Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
8e8c19f6051baf5a4f8131c7e3912c71_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8e8c19f6051baf5a4f8131c7e3912c71_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8e8c19f6051baf5a4f8131c7e3912c71_JaffaCakes118.html
-
Size
36KB
-
MD5
8e8c19f6051baf5a4f8131c7e3912c71
-
SHA1
34b0f8b640788c5973c8811571c58c6b26320299
-
SHA256
ee79018e2b24c390ff952db5c7e85681216b240f04877000ba2e696205d6d0bf
-
SHA512
0a3e4e3a2e3955507112624a3c6207ff595e5ad8e199df533ee98a451d4ea1a50ce2d134aeeffcb786e0c75b8f9c39de858067933a4b5551b02bf57cf962eab3
-
SSDEEP
384:m+12UmrwWxSjFoFL9IHh0ej6Fnoj/vaMAF7vxylkldx5rHN73v0USDSF7d3Y9sgE:mDwWxWML82nyq/kZKTjH
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe 2040 msedge.exe 2040 msedge.exe 2772 identity_helper.exe 2772 identity_helper.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe 2040 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 3032 2040 msedge.exe 82 PID 2040 wrote to memory of 3032 2040 msedge.exe 82 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 2780 2040 msedge.exe 83 PID 2040 wrote to memory of 4164 2040 msedge.exe 84 PID 2040 wrote to memory of 4164 2040 msedge.exe 84 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85 PID 2040 wrote to memory of 1488 2040 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8e8c19f6051baf5a4f8131c7e3912c71_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7e6746f8,0x7ffd7e674708,0x7ffd7e6747182⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:4832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:12⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:82⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4435084349649516056,9841060000086085654,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5040 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3160
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1672
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5767cae62c2621455b058e88ee2a8e2ed
SHA15d851b677e7d2dda78ef1510eda053ed39546b77
SHA256cac5aa90cf1e500911106897680169ba841c1ea9321e475127b5573ccb815e0b
SHA5129fafb8ae293dfcacd3e2864b1105060cc32cff4dbcb3a46eb6c3bb54b95cf4a33aba6207849bbd4659d90282965936af0ed612a2d8e3cb1e64ff36afb8dae836
-
Filesize
1KB
MD5af06ef2c01f305e70e2154abd848172e
SHA1389b4f310c8582c7bb8ace42d3d8a46de1a5a923
SHA256dd1d934d037badf1dd7cd411ce349b1a2a0cd78076420de25f88ebdc867ce660
SHA5121dd877f0ac594f1721b73b317d9d33e48d7b980152d4627592cbdefe6cbdff5a28d36c77c26cd866ff3377fcf305507326e0c023db050ff8476e2cea68e4293b
-
Filesize
5KB
MD5b24e77c4bfb36eb6b8b2413e6bb2ceb2
SHA1afbcb63be0026305d11879d6e86eca7313755e53
SHA256021e0f439ff77f9c3e6a1ef9503f4f53eefd579098a7c28b9ff8883501a420a6
SHA5122ac05ab0ca5bf2741ab146683abdb2a73f8b363440cbeff46ed871fefaf0b8f2bf1a4372833c6389f709f3bf8c22b95ec88587412997a9206f55d803bf29c22f
-
Filesize
6KB
MD55b2f1e3be2f9eb4dd0efe57011e4f14a
SHA19306770e289f5bb9b3fb8a7747300a91f8914298
SHA25634188f1268181281eb492db377e4ce17e7a4418503f997be60b500411391d51a
SHA5122de042b9851ad97c42adcebcf48a9d3da50114ac0d5049da1d27e591db70c62602300065899624ccc43d4ee098eb3fb598b1d988a87bd200f9c2453e89444ec8
-
Filesize
6KB
MD5d4a17f4e37b20354e615702a978ad68d
SHA1cbbbc7b82ff2839fe5420d29e236fdb29cae138e
SHA2567f7c7b62bc8d2e85e189808602082f81c9cabb8cc45ce10c5580db48a7aac5e4
SHA512557365ecd0ba89d8266b87cdf6191a681b4ac2de6b51bf84cb0bbb8e83e3f68f2c5186444b2f952450214e382a62afe88304bad5302887bc96ece206ee65b123
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5a19747dfcd085ba2bb31e5281fbf94d3
SHA1f08fc1c3ada9b11abde865660ab8035d35f9a533
SHA256dcec5af930135444bb2be1b556fdc30c9cb2bfd5c42c626ba7f74a639887072e
SHA512be0f7366f6ff4e7d0e82ae2ecd243b1eef5bd534ad8962b8fd67410bdd43ae12c462b605d6e986bb41f5dfa5af9ca9f53c10964910bc7ce6349bd5b4e04d529b