Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 06:00
Static task
static1
Behavioral task
behavioral1
Sample
c01a55ebdfb9b083dd1f558680482ea3_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c01a55ebdfb9b083dd1f558680482ea3_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c01a55ebdfb9b083dd1f558680482ea3_JaffaCakes118.html
-
Size
11KB
-
MD5
c01a55ebdfb9b083dd1f558680482ea3
-
SHA1
0a9d5d2fc639d77966c19f4fe88f7fcd0b5050db
-
SHA256
c05f0707e17ec0936fd3e231b7869f0344155c69ecfe84d251946511eadaef4e
-
SHA512
5766b52533f757070f508d3786c8d46d6f25310b81c8712273499e1d414130a88083dfdee9dc777e0a8914d76238a7f966655be2a0ba89b08e66544ecf96fb5d
-
SSDEEP
192:2ValIsr0r57M4txagT8IH/w1wvqLkt1Psw8uBuLbdU8d:salIcIQ4txaaH/gqPsw8guLZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2888 msedge.exe 2888 msedge.exe 436 msedge.exe 436 msedge.exe 4392 identity_helper.exe 4392 identity_helper.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe 1664 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe 436 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 436 wrote to memory of 2564 436 msedge.exe 84 PID 436 wrote to memory of 2564 436 msedge.exe 84 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 4684 436 msedge.exe 85 PID 436 wrote to memory of 2888 436 msedge.exe 86 PID 436 wrote to memory of 2888 436 msedge.exe 86 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87 PID 436 wrote to memory of 2172 436 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c01a55ebdfb9b083dd1f558680482ea3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6a6246f8,0x7ffc6a624708,0x7ffc6a6247182⤵PID:2564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:12⤵PID:1676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:82⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:1992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:12⤵PID:2088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13174240819112800200,1874513666911544736,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3140 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4008
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5111c361619c017b5d09a13a56938bd54
SHA1e02b363a8ceb95751623f25025a9299a2c931e07
SHA256d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
SHA512fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
-
Filesize
152B
MD5983cbc1f706a155d63496ebc4d66515e
SHA1223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA256cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
SHA512d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD509fd4b54caec39a8be7f4db934a3c9cc
SHA17f30257417759f5c6eafb872a5a4176a2b7bf8fb
SHA25643dfed01cb00e585ec2e0f31e9530ed1f794679c4fb10064df2b4cd5a86b5f57
SHA51290c65edfbc86ea843d338877245de26e3bf4e15b118ac275a7b645d481cc15d488028da88cff69fa01dd169806077467d5dac7589a0812d5959b06f97456c180
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD5bc71b11b181555fc4b13e2c268e92174
SHA1dbfc1f0e75a3f1ce0c52cfe31d6db93e8605f0e3
SHA25607441840bf343f59af03380f74594cfb7d9ad23d0267907a37adfad8a4e029b6
SHA5124d11611b3a1cfa678c821b4c3d3a347fb1eef30830d2247c4ceffccd60f4fb24fa4cb9affe01da69772de9d4fdb860192ea5f59c521c800b0c8976bf08425531
-
Filesize
6KB
MD52e16d354a07f0f887a18fcc9f8463fb5
SHA133cce8433f0dc0ab375a17530be11ddc6219d807
SHA256890348dfbe772ae79a872dcbde302a9b4452b89a5925c977e3c664834ca22e1b
SHA512b5548c515ec67b809a54962804f626e1f316e898cbfd3019cf2b60a59a3c05edb8b00b0a67c2d6a1140e9d7528d3155aa6f36d1147933b71b68568712a74c4e6
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5676b7c80fbc6213cb9530b626f7bf3df
SHA1268442267e59ac877ae6ee8c318c8988476c225a
SHA256e8fe6a212f224d36b219681d62755f25966cda0fe4fbcfcb0841cf90838e1e18
SHA5124535711994685ab17c427ed59b60dba52f402de210a82fa408dd779cc32dea9a9047a56eb71f16c13c8b71970fa3417e1620744259652e9f8db03f5efd83da19