Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
a475245d915b4058f0eac0df1888348b_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a475245d915b4058f0eac0df1888348b_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a475245d915b4058f0eac0df1888348b_JaffaCakes118.html
-
Size
69KB
-
MD5
a475245d915b4058f0eac0df1888348b
-
SHA1
7d828ea7b61ca07c6ecd3893aad08424f70914e3
-
SHA256
6f5e79504908b158b9448a9bc668ce8064bbf6cd0fcf6e4208882b9efa13b79e
-
SHA512
b559fb5567590baaa98f87ede1c1f77786b3a9244b479d6c7b038fce2463737d4e3d5d94fb1b431c2e01aed62cac9a3484a2bff515a0f74e48fceedc856e8b06
-
SSDEEP
768:SQ/gaBgtYTSx1ZPrw3Vi304IL7oTAxMCzqYTvsCBF07nksl9kaMGr:SQYDFSViE4IL7okzfvTaMGr
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3132 msedge.exe 3132 msedge.exe 1120 msedge.exe 1120 msedge.exe 1272 identity_helper.exe 1272 identity_helper.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe 3524 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe 1120 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 2516 1120 msedge.exe 83 PID 1120 wrote to memory of 2516 1120 msedge.exe 83 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 2944 1120 msedge.exe 84 PID 1120 wrote to memory of 3132 1120 msedge.exe 85 PID 1120 wrote to memory of 3132 1120 msedge.exe 85 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86 PID 1120 wrote to memory of 3976 1120 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a475245d915b4058f0eac0df1888348b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa228f46f8,0x7ffa228f4708,0x7ffa228f47182⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:22⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:82⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:12⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:12⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:82⤵PID:316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:12⤵PID:1376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵PID:696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:12⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,8935991073575892680,9918846744212074045,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3524
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4300
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize408B
MD50203b8a0fb5ff1eeaa962899556fbd67
SHA1230b3e4a14264cef02bac264146b24268cb84b8e
SHA256734417cb703aa3dd010ed5498095f55e60f42bac86105b93ee21da2eabd4dd3f
SHA512716977e80b44957788789687392829de20bf41ac2d0e8e0bb3b3ff39f092c95b972caa7657ba03278e55b2b008819ce1546f690087dba14a46b04ab0a0d7b91a
-
Filesize
333B
MD5ee57360b409b7db75dfb1640805c2856
SHA1dd6c9c8c702bd6c7f960a8b2c6017d9cf8dca850
SHA256206d60ff675449f6b880c83ce18d1b974acdfca7b8b5ec5d4f1db96b265acbbd
SHA5129513383eb0e93c9557592d60584b3c6261a638d93ea7d4442004a039fd5644e7a5eaf2d9ce970567de52c39bf9aaee9e2b327d18446140c8d41ceed894e4c3e2
-
Filesize
6KB
MD5ad64786bb2dc777352ef0139108ab76d
SHA1b2cdd58c6f72126de80540da77916c26eae434e3
SHA25659b1795fccb218211fc7af59e7f0448f3c88dcd75995d84bf8cc969d0ba05c29
SHA51287ef2adaea5b52da0484dabd759a9387776095108a8d9303a18610c20b24611283db33c6e9adbe3ba991b919a834a58e42805582a9d4e29563a73c30aea3489d
-
Filesize
6KB
MD58693967dfdf47fe22c3141c07a53ca51
SHA1925306f69b60559782f0056438d16c1eac63b043
SHA256d473efd5aa59bff2fb4f7e690297d8307b98191e2e3dec42948e6df043c90bb7
SHA512dd86fd27d1b0463a20a513f0627125d846309dd7a58fe41f3756f5421ba0632e8e7f83bb73ee643ac916d9b9387d5fbb392ad6663267d2207f8f6d5fffe67fd7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD559ed2a584604320e876b76ee79c3ae37
SHA19acf12a9926d8116105150d8a883b6d256457720
SHA256f943bc335fd2ae5e016efe9fa2ad405cc981c89a016dff3647133eff9da5dfb6
SHA5127ee7de0144688c51655adc49898967c9e19596808f34a51feeb311b975344d9160e487a6af44aead332c73cc697269817a450461d50e0cb21a55bf63b317e2c7