Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
394b902051e2aae0de0d9010ee770b92_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
394b902051e2aae0de0d9010ee770b92_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
394b902051e2aae0de0d9010ee770b92_JaffaCakes118.html
-
Size
57KB
-
MD5
394b902051e2aae0de0d9010ee770b92
-
SHA1
c77d864d1c403eea3130ba05bc006dba1396af9f
-
SHA256
5bbb4c49becf905bd10421216d4bab09f5f961dbe5ae590b4c5b78da3aba4ee7
-
SHA512
f48ec7700accd305a572ca2d1eb581f5b6c27cd9686a9133721c176d2484d8c8c5694933781ef65fddec94c6c062423ddb460f74a9ceeb616afc2f81ee651ce3
-
SSDEEP
1536:gQZBCCOdn0IxC6+bZfDfffgMf2fZf0fZf/fqfefnf9flfnfXfkfgfCfUfBfHfzfJ:gk2l0Ix+rXTuxMxXSmvldfPMo6M5PbSu
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3696 msedge.exe 3696 msedge.exe 232 msedge.exe 232 msedge.exe 3348 identity_helper.exe 3348 identity_helper.exe 872 msedge.exe 872 msedge.exe 872 msedge.exe 872 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 232 wrote to memory of 4152 232 msedge.exe 83 PID 232 wrote to memory of 4152 232 msedge.exe 83 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 2672 232 msedge.exe 85 PID 232 wrote to memory of 3696 232 msedge.exe 86 PID 232 wrote to memory of 3696 232 msedge.exe 86 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87 PID 232 wrote to memory of 3764 232 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\394b902051e2aae0de0d9010ee770b92_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99a5b46f8,0x7ff99a5b4708,0x7ff99a5b47182⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵PID:3764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:12⤵PID:2528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:2900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:82⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:12⤵PID:2716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:12⤵PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:12⤵PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12108166724313974059,9781957937796028488,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4380 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:872
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4980
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD504b60a51907d399f3685e03094b603cb
SHA1228d18888782f4e66ca207c1a073560e0a4cc6e7
SHA25687a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3
SHA5122a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91
-
Filesize
152B
MD59622e603d436ca747f3a4407a6ca952e
SHA1297d9aed5337a8a7290ea436b61458c372b1d497
SHA256ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261
SHA512f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD5e3848cf4dab2587be059bddd176ff4f6
SHA151c263c9d0ec3d7b823598bcc908dbe87373b969
SHA256af243f9cbf4348f8aa3c1e3ebf3524052885834a7ac9080359b408f2e2f92b8e
SHA5123a822dab6704ac267bcf1b309e5a45492fbbbcb29a3196d0a2cab00321c31bfd9b017c8561441872949213bebccbfb24986a2f8e433bd5d6440f411aabe7d1d7
-
Filesize
1KB
MD5016cd4df4b7166b3b536d4522996b219
SHA1b2d88e3df0baef207d505be75c43c01a4dbd3659
SHA25667091b86cb1a9096dfc773e8f87b632840097a0f44abed4a202a604b8f9e8a96
SHA5122648da48f19cea1aeaf3bc7d089bad893084862c46ff01f2d63948f2c3566a068943947cb5d4d6217d8ae171d7915e390c044009621466c7ebba474002321b3c
-
Filesize
6KB
MD5ba5a60411b98ec895e801a6af389a0b7
SHA126d5d1886aee9b602f78a55e6402795a5eb556ce
SHA256608da2660069aef578db126529745fdc782f1567eca0de7b2b23b1bd4decdc6b
SHA512d2f7d8efa7a5be98a40476997252953f2e4a69d0593dd5611aaa882e925e07eb790367c70b37cc593de8ad557ecc4f36cb03ef2d9549d323107628dbeb0295e3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb79a890-650d-4686-a5d9-2345f9524daf.tmp
Filesize6KB
MD584109240668a85ed9bc1a1f25eca0c4a
SHA1abe7d1270c839544837947434fd930aeb69f4fe1
SHA2567726d0a87f05328e6d516ee0759cf601c653ca4f97f04489654ed7ca9416cc11
SHA5128bc4b5988ae1cd330ee5c7e2ef0609b741cdc69cdd318358b6cb880699a500a7c9d5719abe18c59bda51d282387b61ff2f7eee944a28b484e51974eb3abb4699
-
Filesize
11KB
MD5a44b7c15c7c454faa4f179ea4899255f
SHA1b3bf535174e4e56595e24570cdafbd1188e519d3
SHA256c4605481f731adaf571c0001c8722fecb806b68d9112c30b26f96d743424d970
SHA512d76304213d66a203dde042f01a95f1b929284629dd0c7bfe09cf56313be9f07ac4d977461c153e234dc8ee3e2a0b1b554ee8ce2de16f43d047d81ba0e73d04fd