Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
f59f1d10b5b8cb60c4a425d766732d5d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f59f1d10b5b8cb60c4a425d766732d5d_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f59f1d10b5b8cb60c4a425d766732d5d_JaffaCakes118.html
-
Size
39KB
-
MD5
f59f1d10b5b8cb60c4a425d766732d5d
-
SHA1
37f41eca242dfa78ad76185424651ee5c292397c
-
SHA256
ed6947ea2edb52a66a8b79d0bed6bf8eb37c829f479ba497ef509718396d7ea5
-
SHA512
e38f050327bb61b181a4b1c2767f945070c4cce191bfc0fb5d2ca04c5c7ab66aa3bfb10c06ce9d0a2f28eefb9eafe526c416bd50821d7c125183fcba21930a6d
-
SSDEEP
768:PBX/wrHXha38IYfoYppemUXg6Dbqxy+eJW9vgF35v5XfLvAXxg6uaxKH7lyEWLps:ZX/0Xhg8IIdppemUXBD+xy+eohezfH64
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4488 msedge.exe 4488 msedge.exe 1668 msedge.exe 1668 msedge.exe 4676 identity_helper.exe 4676 identity_helper.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe 1668 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 748 1668 msedge.exe 85 PID 1668 wrote to memory of 748 1668 msedge.exe 85 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 1272 1668 msedge.exe 86 PID 1668 wrote to memory of 4488 1668 msedge.exe 87 PID 1668 wrote to memory of 4488 1668 msedge.exe 87 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88 PID 1668 wrote to memory of 4528 1668 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f59f1d10b5b8cb60c4a425d766732d5d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2b9046f8,0x7ffb2b904708,0x7ffb2b9047182⤵PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:1272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:82⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵PID:2956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:12⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5541079705360792117,10542669500972051487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4940
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4992
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD59be2de0873947991eb4536611b1c3dfa
SHA138ed52bf2b6e94489e192e5d1bba96cf4b825732
SHA256338b6706caa51e0d092981db57107dc7cf6245d386775c0ba5c3559857d7c15a
SHA51292962752232c7b22974627c7f1794b5f1c2e2c8aa3ca706d50f8d8f7e198ae49ebcb48b47d93ed47d49b449804c914ea528a32194c83d65c67e49aeb1711cb6a
-
Filesize
2KB
MD5925c48f8e1c77afdc5fb9985c5725d5d
SHA126ff7d6f989d7adc7ec56429a59e9376e13bc91a
SHA2561410d86750bbef8c6064fe1c04abb1494dc0c40ff6f843fca43f666aae0348f8
SHA51206bc2d8bbe99d538a6fe285ff2797fc44199e0378a215bfb2cba01dd698cbf8665bc7f75d263372e14f4cfbd7de2a2094447b04b714608afacb5b8642a045cc2
-
Filesize
2KB
MD51b8a3301124f9baed7d8360dfd9e4558
SHA101fefb0363fc6fe6ca008d564674befeb20e2b06
SHA256b8942469e2ac1cb81d4e0a316f986520e7d70f2aa1d5e4ddff187f919a761926
SHA5126a5135b14b1e77ab8ad9db4548178dd25bd541759c2f4d2357b08dda2cb35c50e454593cd79f72919bb6e4b88f7ebc61f779db46cd812eb6986e7f242c86c629
-
Filesize
6KB
MD5c0db9d2ef8aed990987f3d9de5896207
SHA114996625522d60642f9888c761ca4d0a1ac48b49
SHA2562610fb8b2511b6cdacc90bcc31f3467d4402176bdc55b33f347f0611567e31b2
SHA51286897a80790018eae0c0b7b074cb24354b8b21947acb40783eaeddb1500e682d553982384150b9f517315573d8e95040fc2c590648af9a5522e69b927bbf914b
-
Filesize
7KB
MD5c3a8e4345edf3b31100e41df5b02096b
SHA1c9bde0b28c321a27a394f385036fc16ea16430fd
SHA256e94eeb941a735d2cefb08a4be9f6da7a20dcafc86a030de2685fd323d358eb43
SHA512bba6b825c43f1e698c08011ca9b2d0e4a30ade189ff0450989e6f4abf8e40e8fe3731125d3f652bde98591d87c23c37e8cfa1808456314f99ced7fdd7fe66200
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5517ae97cb8a76cd2f350749e20f87526
SHA175cc2ecba40a27368029ab3c9049779bf4e3d479
SHA2564b30ae8ccdef1d96ed1b137e12659a6a87f72a962a2a09a16d31488a011bf4bd
SHA5124872fed7c7b3071b2269e6e02f16a02d1c3f456e920844e7b7cf6113408790923ba83cbc0d16e1bd95fcb968d2fcc57c41c80d3663b9c824a764eee0656386d0