Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 02:33
Static task
static1
Behavioral task
behavioral1
Sample
20c96bc1f7a226b0e02dcec11ea0647d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
20c96bc1f7a226b0e02dcec11ea0647d_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
20c96bc1f7a226b0e02dcec11ea0647d_JaffaCakes118.html
-
Size
71KB
-
MD5
20c96bc1f7a226b0e02dcec11ea0647d
-
SHA1
657849c4b3ee07f76337c2b062e1479ce5dc50fc
-
SHA256
492204163ef05a03570d640e4cf5e1dea6c4c5996e39fd2386d1748d59237a9f
-
SHA512
9d05c6ff114a4abf100214d584a23ac150fc6a5bf78eddda71c7688698d1666bf05340433eebf8b0fa7333f9b50bdd62889b8c8ae8642b01dca0fd257eb56299
-
SSDEEP
768:Sp0hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/Vy:SvIk/3tnwOH8OucR
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4028 msedge.exe 4028 msedge.exe 3164 msedge.exe 3164 msedge.exe 4328 identity_helper.exe 4328 identity_helper.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe 3408 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3164 wrote to memory of 3756 3164 msedge.exe 87 PID 3164 wrote to memory of 3756 3164 msedge.exe 87 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 3284 3164 msedge.exe 88 PID 3164 wrote to memory of 4028 3164 msedge.exe 89 PID 3164 wrote to memory of 4028 3164 msedge.exe 89 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90 PID 3164 wrote to memory of 2060 3164 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\20c96bc1f7a226b0e02dcec11ea0647d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b7446f8,0x7ff82b744708,0x7ff82b7447182⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:22⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:12⤵PID:1340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:2752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:12⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:12⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:12⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:12⤵PID:224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,8500788875121142267,11757123979139288516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3408
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4476
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c5abc082d9d9307e797b7e89a2f755f4
SHA154c442690a8727f1d3453b6452198d3ec4ec13df
SHA256a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
SHA512ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
-
Filesize
152B
MD5b4a74bc775caf3de7fc9cde3c30ce482
SHA1c6ed3161390e5493f71182a6cb98d51c9063775d
SHA256dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
SHA51255578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5f6d70b275e3372b242b54cf43dbc243c
SHA168e9c851fed0f75614f23cbb02c559e615751da2
SHA25603d7609ef431233a8ade3049d10968319c4d8899b184c1d9c3ed1b2e9bf8cde0
SHA51288b7e48c2d281cd9f19701aa8062b96d62ea44756b7727489e5461060a13f822b90f8aae35853b8566ead03d0e05d0aae6fdb853046ea3c6f6702eccceb7a200
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
400B
MD5690778e0f51f4c6208c107a0fe667c7d
SHA1f31120a0b146780c5160ab3dc8a0a2c9676b64e7
SHA256c06f0e7a108007cf50914b997ae9cdf86e44dfb75710f926f189ce7b9134c457
SHA5123fc92981dfa16a360d393911a4b88ffb19d7bf462ee330b419854f4451b13589255efd477f3a60af9c5453a4e25cf03d11f5f21a0ea83063703b9f9194ad82a5
-
Filesize
6KB
MD5d0b3d96c1dca6627da47c2719d6b3c2d
SHA158edad1bf0c2c9fea8eb4d429e3791007e639e5a
SHA25660fe8541d0bd1dacba9e6c652b0801bef802b1bbe590bfbf2a23f63fc92dcf35
SHA512ea8a918bf483b4bb7e516a32750ac19bc23d49c3c37eff6ce7e408525402b61484c51ba098e2c28750c29f8a3d0dd3bc1865b11e9a0721f7a3742b21526d0da1
-
Filesize
6KB
MD53560566e1b0051d811cd019cdcaf0930
SHA1445deca393ea8c9d20e87a43f5915baa095f0119
SHA2569f8cdc8213fec062ee1356bc732c3d44b049a1f6218a6b1850adcd07244f8755
SHA512dc126c4050ce8c0d81693ab69dace6554dd7973b7edc90ae08b8e189e9211a058a5dd1ea979e6dd843d02ef876099d0b1e0a88d3405ee50029b6c14d3c473ca7
-
Filesize
6KB
MD5ed66bca540ac362609116a86501ec620
SHA1240003841892c67b0c41fd4a5496bb4b9f59ee30
SHA2560310b8aba937f3a5ed083ad42a27aaa82629c252f6a85518311e9a22b05b574f
SHA512a0e5f8d587abc538d669ed146dbf1ff974ff390243e9b73c846eb4176992d2815372142cd41e24c09bfc0f76ff2af37118f891e3674b96cf896678ac28931585
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d820c74930704fc8b4330da1ec199153
SHA1d8b8a2aa61a4c38a5bd00a5b40319da44b7e1576
SHA256dd3eb7879893b74ea49ce0ba6146bfb71c7186db96197e201d9aa76d29a59153
SHA5129dc93992681dfeceaaa54bb527aa2a903222846815e9870e59e0cea34a78071628bc518642a6a355da759d3fc21acc264c7ee100c997acfc230b40e77fdb9b5b