Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 02:36
Static task
static1
Behavioral task
behavioral1
Sample
847f6b2ec7be9bdfe4f15ba285fa30d6_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
847f6b2ec7be9bdfe4f15ba285fa30d6_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
847f6b2ec7be9bdfe4f15ba285fa30d6_JaffaCakes118.html
-
Size
56KB
-
MD5
847f6b2ec7be9bdfe4f15ba285fa30d6
-
SHA1
1df892e39882ae53afc423ab52ccc1bfa3539e62
-
SHA256
977a6b141d612165ad6744c4c7e35f576773102cefebac749e0612c300742416
-
SHA512
854c60ffc268367d63bf57fade06af53369e9a551964d5f7ea4ce4fdf2e103f36beee18e69f2666b0ed1c32137c3f3858c772df8f3de8ce59e262a030b9d18ab
-
SSDEEP
1536:gQZBCCOdu0IxCF7Y+gjmMhlnPUwcsI846egKaUGAaCWaYWASWUqyy0i86uUuw2UO:gk2A0Ixv+gjmMhlnPUwcsI846egKaUGQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1672 msedge.exe 1672 msedge.exe 4720 msedge.exe 4720 msedge.exe 4204 identity_helper.exe 4204 identity_helper.exe 1884 msedge.exe 1884 msedge.exe 1884 msedge.exe 1884 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe 4720 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4720 wrote to memory of 896 4720 msedge.exe 84 PID 4720 wrote to memory of 896 4720 msedge.exe 84 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 4716 4720 msedge.exe 85 PID 4720 wrote to memory of 1672 4720 msedge.exe 86 PID 4720 wrote to memory of 1672 4720 msedge.exe 86 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87 PID 4720 wrote to memory of 2268 4720 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\847f6b2ec7be9bdfe4f15ba285fa30d6_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda94d46f8,0x7ffda94d4708,0x7ffda94d47182⤵PID:896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:22⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:12⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:12⤵PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:82⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:12⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:12⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,14732211158943479095,13085773694096097137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5012 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1884
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:432
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
210KB
MD548d2860dd3168b6f06a4f27c6791bcaa
SHA1f5f803efed91cd45a36c3d6acdffaaf0e863bf8c
SHA25604d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
SHA512172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD552980741eb48bee64ec0cf5d82c68c26
SHA1e2810a8a44d2892c805c237a3f610bcf191e7564
SHA2563d91a2f849daae50a70c4e4b5ed4182025a648f7797ff23dba3305175fd3b15d
SHA5125c7e87da72c04dfcec17536ae94a4a5b46f63beee559282e415a7256399390e0ee4a2d55b36af5abfbaed88be1300769a19cad21142f76c7f7357b66bcd2c9b6
-
Filesize
1KB
MD578a95b23de2e734f4e98ef9cbebed5a9
SHA126605cd1b8674ecad779b4e9932627c4def52503
SHA2569edb74c13a385005a97d0d05695e566947d514b1294cb473c6ed15c54ccc5226
SHA5129dd14b633979c227918410f4d30c33607ba2b58cecb9b751c1090d686d88069f6d3d518253e36bf6ac0ef2e8691364263d65262577b1a5cac126566c445aa21f
-
Filesize
6KB
MD53646208a55f6c40b640e0afc08584460
SHA107736d941b82139b74914654facb2d2e580b783c
SHA256fcc8e09ed1ccd3f442c0b2f0dcd019a64665be7ddc2b38ca09c03277e6cda2c7
SHA5126b9fa71f6c8b8c5cab9aa53da154f736e5688f8ea206c9bf004f4a2322c25ef51ce763f0ce26c91e79476510aea839481badc6183d89cc753da3af8a8200aad2
-
Filesize
6KB
MD56a51ecaa4edadc1f9adc921d591da686
SHA10bf35f7e30a1b8e18bc910899f2cd374ecb24496
SHA256a0ef8c1ab763b55c3e2e1bc92b3c9deabf58fe2161240460d390f54bd417aa28
SHA512f5238e6d47d207fb8c22ad9e9cfd5a09370846c30f91b759d58a13f9b8f73acb3becaa68b7b05a4bce041e083829b72eee96638973142e53ccb5c18fbff11391
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD554a978549b8685cd20affa07a554ec51
SHA18d04dca4f6a469e17e3f5a8bbac15157bebfd222
SHA256878c714b19eec86ab05926e6295e0c2030c8f4ab308170cc674327f136e176c4
SHA512ca0662a53ca582ec94633418a143d664d80feb230926ba819a6e53cafdbb5fd4701f15915ca8388de4e88496f922489781bce5e7fc9b1b78169cbf34349c91f1