Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
306f637f1faf60d0dc76dea565635c69_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
306f637f1faf60d0dc76dea565635c69_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
306f637f1faf60d0dc76dea565635c69_JaffaCakes118.html
-
Size
12KB
-
MD5
306f637f1faf60d0dc76dea565635c69
-
SHA1
9012082e093309fabbe1c62663a4182b86eea15a
-
SHA256
d2b691f92d8bc8d4be62648074d80c00b36a4060d843250b53585342b4b8fd67
-
SHA512
80caf3817e54804d867a599c75baf8b2abcdcce3b48b7326a4d0633d539814824f36d25de7bcf2220deaa9f62c16eedea294be5681f9d11b98bf9fbdec3afbad
-
SSDEEP
384:sdlIcDVEjR6/gu5ByZqnujhKh0ImzguLZ:Aghsx6xLZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1408 msedge.exe 1408 msedge.exe 2384 msedge.exe 2384 msedge.exe 5076 identity_helper.exe 5076 identity_helper.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe 2384 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 3788 2384 msedge.exe 82 PID 2384 wrote to memory of 3788 2384 msedge.exe 82 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1000 2384 msedge.exe 83 PID 2384 wrote to memory of 1408 2384 msedge.exe 84 PID 2384 wrote to memory of 1408 2384 msedge.exe 84 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85 PID 2384 wrote to memory of 4428 2384 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\306f637f1faf60d0dc76dea565635c69_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9843646f8,0x7ff984364708,0x7ff9843647182⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:1000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:2668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:82⤵PID:844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:12⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:12⤵PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15102092267373615582,4771169773277455162,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3868 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1532
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53c78617ec8f88da19254f9ff03312175
SHA1344e9fed9434d924d1c9f05351259cbc21e434d3
SHA2563cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed
SHA5125b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c
-
Filesize
152B
MD509c7ae658385f6de986103443217840b
SHA1298d880503edce4413337c09d3525f27a2edcd28
SHA25691e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7
SHA5124e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD5abf165c348fce3219ac8ac3e201de167
SHA1d824df282db38f48cd00a162d56075a7b2a7a769
SHA256bcde5ace6c30595be2cde07a1e58af64df399b42675b7ce0dc55752786621db6
SHA512bea722fdc5da7367067eb5a09881e32c6f94e21160d17e638e53a21a8da4890ce20110a498f20eda012815d4288df03710a5e896d203b4307f247e131c5dceda
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD5f35626682402611475ecb4c9f8d6ed11
SHA182b701f08803fdb227ff375e8299d1e788b0b0df
SHA256d847ca63d177181e0a8123fd6684542ff749a6bebad082e69b10c55f441eed62
SHA512d5839e535fecf0b2eb37d668e4f2a568bef92dcf6844c5cb1d2c16832908e9f8b85db6ca1b86fa7a5277aa7aa87f801566399c396479dfebed531aa5a7cd1854
-
Filesize
6KB
MD5a52f6f7b5fb396c9e2006d66de8cefe6
SHA14cde4c183d7ca57f2922cd61a8a41c421fb20191
SHA256a6461bc96cfb118e26f2fad62a10d3ce12eeac19ed183305ee02cfd2aa6316b3
SHA512770a4792c8e0abf1aef8320d16b9678da176de3b25d59bc626be59c135f0e7f4bff8909914e024a11ec9c150acd69e2efb2350d05b0866ef8eda3e56e993c83b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5cd0da702b2709568ddb40fd7191e7cdb
SHA166b3bcb8e10f8d4fe3b43b462547d8059d661e71
SHA256f2f86908bd30c30773b1eed07da5993615450014bb33d9daa03051f643d1aab9
SHA512e3a570e00382ac28adf123a1723e3bcfc4929eda9bb9e8a8c77ef3468432c211fc443da11d8184825bdfe62e4aae9b91c0f542341fbde69f4f0fb8d51c9d3b2c