Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 22:03
Static task
static1
Behavioral task
behavioral1
Sample
4b9891edac31f299ca5418fa3d1afb2c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4b9891edac31f299ca5418fa3d1afb2c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4b9891edac31f299ca5418fa3d1afb2c_JaffaCakes118.html
-
Size
60KB
-
MD5
4b9891edac31f299ca5418fa3d1afb2c
-
SHA1
070fa5c4548c842db549faee23a893720c3d10f1
-
SHA256
0fbca10d83d6f51ea79cf2cf72352e4a67e32a4c6b0d3604fa20ed862ebe530d
-
SHA512
0661b4d30d46a6a2931032e2f5776592590fde3f7cac80d4421d72f987886113071921a1944b49e2d613ab2205a3ea8b330be03d4d9e44e9c475cd9582d54a95
-
SSDEEP
768:ve13xsOtyHHvPWuo1axKLcFffRASAcF7xVVBVfwZnXiJNZ6EPBZA9/7f/wF:7OUHH2uEaxKLcFlZNYZnXiJnZA9b/wF
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2096 msedge.exe 2096 msedge.exe 3088 msedge.exe 3088 msedge.exe 844 msedge.exe 844 msedge.exe 844 msedge.exe 844 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe 3088 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3088 wrote to memory of 3632 3088 msedge.exe 83 PID 3088 wrote to memory of 3632 3088 msedge.exe 83 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 644 3088 msedge.exe 84 PID 3088 wrote to memory of 2096 3088 msedge.exe 85 PID 3088 wrote to memory of 2096 3088 msedge.exe 85 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86 PID 3088 wrote to memory of 4020 3088 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4b9891edac31f299ca5418fa3d1afb2c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb75946f8,0x7ffdb7594708,0x7ffdb75947182⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:82⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:82⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:12⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,3392677855526537974,2605016800541305649,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5204 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:844
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1448
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD504b60a51907d399f3685e03094b603cb
SHA1228d18888782f4e66ca207c1a073560e0a4cc6e7
SHA25687a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3
SHA5122a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91
-
Filesize
152B
MD59622e603d436ca747f3a4407a6ca952e
SHA1297d9aed5337a8a7290ea436b61458c372b1d497
SHA256ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261
SHA512f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98665429-22e3-40c7-934c-1cbb508e13db.tmp
Filesize6KB
MD54d39d3a23e9701ff6fed8f68a0affeca
SHA168d12a0ea5226a6d03f55439bd2f5c94e6640cb0
SHA2562026ec74e27c81376eabb941b1c2cfcfb3b7ddb5fb8bbea91e5f0addb77d6d93
SHA512c3e232e4ce62ab9da0efe8571dce91db67d6dba4dd8f5cfb6ad2dd746889289f7d559cba6cb0c8918c2a83dae7f3ac2f2901ae7b7d3bc435495ba193ac904772
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD56ce4c3b5b9477473baa691aa2be2b666
SHA1b9d75b8b044adc4b615a27a6f63a3a86d71cdd5e
SHA2564923575fc126830c1cc829291519739e0dc33d3061655f63cb8189534e5ff90f
SHA512e7c4e8e6e3343a30c8d05bb38f2ffb93bd0bc4c234719c6171881a7ea5f678043a65ef36380d802b9da46a875141c137a8a5848b6ad92389aa68f72501d967a3
-
Filesize
850B
MD54beb87aaf765361ee9039abfd2967745
SHA19f3dc6628915d52d75351c29d7b177a2c90691bf
SHA2561db30780f61fab609a3ba9fe2ef355ba37fb894172f5e91c6575732909b62142
SHA512ec1eb71249ab61337f4c57ebcf294ec8c4db997dbc0e1570629d078d16b5988a032c5920c02ca7c61c525ae5689991368f8dcbc18fdcbcd8182f080f9b9a2cd0
-
Filesize
6KB
MD5e193b520193d5ba115a71203b17b1893
SHA1bfaaae5876b5a622cd5d5863280929ef6e76c04d
SHA2567031bdc54a3e383fffb7c73e32cb207e6c12e07d11a82e38a767dbcba608ca5c
SHA51217d85443c8fe338270001a594eff29933913cb1a8efec87e40fef6b549959dcd334af12e317d37d261fbbe27480e5d1162a9d877c7c5e0ace4f8a57787142cef
-
Filesize
6KB
MD58b8cf2311137c609bbcc609aed1a43d7
SHA195698561d6fd9c7fb35400f278722462008e39b6
SHA256384d64e13cb74dbdc0e6ca57562b0b56568958520e77dcd606d55aa627c9fe50
SHA512dd2f4bfba456596ad307500128337d30f44135b2c660bc704fc0e66742b66c2c1e8e94551c0fae43121c5f89fece16fc205c946ae8b3758a1fd504187a5088d5
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD580239dd6ef04d79af837c8cb2a10cde7
SHA1010f72bb41e81c6fd4e47ae0fbb408f472cf2859
SHA2563436d14d33d12dabb07ac82c635cd3fe50121918c1d3cd5c2ea8527ba49972c3
SHA512e826d73803f70a9de4b0e0fc6abc148954bf5b152e4bcdbaa7af7e1e773a7495df6a666d7d78fd592268d0c0495c79b47d72f079ff8ea8e82e432d4a54973522