Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 08:23
Static task
static1
Behavioral task
behavioral1
Sample
8e02188391b18abcdbce86355c890e2c_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8e02188391b18abcdbce86355c890e2c_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
8e02188391b18abcdbce86355c890e2c_JaffaCakes118.html
-
Size
59KB
-
MD5
8e02188391b18abcdbce86355c890e2c
-
SHA1
d37fe689d112c259713da15329c2f78b72b59a93
-
SHA256
1c14c392c08d78768b01699858d0cc156789e5c54c500e60c2af821736a09a29
-
SHA512
e0c3747dc9f395b5cbd486a6b18013eddabe3d04f214d903a26d5c99798d7afaf9382588ff1376ff45d2d3db735c1b002c3bfe0e1f47731b674d5598784a3bfc
-
SSDEEP
384:7fK0pcf0gHXs7fHin+ghB9erGWUhKjfgda+4085PPGochj+NFZW9atbeUO2UdD:7fKqEns7Hi7hB9errFR0SZCAW96eUmdD
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 116 msedge.exe 116 msedge.exe 4588 msedge.exe 4588 msedge.exe 3312 identity_helper.exe 3312 identity_helper.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe 4588 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4588 wrote to memory of 4644 4588 msedge.exe 85 PID 4588 wrote to memory of 4644 4588 msedge.exe 85 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 4888 4588 msedge.exe 86 PID 4588 wrote to memory of 116 4588 msedge.exe 87 PID 4588 wrote to memory of 116 4588 msedge.exe 87 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88 PID 4588 wrote to memory of 4848 4588 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8e02188391b18abcdbce86355c890e2c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9835546f8,0x7ff983554708,0x7ff9835547182⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:12⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:4552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:12⤵PID:1828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6692 /prefetch:82⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6692 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:12⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:12⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:12⤵PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:12⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9633462178902769607,9469294410625658635,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5884
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3580
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD56593ecafc230132d017741e37607ac9f
SHA154f4f0045e11b9d686c1643431f6aa978786accc
SHA256aa85cf6503af7bd1fa681a4bc745e47721fe91a3473c9f806e4bc05207c35154
SHA5128556c289c6d70df0ae1112660f2bb41eae52eabec2e1924fbe1cc2dd041a5d94158a2b2e1fc7c4d6e739e69f58e1c9e6871b370dcdb095e900c0c6f1efca9e0a
-
Filesize
795B
MD54aa054497e949517a4e0bc2ded4b8ae6
SHA14a9ca755f94bd1f1af239725817e0d808403de0f
SHA256df84a7ae22243f3babaf190fad07dd821a607ab3b38baabcc168d460bd3c7b82
SHA512f79b8c41e6e953cee14d9d176d2c2757cee4d605aac04f5f7211457ea59ce71f3e1f1577761d9ad22c0aaefff23b32287679a5ad088317bab1d54317aef82e2b
-
Filesize
6KB
MD5dd6a2d8d606c17c503cae7c2f48827ea
SHA12783aa6f3545539cd197ca1515570a474e91d1fb
SHA2565d251f5c216cd77b538c007edd1951904c80e1563e4772bf46ef290f0000482c
SHA5121eab44ff047e0d4dafb14b38265e1da909fe5faa359caa1c60b870467757f3e96ab8aabed47c15c955ad9533431114a0004e31aeeac05518c04d405d27920515
-
Filesize
6KB
MD5804bcb9f3f57a0bf88b3cb1739212725
SHA19cdddc601069cad6fc31e358712632e940fb917f
SHA25620f387848ad4e8768e1b7acad0461b11f245f04dda21046ebdd390269a370d8f
SHA5127f3c33636a6b753720fe5f3e545a3a6c5fe014f41ef04f8660b024d82be0f4f541a522b9239c7ca9040ee3bc1d71944e3f3e5e6abad1642b5ce4d86b4b085907
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD52afae72fcfcb93db71c8ae1e85ed23e9
SHA18e75e36cef4684dc3ed9270850dfb025f0bccd98
SHA2564aaf1bd8a7fbba4e828fb1bffdc82a43af3c5de22bd9a071bc03daa7d08dc575
SHA512e231d77888b081948898b85030b5ddb7186ef6c93be41492659c7bb96f5c1bec8e8b0fb72d0079197d0b727cd82e0b5f447c2575f19d801e498869e1f0dc3015