Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 02:09
Static task
static1
Behavioral task
behavioral1
Sample
82a3f26067553e6018783035ef77761e_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
82a3f26067553e6018783035ef77761e_JaffaCakes118.html
Resource
win10v2004-20240730-en
General
-
Target
82a3f26067553e6018783035ef77761e_JaffaCakes118.html
-
Size
58KB
-
MD5
82a3f26067553e6018783035ef77761e
-
SHA1
0ba8bc61b28df800a02e220182e8373f4e59d64b
-
SHA256
90f2e96ea2cfec94886df10cc073c0ae9ae41cb7220dbf2259fa943797d23f36
-
SHA512
c36fa89f134a0cf181cd309764c052cf50e9868d9df7831300168cd366168e6664287bdd29664ef63ed6820c066fd449fbb2554806865be5105d95d39ed1a816
-
SSDEEP
1536:gQZBCCOdK0IxCcXMDfFfyfzfyfNfnf7fBfCf8fHfZfmfgf1fMfZf7fpfVfzfffxj:gk2M0IxWdKr6l/zZqUfx+I90RTxt735j
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4420 msedge.exe 4420 msedge.exe 1312 msedge.exe 1312 msedge.exe 2024 identity_helper.exe 2024 identity_helper.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe 392 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe 1312 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1312 wrote to memory of 4384 1312 msedge.exe 83 PID 1312 wrote to memory of 4384 1312 msedge.exe 83 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 1296 1312 msedge.exe 84 PID 1312 wrote to memory of 4420 1312 msedge.exe 85 PID 1312 wrote to memory of 4420 1312 msedge.exe 85 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86 PID 1312 wrote to memory of 2120 1312 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82a3f26067553e6018783035ef77761e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9807046f8,0x7ff980704708,0x7ff9807047182⤵PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:1296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:12⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:12⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:82⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6296 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:12⤵PID:3932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:12⤵PID:1288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:12⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7923302152938265503,16350479820256776892,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:392
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1720
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD516d2cc2d8a8347e405d36323b4e6ea99
SHA1ea695aa245d20b1e1141f4c18ee5e56f810614b4
SHA2565455c3741232efafea8e3b155a0fecb660800e2e0f19cd2d720281f7cdcbbc23
SHA51285d9d1319d4b4f8442e2fbd22951d7a2836f6456f18062508a5d22031d829a23a1a4453283f2194312ec444eef57fe09ca393c5c1536efabb7495fd301433343
-
Filesize
152B
MD5ee3b30a1359db628dcaf6b053a049740
SHA135bb7a4d99bce5d4ff9e080b6078dd8d9ca9cb1d
SHA2563d145dcba409bab26909c6090fe80bb55a0c030d226f26bb4e04b1bd495f5212
SHA5126825eef8c8fc940d1e21c31e8643f969386fc5c5f467b6ae4a6709dd09f35632bfa2b87f3bc828a8dc6d70533dc7fbfcef6772e2b73586286680f4b567d92c7c
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD5c03fc7874f5a8ed6827d980f3a3aa0d4
SHA184382e66f669d58936263ec152ab845f89b8a017
SHA2565b98e0645062fca3a89463cfa5e1165d5b83a63a02712e408d6e86f779a2cb2a
SHA512403cfccd46edcc3751e1fb8432eb26f37ba07dfb5f1423b835b72d4acd4d67651c3446b162f4777b5f3bb3e7bc48b9c5e9b4572e23b2d22034b7edf35ce5d0d5
-
Filesize
1KB
MD5e88e38b522a9907e45da19d45c861cdb
SHA1acd24d9c578f06433c296f5c928a9aed720ab89d
SHA256556791cc4a9bd39a99d0c2639f6b76b3dd0e073288daa982df9f1de076b317fe
SHA51269d70d180ad285b748fcbd1f71fd9344f2c5a4b160260a49e1b84019de44407d9d8e7d62ccfa0f64421c1ef7d649d59f2a696ec82881f6a0ead4c99545d76614
-
Filesize
6KB
MD543abed2141644688ad6084420d9b1fbf
SHA15be793732ca24e1860774ab249a82b658bb9381a
SHA256a0c9787e67df42fb4701ef632f64adc251c43c0c3084322f107f6705cf264841
SHA512af5e89f25f9a37aa0aa17a908c1d99d39797484251bc3124538f21fd3e45a2f644406bf49801f61d65f023763334de1306805d62fa7e74059064a00e2fc753d8
-
Filesize
6KB
MD5e5f8c8222475b490ed598760930936c8
SHA14fd839c577cb8d9fc82eb059a483e77492eaee01
SHA25629301e824a67105c3b38aaad97d24c27e5a673fee64bda67577bee2be7402707
SHA5124551b083b00271a282c32a36d6c7375a153c7d8c510d1278127e624244aeca9969cf1df84e1b25538a46b96ef9c4125cfa4e7887261f33a9b85b7bc6197177a3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5b57fa0f0bdc43e5b864d02e19ab14980
SHA18853ac1772b137feab9c83ef6d61bb1deff57425
SHA256245ec653683b8372ba689447cc2aa0f1d33f2c140b3d53c87739547f0b436c56
SHA5125eeb628be988e0b448a15a06ffb16305180e8d17a592001abc19886e3644984fd0e1ab0061b8821296fd698ec4951624e3466c06f6370a6e2f36e071ce5414ca