Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
27a7dcafcabf72cff047f4f46d9adae0_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
27a7dcafcabf72cff047f4f46d9adae0_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
27a7dcafcabf72cff047f4f46d9adae0_JaffaCakes118.html
-
Size
57KB
-
MD5
27a7dcafcabf72cff047f4f46d9adae0
-
SHA1
d90dd1633f9477212cb91ffc6481a36da4e7f11e
-
SHA256
d67c7ca3ef64c85ebc78e3545d42454b3c708716904f2accfd37235dd78530f3
-
SHA512
05ed7202b226c825c73f3305e0cbd1a1d302bf652801af91064374db491c953dd87bca5c52b25a2a493935b497743c421d5806f431dfe2699224ec7a5d6a99c7
-
SSDEEP
1536:gQZBCCOdr0IxCCc6Mfwf7fCfHfCfYfifyfQfqfSfDfqf0f8fqfCfkfzfpfUfufIy:gk2V0IxOoT6PaQ6aYCarScUi6s7BcWgy
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3464 msedge.exe 3464 msedge.exe 2968 msedge.exe 2968 msedge.exe 1696 identity_helper.exe 1696 identity_helper.exe 1616 msedge.exe 1616 msedge.exe 1616 msedge.exe 1616 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2544 2968 msedge.exe 82 PID 2968 wrote to memory of 2544 2968 msedge.exe 82 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 2132 2968 msedge.exe 84 PID 2968 wrote to memory of 3464 2968 msedge.exe 85 PID 2968 wrote to memory of 3464 2968 msedge.exe 85 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86 PID 2968 wrote to memory of 1848 2968 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27a7dcafcabf72cff047f4f46d9adae0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc53df46f8,0x7ffc53df4708,0x7ffc53df47182⤵PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:2132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:1848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:12⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:12⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:12⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:12⤵PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:12⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:12⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14357054800092779260,10986677472215483977,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:216
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53c78617ec8f88da19254f9ff03312175
SHA1344e9fed9434d924d1c9f05351259cbc21e434d3
SHA2563cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed
SHA5125b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c
-
Filesize
152B
MD509c7ae658385f6de986103443217840b
SHA1298d880503edce4413337c09d3525f27a2edcd28
SHA25691e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7
SHA5124e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD53032e1de45f262a7ed54c4b02b78b213
SHA150cddbcfa0e7fed32c76d469c289b07ea55034c4
SHA2560564bcf70757d215087fc94206d7d2a4b46f6d2d2eb697f5aeb8e353ad88e866
SHA5127e62a7ed72be98a3ff17f9a08364735d29812491dcaa24ca265b3ced23b8b60c8b2bb3443412c87e74832d2a92eb34d342f8fa3d8f567d36cc87a0e67d369e30
-
Filesize
1KB
MD59e4d81db1541d188faf003e14c3a40e0
SHA135de31121afcf70ac2d1362063b1f1eaba4bcbfb
SHA256572b2807acfdd57a9c9d7ad36fb88b59a88ebfc6e97320eb9fe7eb92186cbcf5
SHA5121a903f7efa50d0da57fd727f7ca02dbb72dc0010650c3ebe24582fe7f8b9ba7ac12b5b1e5d507af3fab04bc91bf9c917947b3a218aa237d0b763f9c7def8e7e4
-
Filesize
6KB
MD5c85a2f7e4e730de703b3ba81390b45af
SHA17b61a21c613fbfba49d36ba0462651f1bb56eae3
SHA25629b680168e97dab60410cc9069e7ee16a762991801c2ab5cf497905cb87610c1
SHA51261c68c249c9483b2fb82140679fbef984703ca048e0dfb8f8cdf810d95f508ca92e5e650b0c7d817dca30b4d531725bf9ba8ef312c2d4328969b924d4033c24c
-
Filesize
6KB
MD5270d40c6e36a537d624698d883b8bf12
SHA109dabf1c5854a1f7d8258c776d8f55462409a702
SHA2563e967beab5a21b26d3d00a4f034b4a79b3306fce31128a34df65fa0ab8ce847b
SHA51251973cc7f7041463d3b341bd61ba4d1c74cf5b2bafea9c2e4a9a96e4f9e444a7f3efee2a60de88e69e80967273d5ed41a62950887e25e677bdae0ea2271a54ce
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD56da5eeec087c522ccd6e735e5dbb063f
SHA1bc1b30b36386c91f49a5d1a8e5a5a836f27d9386
SHA256ca0966ac35f5dcd9fc7fd4fdc53db4985d443fc1820bde201df7b14d773c4348
SHA512541a6f771b27e898ddaa857f3d88481b0255007f8b18e1704f33ac9efe1739c6b6773ccdada7dfa59aa54b2b2a33a8dc6e25053dbca80adcb595cc488e3b31c6