Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
facb3e906f57f19ee25a7d8d4da33b09_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
facb3e906f57f19ee25a7d8d4da33b09_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
facb3e906f57f19ee25a7d8d4da33b09_JaffaCakes118.html
-
Size
1KB
-
MD5
facb3e906f57f19ee25a7d8d4da33b09
-
SHA1
7660873ffc8cb86b2712e3a353005134e97ce8b6
-
SHA256
d3aae41be89eb31d2b3bfbf8e8cc257ad2a9dc4756966fde410415c04c1d68a0
-
SHA512
0cf5f6532f7cc9db764b8063899e3e299210ae16509bbe70254607849368664ddc01421f170868161cb131d52734d9b994d669d6e876d27dc024b0f0cace6ff0
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3588 msedge.exe 3588 msedge.exe 4452 msedge.exe 4452 msedge.exe 2356 identity_helper.exe 2356 identity_helper.exe 4804 msedge.exe 4804 msedge.exe 4804 msedge.exe 4804 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe 4452 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4452 wrote to memory of 4864 4452 msedge.exe 82 PID 4452 wrote to memory of 4864 4452 msedge.exe 82 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3524 4452 msedge.exe 83 PID 4452 wrote to memory of 3588 4452 msedge.exe 84 PID 4452 wrote to memory of 3588 4452 msedge.exe 84 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85 PID 4452 wrote to memory of 1732 4452 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\facb3e906f57f19ee25a7d8d4da33b09_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff974ed46f8,0x7ff974ed4708,0x7ff974ed47182⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:82⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:12⤵PID:456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:82⤵PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:12⤵PID:888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:12⤵PID:1260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,14463660910014765605,5740421115276192556,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5364 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4804
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3220
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5a01f3f7c72e6e47e6a9b9665b898714b
SHA1b3162bca8ecdbc747db85774683b47882e47e9c7
SHA2566aee43e413b6b72f53a8bbf6d32b2039fc6d63fbb87a066b1e684ebbf2d82c36
SHA5122eaa8f8e7e0edaddfaac509763aa33a334fc44c756f98eb993bb6e4b4ae8e434eaa02a0efbdccdbb609273aa19b6ef454a921606a6148d08d0f1e7e6327996b9
-
Filesize
333B
MD5454a117ef89ce7271b4d0ad19f7383d9
SHA1840ab1b206efcabf3b816739c9f407f68776c8c9
SHA25623598b004bb03fb92502b248186f9284e9a186d93b747a761412cca5c52db489
SHA512d237c2c12ce87bd6a27228a94db58a53c74de3e7b6e688aac4579d4b2027167d013e95f3bae0243175c72a8b3f662c0b265de934ce619a30b96f1f027add745f
-
Filesize
5KB
MD57fa36ac7ea55cf4953dec09a30f548f2
SHA11abe41c111dc9fe88c7ba326e6307676767c6715
SHA2569142f1cac1b5800728306625362a0d4e44f48ff1ac01a992ad0279c72ea47c8b
SHA512eeeb6c9637c917510656fc156e4f45d6c0a8e8939ffa6199ec800e1e2eb7626e0dded2b2fa2250e11a414aea5d6b7a78927611154b3d7fa12a09faea91634200
-
Filesize
6KB
MD5e37eb407991ef176b120bc1663b743d8
SHA1dcda1a8cd5a3317c806c812b1f4b30c089efc2a8
SHA256d246523f0f35b20ea102ca9cde9c87aa78e762e6966d1b447673bdb05da6715b
SHA51254892770debd5a7ad43d014bdc24462c091c2dc97706df80cd9d3ac8d75ad4f63fb88c0851bf55c3bbdd9d747fad68d265180f62296be498e16fb94602e751b5
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e4101c7b097cc16fe6ef5de5420c6094
SHA1c5284644c3853b9c0596a5615ea2c0dbad5f4612
SHA256a638a0d8c3a6912a7aeddd7864b13435d5e9e5caa21c13628da97ec9bfe7e662
SHA512a00341bddcb81da45a8a201a6d5d7c6740f97de47276712db196f9e58042b5ab0358a0c1f89422e82b2578f37cd7f67acf35475f18320b4da0012d7753f3543f
-
Filesize
10KB
MD53fb6e838bead6d5237e4a74d35c13a92
SHA1f70946531df709afcfc391149f23e13a77d31e62
SHA256a220dc0b616c6f770c938155c066a0e1b57622797e12070f38e67972e9da6726
SHA51257a4d497d026d656f2a0575c1b35c94d28144d24955f95f2fe94a931cc0e99c0fc092cf525e8655a62648c61ed2876b3277e9ea522100e45a20325b98add9c9b