Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 05:53
Static task
static1
Behavioral task
behavioral1
Sample
eab4b9a7b22c1d87ae3ffa5af2266450_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eab4b9a7b22c1d87ae3ffa5af2266450_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
eab4b9a7b22c1d87ae3ffa5af2266450_JaffaCakes118.html
-
Size
27KB
-
MD5
eab4b9a7b22c1d87ae3ffa5af2266450
-
SHA1
c7f684d9c9825277ab6257c59a6073f5b70fd657
-
SHA256
08eedab44b76c2877adbe02e2f40a389cb1ec0abcd75d870e6ae00dc18be9758
-
SHA512
c781905bf0eb01967548d8e0d749523520eb16f222652239d5ee7d88c5f6411985024a62f29de187026d6eee147305de6d73525621a01ef2a9117f67432d024c
-
SSDEEP
384:aMCm3tIB0m20xQoejmuNcgFrjSjP06bS3YNkaS7fn095YG6E1:aMCKaN29cgF/8MD1u
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 460 msedge.exe 460 msedge.exe 3096 msedge.exe 3096 msedge.exe 4456 identity_helper.exe 4456 identity_helper.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe 3840 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3096 wrote to memory of 1884 3096 msedge.exe 81 PID 3096 wrote to memory of 1884 3096 msedge.exe 81 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 4620 3096 msedge.exe 82 PID 3096 wrote to memory of 460 3096 msedge.exe 83 PID 3096 wrote to memory of 460 3096 msedge.exe 83 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84 PID 3096 wrote to memory of 4996 3096 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eab4b9a7b22c1d87ae3ffa5af2266450_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb579346f8,0x7ffb57934708,0x7ffb579347182⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2600 /prefetch:12⤵PID:3508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:82⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:12⤵PID:2860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3310629855776706293,9887097530726952384,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3840
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4216
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5cab16fdd0650b98b43c839af438391bf
SHA1baf37a7eb1d691cdcd1d9e96fed7d2bd0dc51ce9
SHA2566cf63c9ecb66c4abc8852e3498a310b3ab04843e285b7b4b6f5a119b4c67347a
SHA5123fef99d22468eb25c88bbea81b7c49bf4300118439236b75fac781cafe8ba56ef8ec395701e9f6d4df6b2579780e24a28fc14195b5bb8a277de780c8516440c6
-
Filesize
698B
MD586fc67bebe6e73fbbdebf9042b499b06
SHA1322f48822850c29d63d249921899319ea9b838d2
SHA256a37d1c8c45ae563ecc412c48b3fc05e9c6accc1781908ea2ecfd09f7a148cd58
SHA512f6d9a5e13019ad9e45e25dcc6422c93ec3be563a5cfb4189768f9c06e44caf52f8b5c0d1395af94385ed0a0d7b75b237f6d47b2e2730a41ed3a2053995af9af3
-
Filesize
5KB
MD5a3e858067910c9316b0c5be7fcf8d017
SHA1a525b456fee05ad1c4c7305fd2bb2e108d55b0b7
SHA256016533400e8e085a8239e83ba7e8da4093b589f4dcccd93c6dee5656e34669e0
SHA512db1a4c174061dd713e1a167533eec0aa9672d4d018a82e8f24db4e1a07f00c802d7e43b7626bafa3de088f7902c39361b46a6403df601c5c462dc96346bba1ca
-
Filesize
6KB
MD54a631e620ccbfb7c03c642e2c1adff5a
SHA12ce6206a2ac9b89f361ec6af1efb109470a040ed
SHA256e249231551a412b1b22389c7dc310bbbfebdd755adf5d46130f72cb90972e177
SHA512df7185806595056bb788c64ce4a48511e62661f1b2e9eacf3fd7b35402b20da7021b49e48ecf9a199d80270fcea7342d795156359e257b536ecda9214dc917cf
-
Filesize
6KB
MD59fd6bd076ee92ca41b474e71f8063df8
SHA16cc071408398d929596cfdac9274e783427302ab
SHA2561d71b47e79b0c7be2ea30c34a4521be6835346099f5e86c000203f2d6399c59b
SHA512ac648063274c7ef38a8259004b8bdefc9f7e134d445a8c11eb846cc98245da42e7173866e6431243bb0794dd2183ffac26b7fd8721ea7647fb724f6482c707c0
-
Filesize
705B
MD538cf4af344046c7af4ba65ebb19709fe
SHA170a5210713e13c9165953d9ca4422cd1c4aaf7d2
SHA256e647d45b7fac4eed766b29bada477ca53f7a119727acbae8133d793e78066c06
SHA512a8ad419178ee9c4ef0982e36e66bebbcd0cb17988cfbcecaf549359dfc5d378161836c75d34d23d288be75ca890610f706d24036ab987b171ed15d7d2ecbe3f4
-
Filesize
705B
MD5d3de184083a5cf7668ae0b42f05a5058
SHA180fb9138497601960595589ab35e23d9c6ecf457
SHA2560eab54c83793bd7bd933ae12342bf5f7281236e695c5da26fbd17466cdac3327
SHA51260b9e835a17660b61d4b5868fd5a0ad11fa598e3519a15aaddf75aecf6665a0f468fe21801eae0eef2687ef482ea23f8ef624e7ab5ff0ba1c2270efd9b27fbd3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD56472d49f8d7f65024167ec3ee553fa0f
SHA1c2a522f802f21aabc1269b189f7101dc0770748e
SHA2561504d8877ead83718205a155af396ec8570acf740479012cc1004ee085f0d538
SHA51241de645b9c80d6c87a738924e513ce977652e2a8673938e633cdd972cc6ca6d240372feea7acfd12e2ecf1491e1065dd040f3e619d6dc370564e240d8aa79642