Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
87s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 21:40
Static task
static1
Behavioral task
behavioral1
Sample
9951985256280001812e6e213d5f4783_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
9951985256280001812e6e213d5f4783_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9951985256280001812e6e213d5f4783_JaffaCakes118.html
-
Size
38KB
-
MD5
9951985256280001812e6e213d5f4783
-
SHA1
e0fce5084b73a4c20bb60f11ee7af64ede9004d3
-
SHA256
4d5709da60c64dd7522b8cdb4c5783c98fc95aa5f16c0842683773d55134ac32
-
SHA512
572d8cb447b282e7ad3462168b9c05164341dffec48285405afdf39392be69f96f2f3ab8cab91c506b50da5debe41aae9fd46d28779baf039da33a5d23605641
-
SSDEEP
768:8Ffb71bRaTb2vbuDOXY/59bUfYzUkzoGeC01JA4JdYAX2Vgp3P:8FfFNaTSKDOXYvYfYzUkzkQSZGSZP
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4720 msedge.exe 4720 msedge.exe 1624 msedge.exe 1624 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe 1624 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1624 wrote to memory of 1876 1624 msedge.exe 82 PID 1624 wrote to memory of 1876 1624 msedge.exe 82 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4472 1624 msedge.exe 84 PID 1624 wrote to memory of 4720 1624 msedge.exe 85 PID 1624 wrote to memory of 4720 1624 msedge.exe 85 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86 PID 1624 wrote to memory of 3416 1624 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9951985256280001812e6e213d5f4783_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8e0146f8,0x7ffe8e014708,0x7ffe8e0147182⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:3416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:2868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:12⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:82⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:82⤵PID:1468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2504 /prefetch:12⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:12⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:12⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,712260496923431669,14873401644489303085,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6092 /prefetch:22⤵PID:2016
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4552
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
23KB
MD5e1c71f7c04be834f5587230db2ad24b3
SHA1f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA2569fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
SHA512205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5461af27a98fec373daedbd856d1f0ec5
SHA1bab963c48c61234b176bfbb2537c5e6a97fd8769
SHA256f92999c988decc57ae957f802dbbf02d2afa457f5085a807cc946119739458e3
SHA512e1068b6b9fadfab77ebf1516093ca18f963db299d462bcfcdb0c04aedaf3e191facb1942c2f6d60eea214a48deaa235b5768a8ea59c9d93a581afdd9c220b5a7
-
Filesize
6KB
MD56564f11830958cef8dd3ca17c4336b82
SHA19dee3a9f76efd3f9c59ab199a62307ffc8fd4e58
SHA25646edf3ab58403bcb42796d7240db3fc270a4f0c69c5e04fe7cb858f5f09b3bcb
SHA512027f2f876232e241c97a1d80bc79c5ed15c7bf5828ea4b3ccbfdf5c5441d0b40510f855eab9138069ffc928f93a471a6650a09be69ceeab2e67b31ebf51b6e67
-
Filesize
5KB
MD56925a655c5e932b662ab027e0be613e3
SHA1cd988b345bf38ec9ad5ceaf1cf87d45ce1065e08
SHA2564ab389f223bce1782fd84e971a9bc9945bbab120e7e4b4227adfaf896ae65819
SHA512b7a81231278ce7cc73d5c13125cc577e9d11d5eb2b9b9ea9af5ee8af3bd00ef26eccf468d31dcad13f61c6c2abeac796841c78e7050a8efd2cfea19a43d2fa33
-
Filesize
6KB
MD55edadab52c561d3a70e416908f9d6fb4
SHA10f3c29f5fb95337f4d7dc137b5a73e798ab984f7
SHA25625245137f1225669a99ab1008338d488f0aa8b8aebc035e9c5237201a54a8051
SHA51295754a7dab8dc6128385732e7ecd066fe0c0555ac1a237513dd8d0872570b9036e395010a2766e0b23c89808683e6782d859e7261aa01b7b6e412d4dc5172af4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5c0af4cf5cba2a2a597ffba8f348afc1f
SHA10577eddbe43af5b419da46ff4e69ab5090929914
SHA256d36d7ead39c80a1c65c1e0c4c6160ac2c93178bb3f7e99d217995bee2b08be68
SHA512cd5bef0309e9362fe780e3d77e1f1a1cb6c148f0a5f9fb6ac809ccd2be10c02686d4fb2beaf12c176f037fe46e94f7115910dd42eab83c18e24d07809b6e94c5