Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
0c34e1987d75aca6d4846b2bd1028308_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0c34e1987d75aca6d4846b2bd1028308_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0c34e1987d75aca6d4846b2bd1028308_JaffaCakes118.html
-
Size
15KB
-
MD5
0c34e1987d75aca6d4846b2bd1028308
-
SHA1
d6ae98fe3bf90b887d19da8345d861c81e7e50e9
-
SHA256
bae32ab53b791789d8f5577b3e2c0c382c86ce2ffb9c3a6b4cdc6c7c0f14adc9
-
SHA512
daf0c6173d13cfb19cf6fcd278054d53d316900c5f1ae2a7e437afadba1303603f6d5e2d025b230a1219b474fdc5e19de972b63ba5ff46877424498aff47dd3c
-
SSDEEP
192:yhfhT5jcIchp6tMYrqP74q9X5ezXHQ2vG/L5wqH9dYOPNHF/2ntwaillmP3KTALd:y9XcIprq99OHQ2OWqYzC2V
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3216 msedge.exe 3216 msedge.exe 4760 msedge.exe 4760 msedge.exe 4864 identity_helper.exe 4864 identity_helper.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe 4300 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4760 wrote to memory of 3596 4760 msedge.exe 82 PID 4760 wrote to memory of 3596 4760 msedge.exe 82 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 1656 4760 msedge.exe 83 PID 4760 wrote to memory of 3216 4760 msedge.exe 84 PID 4760 wrote to memory of 3216 4760 msedge.exe 84 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85 PID 4760 wrote to memory of 3732 4760 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0c34e1987d75aca6d4846b2bd1028308_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff889ca46f8,0x7ff889ca4708,0x7ff889ca47182⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:1656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:12⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵PID:1320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:12⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:1708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:12⤵PID:2616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:12⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1788,2608028474281015234,9650256097021923905,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2620 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4300
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4560
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
213KB
MD5f942900ff0a10f251d338c612c456948
SHA14a283d3c8f3dc491e43c430d97c3489ee7a3d320
SHA25638b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6
SHA5129b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5da1a932d023fb5c8edca201931606ac3
SHA1842a7f8b737fef00a5e2af7c2b657e069eff6831
SHA256ead9e4a6c952c13b95b987c8f277e33d349109a6fdde0d561fd4037111d052d7
SHA512299434acca3a7257f048d2815e6ce11441a97eb3a75842ca2924dedcc26d5ac46785b03ed4830c508fdf05d785f0990a4f4c36eb684bb0261e822d02a50f7950
-
Filesize
1KB
MD5016dba500e5640ef93d85e1a5bf6ee6b
SHA1e58a9d7e767a0a3e71d157d0ff538145da717e37
SHA2567bce76fc47fd90d8502c36ad8a576b6d67bfe602216aa631a9080bd07a246194
SHA5128d3b3315077f8eaa71c8b4e6600e02ad6dfce3c35e7c07c42daaad25359f462dfc74e2675bb1908822d58a856d508decaff2b1e387489cd6ea20fc0d5c519d9e
-
Filesize
6KB
MD5f6160baf940acbf35955563136483f49
SHA18dafcc37f69114c67fe0564a79f8ea709dcd369d
SHA2561439acf50c2df0f98058eb2cdd3880815c703570aa2f254cbf35dfb72d98ff35
SHA51277856ef9cefb4d81871fadf03c6bc1ead9756b7613e80b47126b4a28e8c937d45840f8cb1bf11e032faf771a9b914c1bfb8e279fd157b0eca9a9656037d8937c
-
Filesize
5KB
MD58f84abd50f0cb70b4dd3724a7e323444
SHA1221bfd8dac640202f51596b66e7d4f74ef35e46a
SHA2564bc0dd8a9d6238c79ffd648eba9b01b107bc0e54c0304b3048cc543a494f61d0
SHA51290ad338443aeace7dc0713580717204916cd4e6749b5e838e3f142e40a5825b9259862c67e1d9c41065734a9c136f7795db9903e68550c8c199d82d14a90993d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e53cc741479b9dd9fab16ef2e7a862a5
SHA1766c0761aaae5f0602e5266dd08e753ef674c2c9
SHA25653172cb8c005a5945911419199dddf9e1618db225b280575063e8fe24d74845e
SHA512d2935c2b5109afbc484165b2c5ac47f373d1cc169f273c6e0a2095cc09915413433ccbc25a10413572886f24fd927d8adc3691592328849b75a995f4888240cd