Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
3a6388c9ce1fed25535399c7896f9984_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a6388c9ce1fed25535399c7896f9984_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3a6388c9ce1fed25535399c7896f9984_JaffaCakes118.html
-
Size
77KB
-
MD5
3a6388c9ce1fed25535399c7896f9984
-
SHA1
0fa1f60b2d2850444eb9fbdca18cda5b708515c2
-
SHA256
2d513415c7b6425a139e8e2e6464dea56292ea610f4dc7e91eefec335e30687d
-
SHA512
075848ffea0d988037884f6b1da268516545ce4878477c414b0273f6bbd8377cf7cacfcc250bcab6c2fdc409049db503eca4139ebf2e9f49d0d176832fee4392
-
SSDEEP
1536:VneX0LHPlxvG1G3UtSi/mXH7nD9UcVluEFwA9f5BtPBaC0yJwxyBJR:VHLB4zmXH7nD9UaluJApn
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3724 msedge.exe 3724 msedge.exe 2376 msedge.exe 2376 msedge.exe 5060 identity_helper.exe 5060 identity_helper.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe 936 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 3524 2376 msedge.exe 83 PID 2376 wrote to memory of 3524 2376 msedge.exe 83 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 2892 2376 msedge.exe 84 PID 2376 wrote to memory of 3724 2376 msedge.exe 85 PID 2376 wrote to memory of 3724 2376 msedge.exe 85 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86 PID 2376 wrote to memory of 820 2376 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3a6388c9ce1fed25535399c7896f9984_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc883446f8,0x7ffc88344708,0x7ffc883447182⤵PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:22⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:82⤵PID:820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:1628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:82⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:12⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:12⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:12⤵PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,914400429386503469,11131916904437866249,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:936
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2296
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD575c9f57baeefeecd6c184627de951c1e
SHA152e0468e13cbfc9f15fc62cc27ce14367a996cff
SHA256648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
SHA512c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15
-
Filesize
152B
MD510fa19df148444a77ceec60cabd2ce21
SHA1685b599c497668166ede4945d8885d204fd8d70f
SHA256c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
SHA5123518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5c74b0c03bb8586f5d17d886ae828db50
SHA117ba97deac626bbe7c9c925c0ef26d33ddad6368
SHA256c4db1b308c0a381af49215c61186d14c67acb2b5b6c4472419c870998791646e
SHA51221ab0a718573736d388c882f7dc9df3027b346c0683782d20c7d3b90da85a40dcb62fde46c65c6b9c77d9cb3abe5ad91f0395f92a46e4e5ca0af7b6e5d111662
-
Filesize
1KB
MD552e0a6e2350c720e5a0a2fe4e4658f70
SHA1bdf49b924381046edf40c20391a32883c129154e
SHA256dc18e77e36b19a7ecfccf73f29436c9b478232a00d4b11c4d1e76579fafeb1fb
SHA5121c3c180107af9d046c2a20f394d5306e0e3b1cdc0bf050ea8fc382bef61f55849055416cfac8aaa50e427c81cf1c7663f687f3b3298e0fe3f780cfecfcb320a8
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD5fc90f32f6bc591dd675b0656cbdc35bd
SHA1f5a42050babc1c57c336a36b40aed034499dad7a
SHA2566dd25bbbb45a4412ea196c35c751bc1c6030ed7ad96b8306f4ec0ecdbb08834f
SHA5129fdd1177131cd542cab0861b493462cfd619d13f3e1aa3d11f42169755fa3175b7af0716cbd5790641027350e899971cd2a2804b10b00dfe1f0009334a828850
-
Filesize
7KB
MD56f9d340b126e351a499a297b886cfe2b
SHA1d070ebef53b085460930d7bd40134f8b3adad0a3
SHA256983ed5beb2aa1b9e070a7713b9e04d29e4ab7c7320fea455da738015aaf6ef55
SHA5128d93481cb34150cf17e8d397cfed534449f2e22cc0a1a7394c2c8067c28d56eb2a5ec0c5d93c125b12ef3bb2f0ea582f47c31a3bd87e04327b01547ca5da30a4
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD505da92d68d272b6b0d136a64575909e3
SHA1158180bfaff312255ed221847b2e34da12ee8d2e
SHA2563b95c859c030a75c262ca1fc5a1ace74c7352d8cb6956f0a9a5678439672958c
SHA5125461ebb7dae5dbc903d854e9ed843c60f0ef4a998b7211125926bad53181c22f99a2050b0f057ec8f115af1c1aa0f79a0763bb703c8dfa22b66d83b16f676f22