Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 09:54
Static task
static1
Behavioral task
behavioral1
Sample
8e47283117991c7e1e08bfb968d96dec_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8e47283117991c7e1e08bfb968d96dec_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
8e47283117991c7e1e08bfb968d96dec_JaffaCakes118.html
-
Size
57KB
-
MD5
8e47283117991c7e1e08bfb968d96dec
-
SHA1
b120aae9b5612aa810c3aed08776acf846d934ea
-
SHA256
95b19ea12d1a477f8d7ce5f68ed88a9a20102a8bf25c9724044830f55d9013fa
-
SHA512
4e7f7e79b66c6d7e3a1cb8d9a7314081c3125a92ab01a8380d75ed00e1aaec908bc26a72a8d3a47fba576315989ea76984bebae7fea4a070b51f7c38a795d22c
-
SSDEEP
1536:ijEQvK8OPHdyAHo2vgyHJv0owbd6zKD6CDK2RVro1QwpDK2RVy:ijnOPHdyB2vgyHJutDK2RVro1QwpDK2m
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 536 msedge.exe 536 msedge.exe 4332 msedge.exe 4332 msedge.exe 3456 identity_helper.exe 3456 identity_helper.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe 4312 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe 4332 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4332 wrote to memory of 4588 4332 msedge.exe 84 PID 4332 wrote to memory of 4588 4332 msedge.exe 84 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 4064 4332 msedge.exe 85 PID 4332 wrote to memory of 536 4332 msedge.exe 86 PID 4332 wrote to memory of 536 4332 msedge.exe 86 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87 PID 4332 wrote to memory of 1244 4332 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8e47283117991c7e1e08bfb968d96dec_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8234d46f8,0x7ff8234d4708,0x7ff8234d47182⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:22⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:2264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:12⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:82⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:1736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:12⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,4133023522136890885,17819945472955945854,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5652 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4312
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3412
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d4829218222c8bedb9ffe89dffd37095
SHA1aae577f33f413ec3d09f2e7ff5d9cc20a602241c
SHA25649239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b
SHA51203e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1
-
Filesize
152B
MD515e9c4b4eefb3e1c08a010e748e10f58
SHA13172378f2c7a00553ce086dbf53fcf3126c5a724
SHA25607b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000
SHA512811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize792B
MD54c3afc5f053bd5c45e5256e3e84b85ae
SHA1be7a249702778d54363ac64fc6209ea8713766e2
SHA2565e7b731857fa0c2eec723597b7315b1827205bb69ec8d84298252c4fcd0f78fd
SHA51202ec085425cfcac83f4cc6ebd79fe714c97020351d87027bbf39c6efcba565506125039303d11b41b5da82d4b0deb40dc566807ab7b86154e6242b043de20e1c
-
Filesize
1KB
MD5820de382173dfab69786f60a476b1f89
SHA13a284dfac8a9961902a23e141064311269b3a0f5
SHA256e414da6d3d57c160e6f62702b2c51a859c603017c6f8b4775058a785159c7fff
SHA5126551465e9a5bfd08b7610e73ff3fe11558344341bb1387d95234bfedac5335f46675f3ced2b3d52bdaa5eb75e1589e8817a4715d0456036c7deb41cb5ebc137f
-
Filesize
6KB
MD5776e65044b6d5816f5fc320e4f7febd8
SHA18ca7964e0253274f488b5ec817a1cdf0954f91d5
SHA2569fcb3aa1cbaaf282cc93b7e11253f998f9594345df76ffb8d521322732ab7984
SHA5123e2ba4b4076919f6807628040baa3dfc86a30eb48b67d73b9594a56da9bfc64c2dab18be68cb5545668603e5f89a1f3f88bbef98375928d50a5cc9e839e4f4be
-
Filesize
5KB
MD5a1bcdbc73e8e481390a2f8bbba157189
SHA1687b594c9194e8480bc0f6e25325deb85799c3d2
SHA2564b78e1c74f0f6ae7f2a6a59ec50ae38bdbaef05fef66d332ce01fa1f3977fc03
SHA512dc0164f8e23dd42a113fbd3884416e47e507abad3dc6a0fc88b3e381a5a69601fe817ff43696da7673681bc7d7949957814903679df43bcc0cf2bd20d71737e9
-
Filesize
24KB
MD57915ba0545666aa5833cf9f9f86d45d6
SHA1743ecc319bc2a54973582d4a5198042a48fbe8db
SHA256f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20
SHA512a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD54cc87f4c69b6e129a19178be5201c86c
SHA1449efe4beb447f57e558e77cada3f11ca6be55e8
SHA25628137067f932bda7b53778e768d28450994cd2b51e63f4e74f16503ea34c954a
SHA5126e14dbb0714f749dd402d8d23f89668267d9d01e5c798659905666805351330e6c5a5d7cc6bf8bd87a86d0b990f29ad7e956a548e82c78c47883742d6bb43dca