Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
07724ab609f2e2368fcf3c993dc1f4be_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
07724ab609f2e2368fcf3c993dc1f4be_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
07724ab609f2e2368fcf3c993dc1f4be_JaffaCakes118.html
-
Size
32KB
-
MD5
07724ab609f2e2368fcf3c993dc1f4be
-
SHA1
e1fedadee486679076aa18f80d82c082e1456ff2
-
SHA256
73c0cf4b601c99e8ef03dafc9ff64b8f68c738ba5ce974554bdadb2d50187df4
-
SHA512
5c22c720341e8d6b56526c2d17d978aaef051dd1cab5babb7c2215d9ae79194f1c2aee71f5134765c147a4ffd559ec6255093f0973be4b7bbb049fc57621adfe
-
SSDEEP
384:sXlIcytn4PWGTHVWl1NeCI1lm5nakto9IATGJTHlSqIhOl/gcrB18n4VjXlb0SAP:ENWHrylWnaEJEigBchAxLZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2556 msedge.exe 2556 msedge.exe 1940 msedge.exe 1940 msedge.exe 2336 identity_helper.exe 2336 identity_helper.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 1144 1940 msedge.exe 82 PID 1940 wrote to memory of 1144 1940 msedge.exe 82 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 4700 1940 msedge.exe 83 PID 1940 wrote to memory of 2556 1940 msedge.exe 84 PID 1940 wrote to memory of 2556 1940 msedge.exe 84 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85 PID 1940 wrote to memory of 844 1940 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\07724ab609f2e2368fcf3c993dc1f4be_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff540d46f8,0x7fff540d4708,0x7fff540d47182⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:12⤵PID:2716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:82⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:12⤵PID:2720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:12⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:12⤵PID:3764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,4844831953282377771,6448971368739595550,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5960 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4404
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:416
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD59903dccb14ac5777d97add91cac9c0f1
SHA196d83979ad78fd2ab4699d0c88f80dba8920996b
SHA25613b06a2d6ce0380a28c5e97755c60d96ddf6f7d21efdfd8bc760b297bd4351ff
SHA51286fad51b382f4ab36ed6b5d2cb2ab40762c6b8a31c6b9a7a3d8ceb34bd43f39f26e9f9b5139bf513c6f5c5838cb8415244c59651199f91677f6a098a9c3885e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD5cffc1705fcb573b5b500413c05234267
SHA19bbe526c40d1b3f3a546e4ae3ca9463a2e97aac7
SHA2561f952b8ff05c6fbf6d66c17192da4304a817b3bd9e8a62c4653779eadbc314dc
SHA51233323ec48ccc3bd57644e31ccc713b06bf4340557f60f2fc4ce1178986a665649947c52727db15877b7faafa5bbde16026d28ffa805cf47dbb07612ec3eb82dd
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD5ae085fee00d21ef308479b85fdfbf9ad
SHA1d3b1fa493496c6b4fa099c6bbdac8082fe18a2c4
SHA256ebd3a719c47bea24cea191971ab881a0813f3822e224098bfbde33f3be397012
SHA512b0214accf8374e9f86e1c3843a9091a35ff1475a0cbd23871bc67dce723c8edaa2b8b3d3a0739c52a8271de3f4dd9fa5676b32e63e7e01a8faa5d95e0a009ef3
-
Filesize
6KB
MD51a5a31917d816f2adfa4487cd902fe91
SHA1547127a24980bfeef85e590e93dd00ebbd61f514
SHA2566eac6950ae9a3ba71c5fcdb602ab74b30fb31f438ecc3ad6fb642df06cec9bdc
SHA5123dd47e1ae5a6837c74b9e4df99cf11bb80783ab5975a3880be0f62b3169007d7b47f184900fc6e43b875e78f169fce0a22ef7477b3619daffff5a802a8506b34
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD510229f98feb1bf2ee1ceaa9f2fbe8ecd
SHA10b9afd62410a3babb6b333742a0554a76d14423a
SHA25668c33a98e80b427876a4383e4d70f9d4d4ed085e74e37b94327d3a590fb65f8b
SHA512a025a0f7309364cc1e328585d1df2ede7e3dda26bd3490fe6b56949f1c93096714ea0fe5154a72abe9ab44a38fcb0bd26cf1c39b646323aab9aa6ab1d76cb7d6