Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
2c3432d79d5e835da56d010831aca55a_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2c3432d79d5e835da56d010831aca55a_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2c3432d79d5e835da56d010831aca55a_JaffaCakes118.html
-
Size
57KB
-
MD5
2c3432d79d5e835da56d010831aca55a
-
SHA1
e05a3bcf72b71b84ce7decf2a7f625cb94193303
-
SHA256
1a59dd674e129806dbacac17f0cd69959c4a9d2077383037430c4872666791df
-
SHA512
993491031b0187d09ccc59edc943fde102437bf3f804feddb36c0ab6d944d895f17c45bec65150f1b122d0dc325b1c16eec238b7cc894fd0034cea613f93bf68
-
SSDEEP
1536:ijEQvK8OPHdsA1o2vgyHJv0owbd6zKD6CDK2RVroNWwpDK2RVy:ijnOPHdsR2vgyHJutDK2RVroNWwpDK2m
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 920 msedge.exe 920 msedge.exe 3248 msedge.exe 3248 msedge.exe 3956 identity_helper.exe 3956 identity_helper.exe 4780 msedge.exe 4780 msedge.exe 4780 msedge.exe 4780 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3248 wrote to memory of 3536 3248 msedge.exe 82 PID 3248 wrote to memory of 3536 3248 msedge.exe 82 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 3824 3248 msedge.exe 83 PID 3248 wrote to memory of 920 3248 msedge.exe 84 PID 3248 wrote to memory of 920 3248 msedge.exe 84 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85 PID 3248 wrote to memory of 4836 3248 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2c3432d79d5e835da56d010831aca55a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcff8346f8,0x7ffcff834708,0x7ffcff8347182⤵PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:3824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1952 /prefetch:82⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:1536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:12⤵PID:2228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:12⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:82⤵PID:1500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15313637199627756699,9291029914866969664,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3840
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f0f818d52a59eb6cf9c4dd2a1c844df9
SHA126afc4b28c0287274624690bd5bd4786cfe11d16
SHA25658c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61
SHA5127e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509
-
Filesize
152B
MD50331fa75ac7846bafcf885ea76d47447
SHA15a141ffda430e091153fefc4aa36317422ba28ae
SHA25664b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a
SHA512f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91229e8d-39d7-4cd7-8c8d-6bf985ebb1bc.tmp
Filesize6KB
MD55608e107efd08d86cc59c6492331ddde
SHA1c5df0b464086e6fe178a471e05c93dbefaa9559a
SHA256ed06e36cf42287b991e2b7e5b23e2dd91631f2ded4c89fa1aa183d705793dfa1
SHA512feec33e687490beac323f590a844c6275c49034f079a99439b533682e398d022dd53e7170c1f20ba99fd0fc02f7fee850d955de4b89cbf56818f715af32532c1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize792B
MD53381f198481f932178966598f9cc685c
SHA13060d1a08770e382e56fc2ca658c89ba566c28bc
SHA25690389652b385834dc60f1104fb3d6c3eca44a0198ce4a0e048907cfff987f22b
SHA51255825b21c34583bc6bcec341b3873bdebdc9d73c826e530d26bb03d2df11b701bb604bd22220827e45f9d19033d0e48912df5a5a744dfa52329beee871de8823
-
Filesize
1KB
MD5fcebffde3c43445f49cb59b7a1d3683c
SHA119805377526edab950bb216b268da2711e492b9e
SHA256214f34b1ec3875e69cc588c9a825408c7841bac36e0ce1a7b12e72a5bbe79825
SHA512de16df22fc36254d8ebae7f40244d05ac2227de616ceb1a832a406b610f9de3f5e0666fb305666287876773a80c42f96b8df9a2856f6c3bf931772efe4fc7950
-
Filesize
6KB
MD5edc6b3dd09ab13b77b2b9200c672ec7d
SHA16d79b59d885ebd8f89e344945a8e45919b405f85
SHA256051f1083974096f1622e9eb858fcabb2111c3599d1c4e6a144a6dcaec2e95d82
SHA51267b36fdbd9a2ea88323c26d5391c90a99fba2512ac61c4309300055c23beef0369f1a51d31a081e23c8a702e51262aa5d238f91a74f9e863f3ac9551fe6cbc9b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD54b1cab76214c01fee87de60c4f11e337
SHA176ef6754a74010fdba2be96b7ba202bb73b97b7b
SHA25668692e247f8510c5428ed2680479e9b7544c6d6dc8c5d1eda1732b54973db35d
SHA512b5e366dac14081606a0f9835febe5c46dec26b7492ae1390f0133656fcbb99277bdf7d6b2283cf7fe6e84968ac0bf06b876d91a42163be7bb98a4d4401356349