Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
17/06/2024, 06:47
Static task
static1
Behavioral task
behavioral1
Sample
b743ae52324a49c401ebdbf31787ebd1_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b743ae52324a49c401ebdbf31787ebd1_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b743ae52324a49c401ebdbf31787ebd1_JaffaCakes118.html
-
Size
110KB
-
MD5
b743ae52324a49c401ebdbf31787ebd1
-
SHA1
e8cbe4c4b634d462bd930559fb1be77c0305f211
-
SHA256
1e2ede85fe15d324c7589a10440adf8286faa3e032108da0e7aa80c20a262055
-
SHA512
f59b5b34e8ec2de22f327c84c8cd7169ffcce361544da324741905e5538af0f29faee99450687f2ccb162cbc790fd83e0e9bae9eaa7e7b21448eee70ae5a6c3a
-
SSDEEP
768:STmWZs57fzEBO3+Tf5KssPHB9KOaXmCtWuv:STmWqtfzEBO3+NKsm9K12CtWuv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4532 msedge.exe 4532 msedge.exe 1888 msedge.exe 1888 msedge.exe 2412 identity_helper.exe 2412 identity_helper.exe 4372 msedge.exe 4372 msedge.exe 4372 msedge.exe 4372 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 3704 1888 msedge.exe 81 PID 1888 wrote to memory of 3704 1888 msedge.exe 81 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4548 1888 msedge.exe 82 PID 1888 wrote to memory of 4532 1888 msedge.exe 83 PID 1888 wrote to memory of 4532 1888 msedge.exe 83 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84 PID 1888 wrote to memory of 1796 1888 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b743ae52324a49c401ebdbf31787ebd1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff928b546f8,0x7ff928b54708,0x7ff928b547182⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:22⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:12⤵PID:1452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:82⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵PID:2928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:12⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,10198129597947445388,17392086582149271190,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5864 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4372
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2844
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD51e378c0ef280f5fa8117a83b8d148b2c
SHA13951a5dc515e1066a96981660e15952515df9f28
SHA25678aff23c52c25c402674d37cf83be784aed1b71abb0324b28989fad64b556511
SHA51240c50df920cc1ccee9f53570830c1b1d3ad402355dbbdf2c8ded6c33d986874e3b18a2a0abced75c83bfe548ecdedcd9d259c954aaa9628d60de664e9cc0cec7
-
Filesize
324B
MD5ff17505b02d988cd94ac6b26bf718018
SHA169f3ba890950867b858fb4c1bface08058ddc38d
SHA256d0718af13cae3e6a7b66a86da4da75938d0d6b84bf5f9039f812d588ab9a02d4
SHA512c6570711fc94751163c9a7b8f9932d51b7e472e86707ad8a651f76814408b01e00a0f4710d680f9b168c510bfb527dc3106a254e0747f3254afadbfc73737984
-
Filesize
6KB
MD5c0d1125d143e906286d11282105595b3
SHA1cbba3232b2b0a3ae584b130dafa0e29ff6078f63
SHA2564c924d583c91d6bb04da18895aabcd0adeb56a8a90276fc4c8b58ce32528191a
SHA512e1b76e65f13af7a1f877469707024b0c4b72674cf2d167102fa36f94e3607b339a3615b0e7fee4e8d87238682cb64af8268d1b09a40640dad54a0c7f36ef94f9
-
Filesize
6KB
MD509d83b8866d8a54f0bf1ca3660b1edb9
SHA16d3652a11632b1b6a2acd74eb42a34caa68a56a8
SHA256d3253fa2eaba9c84de425c40fd7c5d3916bfcc925a1b940390af5b536fa26226
SHA5124afc4cff6ff55949648892b346dea33120c48f76b99e699e6948c7da576fef1184672f5c8bc58e4b24ecfc8bc182479efeca233205a95e8cb6e4543036babd98
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5032ebeeb128f436c7b7e2b2f8c1ad9ec
SHA121593d4c57eeff142b0b98fb10e836d5f02688d5
SHA2564919c7fff5d34164136ca3ad4cc610b92655289a4c768a3e2656bf6e115b3a2e
SHA512e6588bb77ef2233a2fdeb7d3fdbfc5ab92b2bab9a172c6c378d4d599ed8e73f096cef51ddb0f125a32cd6ea23043a3909cc59aeafd618b8627495cab8501d7ba