Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 13:29
Static task
static1
Behavioral task
behavioral1
Sample
8a8b409abc54d8ec23eaec81c55d4b25_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8a8b409abc54d8ec23eaec81c55d4b25_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
8a8b409abc54d8ec23eaec81c55d4b25_JaffaCakes118.html
-
Size
70KB
-
MD5
8a8b409abc54d8ec23eaec81c55d4b25
-
SHA1
7a7f3498ffb470a660d37f3101141696c14f6faf
-
SHA256
740bd7d8e9e0e8ee2a2bf2946eb1a132472f0b2b92bae29b465776a43b0bc211
-
SHA512
267650d1742427b65b973958572e8f9283219e61d98c46fd78247a652feab213bde70b31659e8fb6d02694935682da8ac8174b72b7afc962d39a6d1e833822a3
-
SSDEEP
1536:vEijZeqLAEijZeqLGcCrsVdk1vr4Y0oppk/DoW1:vEijZeqLAEijZeqL9SsVd7TopWDoW1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3292 msedge.exe 3292 msedge.exe 1900 msedge.exe 1900 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 3260 1900 msedge.exe 84 PID 1900 wrote to memory of 3260 1900 msedge.exe 84 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 1348 1900 msedge.exe 85 PID 1900 wrote to memory of 3292 1900 msedge.exe 86 PID 1900 wrote to memory of 3292 1900 msedge.exe 86 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87 PID 1900 wrote to memory of 4656 1900 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a8b409abc54d8ec23eaec81c55d4b25_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82ec146f8,0x7ff82ec14708,0x7ff82ec147182⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:82⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:12⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:12⤵PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:12⤵PID:428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12561235781922498966,1825365029979792143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:1844
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5096
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5d0397cf788d1c5416c008a1163eb7b06
SHA127b9040c76ae6da6dfc226a2c947c4060fb98461
SHA2569e8b07edad1aafe1ec2a14a114c94ef43669a5f8449411649d2014255a4e8a9e
SHA51278cc934015a5dda549682b5f1a721e2f600e454f647a887bab82a401b523b1ece255cffc2c72d4cad8f5bacb091ba37dd53d66f3b5c44ab4d5fe737581ed5a16
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5c622902200b80ff988d469ee55068076
SHA1d60073d8b716b04b05232bcf2070255c658e89c5
SHA25629891f2d6aa79bc155ab8deb03044142e6e7ba45423a416a4264e67fc1861d63
SHA512d3103034ae990f4004076bb8f15de1e9cd45229135d90d8420df7173f9d15a1f6e20fba66e24e47a9a350affc9fdd3d57a17a4d9f8e53e65f000a4303a59f629
-
Filesize
1KB
MD580d6421a097e4b0548dd218c14587d38
SHA1e9831ea9cb731befe741ea6968b12cafd36989a4
SHA256e346328d1a149b99b4d723d18cb7c28f45e8ac81ca3d179fb56286655a2df2e4
SHA512fd01861d3abd401bcf6365a5c6e3c4608d7c79ef882ad6c71c7f5d2e4f70911dfe4023f4d7acd4a5b9ba3c79c7f3ac9742419168f43863903fe56b19d8af0a8a
-
Filesize
6KB
MD5e938c64c34d8a396fd21381c4d030b69
SHA12806ce4c30d5645805cb3f63611035578c0b1fe3
SHA256342cbd5837cb478af0665c6139a4b3186028d0b87f4ca65b40ce451b8a7b9d95
SHA5121e4a3c6ba23e6f56cac03b9a83e429d9274d3bb270767cd011ce1f8514697d2550defa67623b9ca968fce6ca23aa00980c6c2ce283a758c210d2e24630b241cd
-
Filesize
7KB
MD5f5e56c32f9ab941bfdd310f47aa5cf65
SHA14b3b65458f5a1b4d20287659bb4930b8b355070c
SHA256217241c150b5078e018b091605bc18deeebafd9d50e109e0531885a0a8eebcf3
SHA512061611558c30fbdc332fddf5f2a4fc9fcee719036938e72b600dd71d572733192a62bda80aa1fa74892790d2086134559eb87c9549ed7595dfd8ede5c116ef91
-
Filesize
10KB
MD507067cc2520f818a3a35ec12827042ac
SHA199708982005d341faa2cc025b83f156515709e77
SHA25608b5878008567c0bff6fda1baa9cae8aa5e118ad4212067dd32c7084dcebe3b1
SHA5122d845c091c0db295ed2b9397fcff2fbbe7ba1f80a47c5bb9b01991db35a051ed568a45699d5ee9a88afabd368dcac2c990c58541361c7ece933ef062f0afb47b