Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html
-
Size
46KB
-
MD5
d2e2a1dacfd8688c31ebd561f544b063
-
SHA1
2a2d7ba42da0658c1d3f05ca95beb4b84c2dba4f
-
SHA256
5f7ad4d5b26c939065f39d4fcdea457860de7fe8a4c0a0a6290824431cbb55d2
-
SHA512
7923e2cb3f97b690bd32ac19180b33861d84cde9021f08f14567e82771f9a807277328dcbba4b51c591ce725b3146380c1d76148d7b6f31a3360686eb6d9375a
-
SSDEEP
768:PYruvWWl+WFGWXAIaAC1Nnh914eIaedgeP+4tReD2qHLlZ5z0i5ljeOK1fa7Yt9c:GuvWWlSWQIaAkNnhb4eIaedgePqv5ljZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1960 msedge.exe 1960 msedge.exe 3972 msedge.exe 3972 msedge.exe 1652 identity_helper.exe 1652 identity_helper.exe 3836 msedge.exe 3836 msedge.exe 3836 msedge.exe 3836 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe 3972 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3972 wrote to memory of 4036 3972 msedge.exe 83 PID 3972 wrote to memory of 4036 3972 msedge.exe 83 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 2044 3972 msedge.exe 84 PID 3972 wrote to memory of 1960 3972 msedge.exe 85 PID 3972 wrote to memory of 1960 3972 msedge.exe 85 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86 PID 3972 wrote to memory of 2564 3972 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff974b546f8,0x7ff974b54708,0x7ff974b547182⤵PID:4036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:82⤵PID:2564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:12⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:3820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:12⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:82⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:12⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:12⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:12⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6080 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3836
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2704
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5d2124139fab75c067770275e299fbab0
SHA1d058af90dcee214862fde6a202a5e8476b48afb2
SHA2564ab8a941abdde697f9962d96db33809270cccb9ec068e1f82cd557dad69be601
SHA512e3661f1a64907ab449b2be96658c00456e2fb08a67176b342606e609b3716471a98c12f86caca2c96d9e86a9d8e59cf11244e6a824373651411fde684b3a67d9
-
Filesize
709B
MD5bbd62636780046b2f485b26d44a01a69
SHA1e4df44a17784d906026e7426955258716493a708
SHA256a462a622596c3b133a6cfd7ad240e297e7dd7734416d4ed7783b0228e08a7bb0
SHA512031cfc0682359dcb598d292e9c89ddbdac2257b494703169aafbb218d20d967d72c7c102593b14a86fe6e1b1c5c253914a0a41de342e5c4bb057c06b2c99ccd7
-
Filesize
5KB
MD52c9661527f88427596260cef0730be59
SHA1205fbf73535f564d973b7cfa58ffb420676622f0
SHA25637f1044bfa8acdb8202d1ccd59d6c521ded9e7d2a73cfeec21b45ac86d77e126
SHA512bc83024b90bfb5773687a34a6c86b48d38468eabed6ff182c511dd0c62a0992e2be41868c42838590b27a9436228364fcf8b63fda5b877c6be0169ae8962595e
-
Filesize
6KB
MD544c82bf2667033927657604a1f9e0b87
SHA14822c43edf08d1542c815ed8d705f2ef040253f1
SHA25675c1d9d2d9912118b3fa3e0077b1af726201b6098225d50131a156ff3d688f18
SHA512ac1186b3e68bd9fafa7574e8109c8cd60427d3c4d199df613eb9cb851bb2525f420afb0eeb706464ca145963cb4105c2ebc5e20f9f0c0ee5f7d24dd1f151bcd0
-
Filesize
6KB
MD55136e75a45e20a7f424ddaacb7d39b52
SHA1ed94e72cc2fe111660e2ec9eed04ca6fb1004cf0
SHA2565707c5751432a4743c9a6070145d73f54c8b54b001f087afdfa5b53670510159
SHA512cb48fb8ffa0cc100fa833349a9c09863366a8a57aea9b3ba303b1a44660243053a31780159c7c3a8d7b83c4cbb646352bf24a45733fa2e3ce33750d88f2ce60e
-
Filesize
540B
MD58f87642dd19f6f0198994f2b966d34d5
SHA1b569c4d304408adb019891d790ecc8b53da671c9
SHA256f245dae70349921cccf518c31853a3bef4a41b59f22acde1e7c65b14cd73a59f
SHA512fde18b364e026a34c5f4c3489735d14a4872bda621dda3725f4f99c4171795558e01196c6d55e788d203f8a95a97364a7ebd438319bc41cc84cd90e44ff5915b
-
Filesize
540B
MD54d04005c32c5d224741f137196a5420e
SHA1334bd18aa6a72a986240db248b4c1df7eef53c4f
SHA2569352eb9dd201da8ee167a8f40cac23200955cf14954ffc5142d35f958c9f1e37
SHA51204f0e5c408d42af9105407c20ed74e0a32f5b42cf92807d2d1784c9c72dc9e4a8f044a147ab99d3d23ce7b312c85e67b651373690418c2ae89afa785a95e62e2
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD572ee9aee81bbeeaa7b177542c4affee9
SHA1fa80fef180b31c8a97c2985aa3eb934b70fdc72a
SHA256e6e46bd58ef1de7dba9e2c79b7bc98d065be5b9a71243b9c7bcfa2de104dab7c
SHA51292d5957c65904ca5532cf4d1eaa2ab0807c403fb3ce3d988d1d3e428e1ce8741656ce19c2eb74bc3739dd120f5ebe846cce5e50ff1ad3f0da06ba310bebd574d