Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
cf5fc4bd7f5627ed2d296f5f3ad91bea_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf5fc4bd7f5627ed2d296f5f3ad91bea_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
cf5fc4bd7f5627ed2d296f5f3ad91bea_JaffaCakes118.html
-
Size
45KB
-
MD5
cf5fc4bd7f5627ed2d296f5f3ad91bea
-
SHA1
acaccc5b988443c03701f5eae17162d8fa06dc7d
-
SHA256
0377d06595c412dc7b6f85a92377aebce7baf1a399eb327790845c87b9c15ff0
-
SHA512
15da822a6f01266ceae12eca0c29b91895100205aaa5d525eb760ddcb8473f4d14ea828ce08c154ea90a68601aff21ffadb96b8f18407c3880230297350bfe88
-
SSDEEP
768:Sq1xlTGuWtZgu6YhQCeCvC+CGC9EO0oezu6ziUVorjlUNKRkjVEV:Sq1xlauWtZgVYOj+FrHoUVziQzNzjiV
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1428 msedge.exe 1428 msedge.exe 3164 msedge.exe 3164 msedge.exe 1424 identity_helper.exe 1424 identity_helper.exe 1632 msedge.exe 1632 msedge.exe 1632 msedge.exe 1632 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe 3164 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3164 wrote to memory of 1800 3164 msedge.exe 83 PID 3164 wrote to memory of 1800 3164 msedge.exe 83 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 4352 3164 msedge.exe 84 PID 3164 wrote to memory of 1428 3164 msedge.exe 85 PID 3164 wrote to memory of 1428 3164 msedge.exe 85 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86 PID 3164 wrote to memory of 3020 3164 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cf5fc4bd7f5627ed2d296f5f3ad91bea_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab34b46f8,0x7ffab34b4708,0x7ffab34b47182⤵PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:3020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:2376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:82⤵PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:12⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:12⤵PID:4668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:12⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:12⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2600646058473599640,6220231569392554432,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3568
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5111c361619c017b5d09a13a56938bd54
SHA1e02b363a8ceb95751623f25025a9299a2c931e07
SHA256d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
SHA512fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
-
Filesize
152B
MD5983cbc1f706a155d63496ebc4d66515e
SHA1223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA256cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
SHA512d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5fd146ffa905d4f59b11132db3321d688
SHA1d6ac84c7d1c66787d80577e423c92897583dec30
SHA2566f5859a59486ad2e99806001ace6e7fe6b43fef93a18607435262ca47cd0bedc
SHA51271d2114f9a56b827c18eb16a6f5defa954bb8beea653693d7185185f9f5a19ee24aa1812d3381866c4d388cc1229419c82b6574da6cadfeb0f419b2a22f55b7d
-
Filesize
1KB
MD54ba0a649dd75ca3518f4de8004d741c7
SHA18f10557b7477a8621aa9f4e142e7e1ce700f27c1
SHA256f4ddda581bb1ba692aee32e1d34b2353f4068e96c7c3ec425d170a94361a19a1
SHA512f448e427a66cf29538a5a9a7d395b3d336e8addb3d554ab0159ae00c17ee614c4f00291eb1d49db37f77e98dbade24070d24d2b189b61799b93264798d1add47
-
Filesize
5KB
MD5e200d0ce139ad3fd4d615f5af00e5506
SHA139708a55fa1a9c3fae95638d577cf21f6a9391b5
SHA2565c6dff672b8d73a6f805ad9b0d00fde02cd1aa0bed32c43851bd53df68c76d43
SHA512230814c6d01b3ada4d2ed092e6b461046e7fe4229348f29df179275003cfbf6428f8e2c50013bc8391f28571e00d2afe06d74febfda28cc3ea0630dd368f2da8
-
Filesize
6KB
MD50b88232caf982f87b847902ead67adb7
SHA127365d665eecab3ae6b91e6b1e43131424bea795
SHA2560bcc72f3d554b06334faa74be573abc6a00376a1341ac2db9a755b5c88e1ee1e
SHA512aa6d3891de4806fc055df4d9eca1f1d78b2680433db7d6c807f57cf001379ec73f9eb4f647b768b47a4b242d2f0f5a11a76a18a34d898215943675d25d9c7432
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD56afa201a19482ebcde92fb5d8ff6206e
SHA17a8dc07157d3b77014239c788da2fd291f8b0375
SHA256a4ee33104584f2ad1d913d619a9f6a45f0d3b5e309eb7ef6729dbd5005974a83
SHA512beb2ed588ca5c12fceb76f75efd0cbebecf4fbbb43c1ddb17064ed76612414421b2166b887221a49774e1c244fd1dc52a53fed8c60be7cfc1febc42a70564086