Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 20:37
Static task
static1
Behavioral task
behavioral1
Sample
b0be84672d3bc3ece4cdc00c0d7f8c17_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b0be84672d3bc3ece4cdc00c0d7f8c17_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b0be84672d3bc3ece4cdc00c0d7f8c17_JaffaCakes118.html
-
Size
15KB
-
MD5
b0be84672d3bc3ece4cdc00c0d7f8c17
-
SHA1
636720dd91034b08bbe6ca6a8560842cabcb3361
-
SHA256
c0012a78ed05d6985eacd6cb2bf6bcc750eeb14ad8e782efad6f34b3ecb1d046
-
SHA512
dc7d48f5ad7d33371c82ba4aca0a24aaec3171aa1720997fe6efd2abab20487e036b14dedb45aea9ceb7fbe82acb3059844b5cfccd36cfda369ed2e1e14654d4
-
SSDEEP
192:nShT5jclc0VFXJbNMjqQM7Fh2LgR2/y04pZnjsSle73ClmP3KTAL3vV:SHcl3FFEqZ5Y1yJZnjTl822V
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4164 msedge.exe 4164 msedge.exe 1860 msedge.exe 1860 msedge.exe 5048 identity_helper.exe 5048 identity_helper.exe 5972 msedge.exe 5972 msedge.exe 5972 msedge.exe 5972 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe 1860 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2052 1860 msedge.exe 83 PID 1860 wrote to memory of 2052 1860 msedge.exe 83 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 3828 1860 msedge.exe 84 PID 1860 wrote to memory of 4164 1860 msedge.exe 85 PID 1860 wrote to memory of 4164 1860 msedge.exe 85 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86 PID 1860 wrote to memory of 4860 1860 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b0be84672d3bc3ece4cdc00c0d7f8c17_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2ffd46f8,0x7ffd2ffd4708,0x7ffd2ffd47182⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:12⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:12⤵PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:82⤵PID:2844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:12⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:12⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:12⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16042635685827518809,11973167539250188310,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5972
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1112
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5111c361619c017b5d09a13a56938bd54
SHA1e02b363a8ceb95751623f25025a9299a2c931e07
SHA256d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
SHA512fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
-
Filesize
152B
MD5983cbc1f706a155d63496ebc4d66515e
SHA1223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA256cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
SHA512d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD58509aed656467772032d9e49a8a5dd7f
SHA14f9f023e0bb549d6683ed472ea66c094485c2bd5
SHA256ee20d23c2ff8224339d01dbd303c2fdd7254705f3a688ca808d68c2956132640
SHA5129050e7511f71e49b75786566eef891bb2078f25b12f04ba3b8fff8699c79d683c53e05a92e7e834e5c3c6024068a31884fd55b9009db2273b6ab08053d27d65c
-
Filesize
1KB
MD54da3f674c54375734cb8623a3b7bcd06
SHA1dc704e235b3add0df8741e828d46a499c9bb5546
SHA25646db5c69d4ea40a310c2d3eadaf66c883223127f5f62ccd953d1b67d43f2c128
SHA512d23f5a8f891e3b6e90830df3d83e23ebf982c9f10c81594f1d3d15a9255f597213dca6e9f2e3cfc68a523b403b98afe4a629407f97ff24c364a0a0105cd79c61
-
Filesize
6KB
MD5c69cfb439bb2d168d8b1a0a06c47bf3b
SHA19d6eb729cfbc5dc7a067ed0f8882a75873635997
SHA2563ff73acbfdeb2a38cc25452e4db5843f3bd79fcd4cc61c34d4ce0c93bf7443ef
SHA5126f51b06f3ccd5a0d41ad1cc3137776463491fc5fbb76c41a3308e95818eee358315f909a20b109d9ef40c00bbd06ae3756bc516642cf869e1c29e2415c6ead42
-
Filesize
5KB
MD554acb18136850907f61ced5f0e089f52
SHA1ef6ce517a4a3881b5a1cd7fd10519540eb87fba9
SHA256b3cefa5b9bf4caeb125544ae7f9645baba68d91c40b2069cc4fde16933d5ca0a
SHA5128a8d3bfe69124983681012394d754117d2e59baed9e2ba98df202d68ac12b3f43ef77567aa767a0bdcaf809e1dae639e704f1a89067721a04918d417b590e4de
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD51426bb7221ed7f7197e848f47580f56f
SHA162bf3d68f7ee76be891ed8a6c06895cb699c0e00
SHA256b9758eeee8c2e3be9d2d3dd1ba27b1504d563313560dca6831e3807504a5aff6
SHA512b3f4122b1fb65186dcbcda55d3b70ff8180af8062f7dfdde9da786c5dfb1fb6b006d50eabcde045696738acafb58b1eb6799af33c61e5f2c91a8a85dc6d19169