Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 01:43
Static task
static1
Behavioral task
behavioral1
Sample
b1292cde6ac89142c36648c5ede40d21_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b1292cde6ac89142c36648c5ede40d21_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b1292cde6ac89142c36648c5ede40d21_JaffaCakes118.html
-
Size
68KB
-
MD5
b1292cde6ac89142c36648c5ede40d21
-
SHA1
4b7b3c7feee8ee926f41c49458d9b255bcfd21e5
-
SHA256
f18ff787c927ffd5f154e8198e54f64b8066a8fa34bc058da56c601af4838704
-
SHA512
f2dd337534b7509cb7695b27d6c1b385583b90568de087deb1e0be114d527e39a15c1a840cf02231cb4225d25560e268de6d558f01e07a7722a65f85b94e092b
-
SSDEEP
768:JiLgcMiR3sI2PDDnX0g6iqRLzaDzPoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:JdYdSETcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3132 msedge.exe 3132 msedge.exe 876 msedge.exe 876 msedge.exe 2480 identity_helper.exe 2480 identity_helper.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe 5036 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 876 wrote to memory of 1420 876 msedge.exe 81 PID 876 wrote to memory of 1420 876 msedge.exe 81 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3352 876 msedge.exe 82 PID 876 wrote to memory of 3132 876 msedge.exe 83 PID 876 wrote to memory of 3132 876 msedge.exe 83 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84 PID 876 wrote to memory of 3456 876 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b1292cde6ac89142c36648c5ede40d21_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb927846f8,0x7ffb92784708,0x7ffb927847182⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:82⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:1364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4841262181391384267,2561390891902731765,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5168 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5036
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4732
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD537b2acc5c6422a6186353492494ca45e
SHA1190de6343ce286ff9f4a06e2313c23479153433f
SHA256d1d94b676803e48fbef898169f5fc45b0e064b0cca2cfb6e3a1352296dd2954c
SHA51220996f5e932651056111d541a4b8f8df61584888bd3a5e7723b35fedad142feafe9c3bcdf004fbc7ec9b32aa0effa3d7a447dd0d52981e647adee360f6221bc2
-
Filesize
410B
MD562aa41ab8a93ac5e10b72aebece96633
SHA152faadd44a36954467d02af14da3630522082db1
SHA256e18b7b3da0d2b542efd69362b935e14c4788e1743df646fc372ada8acb73eefb
SHA512924578717d02e04b2140f09f71d18b1deb1678a78ca11a64d38ee68d7ffca3ef483bfa210059b150bc9b15a15506f7d89f433270408c5efbcbf5ae0a7467242e
-
Filesize
6KB
MD56285c9c0fc26d868ac5b7feeb585e851
SHA178ed61ff9c151a57c2fa872dcaacbf493bb8d76a
SHA256857a50d0252ce9efc27ca58311e83786451b264c9db535648d339de744a05cad
SHA5125ad410e1fcbdd3cb159b134a51210e81bf56ce752fe31145bc2db630b4bf57867443ffc8fa7f705d34bff931b9b22a19f7acc2e86ee77c39b86072ad6a9003a8
-
Filesize
6KB
MD5cf4f012ed4eb55a10236745ecaea1744
SHA109d9357801306c216562edaa60a39cca2b898cbe
SHA256bfea8f6047de4f4bb6dde4ef31700136d7f62c66c4638e2fdb9e1faf528be27d
SHA51268bf3c30435750da5e9b7f113582c1308480ad43cb31eee6fca6d010c99934ca71c4c8c85f6a1747ab1a7e5b8ae71291383d02b082036300348b344a50ec76a7
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5cf3fb1bb663b8ff300d3f86808dd8987
SHA1ce5811758b7e2d640740ec3648ffc7f4835ac1d9
SHA256f33b96d7571f83ee37780153b3651b140be24edb6bd099bad3a117698ffb4bc2
SHA5123e7731a6d022ca070e87da8ac7c26457122476a447f4524085c6dfb0d6b46b0f160371194f48cc4db670da7a87775e4d0c8947546392706e6d135bc4f6722598