d3bbd708aa50b82319078
SHA256c6a0e93e25cd947cf86a6996aa30bee5a6017d6fdb896c0c479e0a87e845f0d9
SHA512643bb3e2a72e5ebf88825d436af28fc25f6c4eac47084d5fdf0addd377ffa570958c1e458186554e8448abcb984e9897024894fd64c4d428f45ffe932f32d241
-
Filesize
6KB
MD5903b77fc45cb80ac2272996a236b683c
SHA16a8e0bd229c3fe53d3aea30d3d9014c4ba04b864
SHA2569380ca01a50aabb3d8d6d2f4138cd26734937b29372ca33078c1236604098947
SHA512252b2110f9eae35a59459cdf5e416dd5fd33bdca253963ab62cbdf6dc7265d5f1129f088a538c644300cdf60574544af2f701a9cdf8cdf64225e4a78bac6019c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD574d43f6ab191a3a4431d306b919e485a
SHA19e08344b251ccf027141ec52bf6ba137ff45fcac
SHA256b660ea99b124c66a1693c093368f11584514fb802a697c1f7e63a3f379095a3f
SHA512b5ddee4c6f7456289403096cab9b189ab75a2405c5ee73ce331160ffc1a14ea4152b62a76e2ed7b2de67734421a39e27c78835fd07904838d33ac3861f892017
-
Filesize
11KB
MD538a250cee94e20b4c82a3a239d247825
SHA1d5840ea9b3217067c01a03eb1ce4605fed6bf41b
SHA256dfa985e2f758f4d6a68d7bc556bb3080a7c134b3402da5ffa246d224696cb4cd
SHA5127746cf8a7c566bcac508b33b783f3cd11f7bd048ac825f46c41a4af9879fec984ce41c32966531257253069a22a3a588cd6196a8b1a0a1140425c43c2f497500