Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
709b2530bd55587f9fb138ab8e452b6c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
709b2530bd55587f9fb138ab8e452b6c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
709b2530bd55587f9fb138ab8e452b6c_JaffaCakes118.html
-
Size
108KB
-
MD5
709b2530bd55587f9fb138ab8e452b6c
-
SHA1
90d16bcf4d6d0fed68b6124a20712010f73771d9
-
SHA256
d0fbaf37c7a32193aaab2f2fa132df60196b6132ec8829e85e6e2a3970852c6a
-
SHA512
60ae4d0ce3e603155d1b98306559d020a3b061d33414ad8d80dfe6bde505fe9f222e818b293bf2d8b04bd1491048f1de293b8fd7b741606dd7975c054662de53
-
SSDEEP
1536:fjOrm46BGax6FQ4mfYZLPciaf5GdDk+Uevc1sVIWlonFnZspee2u6fq9kHXl3TQy:eJW/fqhiyyOsVjQOnQidn
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4292 msedge.exe 4292 msedge.exe 212 msedge.exe 212 msedge.exe 1780 identity_helper.exe 1780 identity_helper.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe 4392 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 212 wrote to memory of 1804 212 msedge.exe 87 PID 212 wrote to memory of 1804 212 msedge.exe 87 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 5032 212 msedge.exe 88 PID 212 wrote to memory of 4292 212 msedge.exe 89 PID 212 wrote to memory of 4292 212 msedge.exe 89 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90 PID 212 wrote to memory of 3224 212 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\709b2530bd55587f9fb138ab8e452b6c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffc54be46f8,0x7ffc54be4708,0x7ffc54be47182⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:12⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:12⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:82⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:12⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:12⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:12⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1101004489942062156,15040510515328392737,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1624
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3608
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51f9d180c0bcf71b48e7bc8302f85c28f
SHA1ade94a8e51c446383dc0a45edf5aad5fa20edf3c
SHA256a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc
SHA512282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785
-
Filesize
152B
MD560ead4145eb78b972baf6c6270ae6d72
SHA1e71f4507bea5b518d9ee9fb2d523c5a11adea842
SHA256b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7
SHA5128cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize384B
MD536b5db37593b781fd9e37488ea1d4824
SHA101a40eb4ca028204cc5c0e6208b1d380be562a57
SHA2561467ce5fc6c71f832e69956ddb182ccfecb66c739f669975770e211f4730317c
SHA51289071f215d8345013d0b52a5b1f2de1b5f1923d82360f1734b1945d7424e3081d5d924f00649f7b56ffe83541cc5043164a2aed9193e944ee38d1d4604016b65
-
Filesize
1KB
MD5da04379dfe9f41d73d7863d2144b47c2
SHA190b60f35e349182854ac43a0da6efb372520ae57
SHA2566760003c4d9c29a859c74f7b3f72b2f1c8101fef57542ec992de18371af5d36f
SHA512fd10a8f0df9975dd92821b38166650d7d39d5da9a05bc9927f84a4b2846a95ef8d774c7c468d9f04e4b011f0db49eb81c3f6e36c70e23252b0922918ea9bf1b9
-
Filesize
1KB
MD54ae13554814a1871eb2737918c0cf70b
SHA1956448436a3f78ef6681f071fffed275c8238093
SHA256f0f99a1a951da96856fb29cb1275b426412ba9dbfd5832525144cff41d43c1d3
SHA51249e418f3d707987222ebb5db27003b8c680f85a38c5ded73d70344f94b04f70d1b5deaec08e3ee359756bd77fb8959f7a9b22d3b54c3314d1c1ea5e0011db574
-
Filesize
5KB
MD5711c137d3adb798f9c94c99199ac8a82
SHA1dc33e8a871940f189731a22e277f85c30c2be5fd
SHA256887c987df8823ba7cb244ee36ceafb35619848d1db5afbddf411e4a554924526
SHA5124c7dc57ff74f0efee1cabc51ee12abcdebd7e0f773ee1099427e990331afe7e5cddbf9003d7949233af152a818182ad576f28aeca3c0edf873cace8a21978951
-
Filesize
6KB
MD57070fd90d32a3fce51eae1c9f8faf05b
SHA186b00dfeb2ffcf071524ad5c83e54e24ee3a7e72
SHA2565e1bd7cb04a3b8b5f71935084ee94ed97e1ead85c35a19b63107ad2635082057
SHA51210cce27e144a0af75e1fe7b71656363d41637a69de7305ca902031bcf41b95f4c13a59bb87261ae6b56be225da115da46f1c7525ead46ed6bb54605f2186eae9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD533da12375176aeab884dd998a9d486d5
SHA11c7827e37ae7af5107f37b7e97b57f23006716a6
SHA2568396bd807ed8f160e34c81e01549d7b677403823273b6658b61b3468c06ede15
SHA51203dac840824ac3bb33156e9d28d797262ee908892310ed9236c72005207078896d7c2b28f96b18985cc510b17523ad82150dedbcab22edea0f4d225b4b46bfa9