Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
0977488ce758275521ddafd26b1b0265_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0977488ce758275521ddafd26b1b0265_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0977488ce758275521ddafd26b1b0265_JaffaCakes118.html
-
Size
23KB
-
MD5
0977488ce758275521ddafd26b1b0265
-
SHA1
08d8314694fbc89023f2938a52b6d550338959de
-
SHA256
b5208eb24550ecba6f991bda6911b58eb1c7d21622b4e5fe53d24a7f21265680
-
SHA512
50cc8ced91d2b4e7e476b97e0481f89c8c6da6ac8cf54dc633818883cde9ab9e13064d82fc360a5c82184da85011b88b57abce6ae79f4f8f16dc51997400600a
-
SSDEEP
384:UMBCdDlbRSuhcx1r0unEPpz4Z0rxwiT2Iwy7p/uu2uzDlS3O+XGL9DyFmh8/7XuS:UMBCdeRx1r0QEPpzLxN9C3O+XGL9DyFD
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3376 msedge.exe 3376 msedge.exe 1964 msedge.exe 1964 msedge.exe 3164 identity_helper.exe 3164 identity_helper.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe 216 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe 1964 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1084 1964 msedge.exe 85 PID 1964 wrote to memory of 1084 1964 msedge.exe 85 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 4532 1964 msedge.exe 86 PID 1964 wrote to memory of 3376 1964 msedge.exe 87 PID 1964 wrote to memory of 3376 1964 msedge.exe 87 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88 PID 1964 wrote to memory of 5020 1964 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0977488ce758275521ddafd26b1b0265_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcff3546f8,0x7ffcff354708,0x7ffcff3547182⤵PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:82⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:3056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:2520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:216
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4684
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD53294e95675c5d6393c2a243c5212a954
SHA127c1168e9870bddee6f625036d3c5b4ef0254406
SHA256dce7e578c2f8516f5a2452444c7dfbf22ada0db537fd3cad0fa8d1eb3bef1e7e
SHA512f4895179947db7558590c9210ae26338c51fb94d3ed9c3a91085fb7ee5b38dc7184126b163d3b8814ba2c2d67675b33cd6b2662113eb4592810ac143e8eb9304
-
Filesize
1KB
MD52c643f69b665e162eaf0bc83f68c3447
SHA1cd8a2277410c40c4dbd5dc869af8abf4a8a32c48
SHA25656628a7e90812845b93add1849ae76c4aa95cf666a4b48740d607f0e994e4fcf
SHA512762c7d0098f2f9ccfa1bb42aefb6b7e430f03aaaaac3204a76135fbcd19d50d4f4a13d7d3f6f03b53e26a28733d59a371b18e6e6cf627d9c7d63d0d15db37bd9
-
Filesize
6KB
MD59579e1531ef367511532135a08b26027
SHA1d0fcf1940a65f75e8c1a9dcefec4d09d2fe7227f
SHA256bc933867976c321985d231d7ddf0ea5baa26fb4ec81c76c84f0fd4123fe4fac6
SHA5126efa6fe841bb1d229931f16688637f1732f1c953f5463a635b8c429678c5706dfad590925c92661fd3ddc9d97a67881f2715b3d5cf8205ce3d7f577728d362ef
-
Filesize
7KB
MD57aec29e8944b63d0744f31adf00ac919
SHA16a7efdf0e09d418f5032823410e098129a99ef7d
SHA256fc248acaa8e71bc0f893a3ff04bdb3947dc17f043aa93db949d816303dbaf853
SHA512d94d4fd7c8e9d47ba64bdedf2320f76e76dcb1fb062e7925710d804374ce70c6b3366bc54a7a9b440817498e23fdda24fbb040086e1f7a402697f8ef251db816
-
Filesize
7KB
MD5cf3eda2bdb5a89ee0007d89111c1bf05
SHA1179742f01b7088f519d8aff93e3b2a1f36d04ba8
SHA256042e9a990eb00613a528a76988d6eb82fd144b15a6022247ddcc529ec57a35c9
SHA512bd84864e74613ee9963e239f4bf64a6792270db422c9d29846e9208a3155a6f8a0e565e22f9af23914f5932a72aa989fe09f5be459a72937c3ddd1c12cc6f119
-
Filesize
536B
MD538570c5d31fbe874582399bdb841bcfa
SHA13b6bb809057e38b46234753549494ea4587d655f
SHA25695ac2d9e03983e4ec1613e1a63f110052bf5365eb361f98ca2fc30d06760ae9b
SHA512419af4450ddb223eebaa8ba96331d2cc0dbbfa1e15f2bdb9392434c5a4b426833d97e5d755dc93d7bc245d3214df4d3ebb1706297e1d7c2a6f7d037337158916
-
Filesize
204B
MD581c1cf378ab59729d6865dab72c82116
SHA12b5266bffbcc5118df8f3ab31fbcecb16f22ee3b
SHA25635fa8e8eab0390c5a33bd61ee310847106078a37c57bbab99ca62797ff4f9c00
SHA512af12a304d8f9807a62fe017117df3b1d24d95ade791f14fc0d2e73d99df270216a2dde6ce9913233878e44dd83a96aaa63201e4ee76814209deaf7715e95b0bb
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD54d89e7088bfa2a2b8685f8434225cf4f
SHA16a87f59e7905a1c719d5b6d56b62431d6b97fff1
SHA256d80288e3e3b7f8ddfbdcbe2279ed99946302237a8fd74e628709f91bbf817a51
SHA5126189b505e7cefa44050af61fad3fed6eeb47a3b6494de3f60ffe2dceae43d90a1faaf17431a4df150a151a7ece8090f55e4288ccdec9da7d3619c86bc662ea41