Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 11:55
Static task
static1
Behavioral task
behavioral1
Sample
390264ca138d3027eaf92dcd07ced79e_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
390264ca138d3027eaf92dcd07ced79e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
390264ca138d3027eaf92dcd07ced79e_JaffaCakes118.html
-
Size
12KB
-
MD5
390264ca138d3027eaf92dcd07ced79e
-
SHA1
bd9e2cd34202c7db45e5eebf8e41e7531e9cc9c1
-
SHA256
19dc69c943f5ada6e83ec74d308c747fe5b09a35e451382a0942d096525b3ec3
-
SHA512
c27794a2c0e0bec254c3192c743d5f5b27f8d98afb5a3b4d8cda74f899d7ad287baf09e0d1d2816fbf7b1834705cfd5a00e0e6b9ec686dfa65b4c5a95fd32a16
-
SSDEEP
192:kO0hx5jcsCnNNGYY49qikxEJ9HGQyax6ADPSlD77ZbqFKeV7wygViFJKU8NK79+R:kf9cNaa7DK17tZeVMFGX2V
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3724 msedge.exe 3724 msedge.exe 2920 msedge.exe 2920 msedge.exe 816 identity_helper.exe 816 identity_helper.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe 2920 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2920 wrote to memory of 4660 2920 msedge.exe 83 PID 2920 wrote to memory of 4660 2920 msedge.exe 83 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 2892 2920 msedge.exe 84 PID 2920 wrote to memory of 3724 2920 msedge.exe 85 PID 2920 wrote to memory of 3724 2920 msedge.exe 85 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86 PID 2920 wrote to memory of 3884 2920 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\390264ca138d3027eaf92dcd07ced79e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc795246f8,0x7ffc79524708,0x7ffc795247182⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2584 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:82⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:12⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:12⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:82⤵PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:12⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:12⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:12⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16412831771113288401,2266729452537638252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2852
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD575c9f57baeefeecd6c184627de951c1e
SHA152e0468e13cbfc9f15fc62cc27ce14367a996cff
SHA256648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
SHA512c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15
-
Filesize
152B
MD510fa19df148444a77ceec60cabd2ce21
SHA1685b599c497668166ede4945d8885d204fd8d70f
SHA256c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
SHA5123518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5b016798d52210794035f91f943a61549
SHA14e7a707551aad436967f6165a5deaba34e4e049d
SHA256e1c90c24590ff56d0b36a7a225ecab6b3027e2d5c45cba697505c636912ca863
SHA512952082891295b598d0acafeab559fc2b685da236ded98b1aa8add671529b21163277afb04edb0b7370961af49b9c109dd1de1eabf2ee1d7e5d053cba2721bd0b
-
Filesize
1KB
MD5162231c2bf5aeea93786adba272b60b7
SHA15e1c1b33494fbfd427750165671a1ac362bf38d4
SHA256e5f741171db51602234c616e3e637844bb5a89e9420406e1c0fb4b2ba2d9db2b
SHA5121972d1e943b9e7f6130e2be2205a9a71cb1763e9f2b59a34a6513f7099c5d4a6257b3121fed767b4d5178ffc7b761560ee457e0fb761c227e07183c9727a91e2
-
Filesize
6KB
MD55e67fd768d9c7fda4cd54bff71edfd81
SHA17ef52a68317d209670bba3684ea0bf7ad4e6e180
SHA256f9d79e8115f6a1503d5853c12b56f17b1414c2c0c4c46ab41b10ce56976843f7
SHA51234dd5bb7141a4063639dfbf44ae5d3665e556419d7e5d60688cf8841558f54fe22382a75da6bc40ec8467e1230db65520c74395bde95fe05f102fb94213203c1
-
Filesize
7KB
MD5fea899cdf78d2d2991eaafcc6315780d
SHA1c083f046fc321530128d453f9a73b2b76018ed22
SHA2564b2272cb3d1cd7f23112b018f54839447b6e26c08787ab73768d34f71ad654c3
SHA51233f251ec91a22b7cc47fd5436e38d5663fcdaea69d6c10425c33db1b367acf2a868a6cab37e9e9cb4346be6f46733b9325365e4b3317483d43529d0c8e3be7ed
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD51d64f05c3dc3c679225ce777afce51df
SHA13754da652ee6e4d8c11741c68a2ad548247a062d
SHA256ca8cde9bf977ff1e1abe30193591a38ee14a1f21f401d252cf1c3d8b97703b5a
SHA512975c220f2f50cc3bea73e733e6b10988693c51318fe0b27a3a97f21cf121f5da00d89881fa0ad0f9791e422dc3c428162bcabcf82060755f298eb515f52f1727