Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 10:18
Static task
static1
Behavioral task
behavioral1
Sample
d1b3262580e90a94adc89983e6a74375_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d1b3262580e90a94adc89983e6a74375_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d1b3262580e90a94adc89983e6a74375_JaffaCakes118.html
-
Size
114KB
-
MD5
d1b3262580e90a94adc89983e6a74375
-
SHA1
df21a523a61f265ea25c30c5f67cd08db3b48918
-
SHA256
0ffab6b3bd0d54a4fe1e7749d6a1e478ac3d7698628159014d2b664a4a6268f8
-
SHA512
a1008efd870addc33fe3eba59f71c7a75e92926bbcdaadd0da4f13f52305df5a3cd90f1eb635a2bb997e43e697d0e3a3f0ae79321d19baec294f046ea2e74c5f
-
SSDEEP
768:0mVgpBSEOupweeeXOs2u8X/xP1DEvTHTEFETpQRTGk+FWPGY0kz8aEjNGKfODj6U:02gpBpYeeeV2uCw8ZkKctSZEm4NM9
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3636 msedge.exe 3636 msedge.exe 2496 msedge.exe 2496 msedge.exe 2612 identity_helper.exe 2612 identity_helper.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe 2496 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 3384 2496 msedge.exe 84 PID 2496 wrote to memory of 3384 2496 msedge.exe 84 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 4840 2496 msedge.exe 85 PID 2496 wrote to memory of 3636 2496 msedge.exe 86 PID 2496 wrote to memory of 3636 2496 msedge.exe 86 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87 PID 2496 wrote to memory of 3664 2496 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d1b3262580e90a94adc89983e6a74375_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b75546f8,0x7ff9b7554708,0x7ff9b75547182⤵PID:3384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:82⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:82⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:12⤵PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,8279082520172130592,18124314694938284277,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5104 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5044
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5b3a44c003973082bf2e79db0eac20c67
SHA15c39a12ebb32b2782429957e26b0de94566b1c15
SHA256b965abfc6769eeb8870ba044754f61333268d4b9f885a155613ad9eeb8b20a54
SHA512e6cb62a33b6a1f9d609ff2c4238805d52bd2935d06bd239c9d94a226947267bd766ad19c7698ba2570a80302be44ecdfa7ba0b5a0aada37521066087bbbb52f4
-
Filesize
1KB
MD506a464e2a7098ee83f6767c4a757612d
SHA1bd308956415a252bc28528812acef7edec9f845d
SHA2563ff89edafae047a05d4380245e198b4cba4d63f90a91613edfe6b2c22704fec2
SHA51262c04ae2eaa2dccdb27afc29d59d2aa72ed285d8b732d91cee7eb3fb38773d3e8077c68f3e951bca1de38b737dff96d8a92dce5cc62326e63b73bb6d75034363
-
Filesize
968B
MD5dce24993bcb91ee4cca04939f20bcdf3
SHA1289f2d202ff707b17a801a0cd592498916594849
SHA25683471e9bc98e7a0081c6de513d9f3d65823b9bc8d120580dfb0140ec2893d534
SHA512d11f218083c211081b500f1514ecd12dd5fd02423404aeb6b485d717de76e6174fd0e70325ff28b9542137598265809d6aced9463eca81c89fdd911fb1d6a598
-
Filesize
5KB
MD54a20b855f819ffbb271d94df75bca954
SHA17d598454ff88532d7e928173a3d8e5e041d9165a
SHA256a9847d5e72019f637cc85373ba6f4416f0fe7778524239bcfa4dd0c8ce5c3a1c
SHA51240cc94206e3615a0dd5c24f566230097edf19d43e3f1d336c2401daa9a90793f4679b09550be9275f271b672f94cc20245b84d421cf48b0183310a2b774a938b
-
Filesize
6KB
MD57f95cc689d3f9c5968c259dd9db01094
SHA12da56f5eb54c4a4699233d329aebaff86cf1db8b
SHA2561fa634c5585f211996e53495139ff13083783ac1a6a47a71b430c8e9d8a4897b
SHA51295ab4e512e310bd974bfa1249a3a50bf4fb97e5ea3301db6d8c17654dd33b6d09d2aadf0cfcf93129da7da818923595c47bd7df73e90708f934c3c913526ba3f
-
Filesize
6KB
MD53392f2309a29c93581bb00ec025165d7
SHA1857b80c03cdbbbe2737e7a3d71e43bad8cfa045d
SHA256e1429ed8b19e6a6a157bd659ec05b8ba8dae96eb745f1973d39aaae9486609d9
SHA51285983cdc542847093a0343638f0886df21fa1d8c9b1e095aa0249991881f904135aff0173691418f33cbdb34bcb6564d1b7697965d28a71ab5a95731722b6743
-
Filesize
6KB
MD55e572569508ba0b0bd97861fa6ae4226
SHA1fa30fe94025573804bc365ce1b1b94a6760822dd
SHA2569abb8a134c8fc85fd94364eabdbab78f2bf90bfc7a4d1bc25ecc9ea1df1d519a
SHA512908e335452f9e66273a35146c037365869479c30bbf6c0ec42ef72a71bc08d92c1448fb98b808162f492d1922b33dd26d08c61770684428787e18435b87157f1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD52984ffa195a2574a9d56a1ae716e5231
SHA185d3ee94e53fe9ec0c27096229b84c6b4052fa58
SHA256fde99ef1e8f211c7816628c740fcca967918c737e2d57b4bab3b8bea8909f1d7
SHA5121294d340ef0aa5dda55791e7e17832359bcd3907b5650998b61e068e3ad457649d529e6be9be0c052fc786506d170f033eef99719dc40ba556939788d18e046b