Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 03:51
Static task
static1
Behavioral task
behavioral1
Sample
044428d44ec9785c938d2e7d0d1013de_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
044428d44ec9785c938d2e7d0d1013de_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
044428d44ec9785c938d2e7d0d1013de_JaffaCakes118.html
-
Size
48KB
-
MD5
044428d44ec9785c938d2e7d0d1013de
-
SHA1
c7cd9966da10bfaf7fa9ff3172f4d1b07db445a0
-
SHA256
65b7712730b00950fa2f6a0b830c73b2fae46fd6f1ab4dd982a74be31884322d
-
SHA512
9b7a714e5cd9da4eddcf34932d27d59e4a9ace297eeddca1e5dc65ac89140b815e7508061812f5d26b01ff2da3b5ba7c984dc23ae8ba2c6c8ecc586acba78ba4
-
SSDEEP
384:S+EB3BpAA0+HI+KPnDQJMCocwAxTN8B44B/qS6FcwjtP3LFzjFKSGPFxPl8Pb3PD:SxpHIKHGB3B2Lg039
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 396 msedge.exe 396 msedge.exe 3724 msedge.exe 3724 msedge.exe 1640 identity_helper.exe 1640 identity_helper.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe 700 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe 3724 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3724 wrote to memory of 2380 3724 msedge.exe 82 PID 3724 wrote to memory of 2380 3724 msedge.exe 82 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 2976 3724 msedge.exe 83 PID 3724 wrote to memory of 396 3724 msedge.exe 84 PID 3724 wrote to memory of 396 3724 msedge.exe 84 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85 PID 3724 wrote to memory of 840 3724 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\044428d44ec9785c938d2e7d0d1013de_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8964d46f8,0x7ff8964d4708,0x7ff8964d47182⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:12⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:12⤵PID:3400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:82⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:12⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:12⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:12⤵PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,11526315002426896988,17010203212103464029,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1300 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:700
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3128
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD570ab9557d6865c014d62e56c9baca4f9
SHA167c23b7e68aef62e91e33efe1c6adeb1df270820
SHA256fa61058503627263d77fba78d9a3a26e946bca8506d8a4fc550fda4ac1086131
SHA512da9ec753499d873e5cbb79580601e650d986321c4dbcb8c2e9ac5f649c2b526980f263f4fbe75fa0a3a34ddde9c86fa71f6795ec8b352f3a980fb9b1dc35be35
-
Filesize
1KB
MD5b59c48ecede02011a66ed00b4e27bf32
SHA1b63c0af74762eee0639d85f8cf3ac61f35efe5be
SHA2566821bc1da988b3e3c84d3a22e29b9ad4c04705dfd787d87290b474fee34773ad
SHA512b8a60230d8371a9c3375d5b5b5a6aeee36bc051436f086f9fb6feff41ad90c22e1ec66597a83bada84e66298cce7d909fb7da0a89f11679a13c931f6a635acd9
-
Filesize
6KB
MD5aac86bbef529b3113306c8417b438618
SHA12de6a6997d0a3b331f996657516c1456a6c3f855
SHA25643f0059f58e7b99c428a2ebee4fda87f295610726ed5ca82d7a86ae41aedf4fc
SHA512a7a29acd62056b79a025147cf23b7c3ffac0550f00b6050920e34479abe2e1e0cea6a995dcb95d7840b803718aa2266833cf8bd773a1357544a43978df726ea2
-
Filesize
5KB
MD58984d4cb2c932b71b04646c4780f4341
SHA1037f30b16c988cb4266048a731d45eee7152d9a2
SHA256e22ae02ab35f76f7b187223cff2a695cb87d433f29e02d4700774bb5e06aaa87
SHA51204cbcb276b1a28f791cbc9d77b3d2db9aea6a87de13addf45a96b3f4cf4708026d176166fc25b786bd0ae5777e33447e136cb4473184baaa525cf7d4faac2367
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5ecdec3f70557914480b4176cb3494e7f
SHA17818471c302219866368087570ca59b2b0fa4f39
SHA256332d198a180f1db2031909eee9ebd0c59c7ac77f4ffc5675a532053fd4a6d79d
SHA51267b354deef1898c6be72ff0fd47144b26184ca308f7d779d7875992fcdfbb30a4e59ced624e7afa3464a0f6c9b9ceddc46beea1a658097c27f4c435503253151