Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 11:34
Static task
static1
Behavioral task
behavioral1
Sample
2c2e6cc4a5ec33ac34d5aa905ae37e26_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2c2e6cc4a5ec33ac34d5aa905ae37e26_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2c2e6cc4a5ec33ac34d5aa905ae37e26_JaffaCakes118.html
-
Size
53KB
-
MD5
2c2e6cc4a5ec33ac34d5aa905ae37e26
-
SHA1
ed79e575f82cb4f2d80f873c1621ba2530225b09
-
SHA256
5e7c42cdbd7209e69d2ecb569cac0b4ecf92620edb593a00d103633d1161a873
-
SHA512
da204246ae4e244b63bf5acda1d559742e70104705504badb5f148c700a7504a18aec41610ff976bd5e4b7bfe9381ae9787474daa30b27f5a9166e860e13dece
-
SSDEEP
768:9GBC/H5ga9ZxYXNuhP+CtxjnZ9/oLdvFMUw31a+hzpCMH9J66Jw4Yg1t/MP1GL:MBC/H5ga9ZWu9zb/GtzwlaAT66pRQ2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1756 msedge.exe 1756 msedge.exe 1052 msedge.exe 1052 msedge.exe 4528 identity_helper.exe 4528 identity_helper.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1052 wrote to memory of 3544 1052 msedge.exe 82 PID 1052 wrote to memory of 3544 1052 msedge.exe 82 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 4820 1052 msedge.exe 83 PID 1052 wrote to memory of 1756 1052 msedge.exe 84 PID 1052 wrote to memory of 1756 1052 msedge.exe 84 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85 PID 1052 wrote to memory of 1716 1052 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2c2e6cc4a5ec33ac34d5aa905ae37e26_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe931546f8,0x7ffe93154708,0x7ffe931547182⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:82⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:2176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:12⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:3868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:82⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:12⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,931210596885150884,17226049589540495071,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3080
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5056
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5210676dde5c0bd984dc057e2333e1075
SHA12d2f8c14ee48a2580f852db7ac605f81b5b1399a
SHA2562a89d71b4ddd34734b16d91ebd8ea68b760f321baccdd4963f91b8d3507a3fb5
SHA512aeb81804cac5b17a5d1e55327f62df7645e9bbbfa8cad1401e7382628341a939b7aedc749b2412c06174a9e3fcdd5248d6df9b5d3f56c53232d17e59277ab017
-
Filesize
152B
MD5f4e6521c03f1bc16d91d99c059cc5424
SHA1043665051c486192a6eefe6d0632cf34ae8e89ad
SHA2567759c346539367b2f80e78abca170f09731caa169e3462f11eda84c3f1ca63d1
SHA5120bb4f628da6d715910161439685052409be54435e192cb4105191472bb14a33724592df24686d1655e9ba9572bd3dff8f46e211c0310e16bfe2ac949c49fbc5e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD53f2b029da4839271b1e86f953b02bf47
SHA13454f90e8ec4712a32dbdc388ecaa60aa5d6fd28
SHA256df7fe7f8e8a4e0c37eddf750561e8c6bad5f02b35c30190eeb9fb61eba5580c3
SHA512d968dc087edfed7677874c01dad0dbdeba091a3cca880555d50b0f288ac26475ac61ace70dc862ec5f2a42536e2cbec4b671aff145b15b5b150e5e7fa0531131
-
Filesize
262B
MD58c5bd48250406a0ca7eb2b3c75adb820
SHA1ffeacf3a1eb1e0549219b6428ec4af8c5054e060
SHA256a13323db9208c5d8edff0eab641bc5b9ef44044a8b4773b7e026661388089e1b
SHA512b58eebc062b32b6c526160393b9f8758024d09a9b14c0583f2252effb82bff52b83b48efdd10ff814c04bb417e93eedf5bb27d14c224681084ec64b27ae40f00
-
Filesize
6KB
MD5833dc20967c1a9a0c8114607faca4d19
SHA19593c3e90858b8508e3529e022e97f427f3753da
SHA256b7a94b5d9d33e453225300053ffd66d15e94f96a788573c54457f7ae8c081c91
SHA5125bf5f1aae8bb2bea9b058917650686838983c444e845f971dbfc8101312b9acd79b2dec508f4050e78fc7e42640d4fe4475b8386979ad43fc71b6e7155d9abd5
-
Filesize
6KB
MD56faf884264ed84a82d622de74fb9638c
SHA1c3ae233c43f8b326e422f5c56341948d68bd8c13
SHA2561acffaf8df633c8d6133d113cfd7973fd74522a424015477cab8a8e6a1cf9c8e
SHA51209d3aedad11827a43861047ec3fc30d377320907ab027295a7eb88294f028ae0cbc25f58301c5c67af0dc9abd8402e8c1ff5815426d96f507fee6c823a541195
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f4162ab0d351d2ede7ece68a66a9b623
SHA1b24d9dcdd67cb98d04c9c5291d1e3c8154ddfc5d
SHA2561d243b3a8a2d3766d0e3364902fd9a35f0bc7f742b11a9930f64e13d0ca89ca4
SHA512cb1465b6213de803d65ba6a695b89b7ad93d1001cbbc2f8075537c4fe08125f34757b3b35d38c5a675337000d07d3a98edc9746755458d446ba9ad89e530a8fd