Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
350080735ac73e44c523008718cdf4b6_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
350080735ac73e44c523008718cdf4b6_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
350080735ac73e44c523008718cdf4b6_JaffaCakes118.html
-
Size
31KB
-
MD5
350080735ac73e44c523008718cdf4b6
-
SHA1
577465a13832069ff810eaa887dc03297aea8d50
-
SHA256
5864d9987aedcdbcf64f1f6a3f3984e649e4b807e0c99c94eab67b4c74278d88
-
SHA512
b3b3ea70de833b0821bf76a69ccad0f33b8ea2dcf2acf6c00963a94ba019483523ff1bf322fcf2e5adfbe27954875b0dc84fb58223fa9f65e2c0f96d33ae7934
-
SSDEEP
384:svlIcytn4PWGTHVWl1NeCI1lm5nakto9IATGJTHlSqIhiB/gcXBxon0xfDlX0BLu:SNWHrylWnaEJE8gry2ExLZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2892 msedge.exe 2892 msedge.exe 3240 msedge.exe 3240 msedge.exe 3716 identity_helper.exe 3716 identity_helper.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe 684 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3240 wrote to memory of 4800 3240 msedge.exe 82 PID 3240 wrote to memory of 4800 3240 msedge.exe 82 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 1340 3240 msedge.exe 83 PID 3240 wrote to memory of 2892 3240 msedge.exe 84 PID 3240 wrote to memory of 2892 3240 msedge.exe 84 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85 PID 3240 wrote to memory of 4852 3240 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\350080735ac73e44c523008718cdf4b6_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa675f46f8,0x7ffa675f4708,0x7ffa675f47182⤵PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:22⤵PID:1340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:82⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:12⤵PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:12⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:82⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:12⤵PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:12⤵PID:3692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14012793934619573347,3727252214985079086,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:684
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3860
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52f842025e22e522658c640cfc7edc529
SHA14c2b24b02709acdd159f1b9bbeb396e52af27033
SHA2561191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e
SHA5126e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05
-
Filesize
152B
MD554aadd2d8ec66e446f1edb466b99ba8d
SHA1a94f02b035dc918d8d9a46e6886413f15be5bff0
SHA2561971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e
SHA5127e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD56f8aa8d3984e526f3aa209e5f029b953
SHA1b987ce1452035b4ba5d0645beba883a9399e04ec
SHA256882909f8f7319e8718370009e7f787f031d67514c57a9d98ef2f7282eb8e859c
SHA51246c652df6ae54904dbb3ff448e7bf73175e1596a1d9e6b2e89558c5c172eb6529923c03c7736ccbb3ae27ae3dd099a84635cebd62344ab2eae98a02762f2408c
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD52235e4e47d7182146bc103508a0e09e4
SHA111d47ce9e5e35ff1b68e796b7ff13da6184c8a60
SHA256ddfdc1826f8b94665b647106054a940adf7ceea5641caa7fae223b253e652224
SHA512d518b012105753aa504f07313b7faede32f0d3e83d3c1f66e165e5bc27ae172b37448b02dcae88a356d7eeb620eea969c1284ecfd70670ccb529e9861b946146
-
Filesize
6KB
MD524ebf2c0a1353d2ee7740c7e5e688229
SHA1d156f523d947044a866feaa6a82f35abccf0c942
SHA256afc9b94dbb05df2caef1c7bca89df6c09ffffa465a09407cf1164feb7ddfcdf9
SHA5124680c400b044ae179bd66fc2535c522981f431381df9078c4b74646887568b09cd56f5daf01ef089a365a96334d5e9cc2d5739759e663bcad5268521b2a7967b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD59023b963e340039abce8a7ac724e9a23
SHA154bd1224329643f91912aa1dcd8ef4627b7f8e91
SHA256bc43b5a4c5417734f74cbd09c80f97ce1758ba19aee56c9f5933c305813e3f67
SHA512aa51bb3d96f0813cc43c632ae26af4a1ce206fec639bba1610bb363c093c71680806cc58f21037d855f0b0fc4d6fb20b1be91d02e9b7819ea69d7eb011b3f8d2