Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 00:09
Static task
static1
Behavioral task
behavioral1
Sample
278010c76ec9c306762b6bde210329e7_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
278010c76ec9c306762b6bde210329e7_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
278010c76ec9c306762b6bde210329e7_JaffaCakes118.html
-
Size
91KB
-
MD5
278010c76ec9c306762b6bde210329e7
-
SHA1
1c9e68ab3feeecf17482b09fb8fb094716489b74
-
SHA256
a438f07246a83d82b247916dbc5fd7261463de4199bce819751f489c8821e46f
-
SHA512
bcfd602f3c9ee14cc4ec3e75fb8ef656e75e66cf4104cdb1b675be5e3761c8170328641c11b6fd781ba26b2915a1129342cc1321d338e21319a7b969dbfbba58
-
SSDEEP
1536:gQZBCCOdTafDe90IxCw1sAhfeDKx+oJaFbOYTgCBGpHTojElpKt8QNN4JE3An64z:gk29afDe90Ixt1sAhfeDKx+oJaFbOYTS
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4252 msedge.exe 4252 msedge.exe 4440 msedge.exe 4440 msedge.exe 2416 identity_helper.exe 2416 identity_helper.exe 4048 msedge.exe 4048 msedge.exe 4048 msedge.exe 4048 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 2100 4440 msedge.exe 84 PID 4440 wrote to memory of 2100 4440 msedge.exe 84 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 1980 4440 msedge.exe 85 PID 4440 wrote to memory of 4252 4440 msedge.exe 86 PID 4440 wrote to memory of 4252 4440 msedge.exe 86 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87 PID 4440 wrote to memory of 4300 4440 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\278010c76ec9c306762b6bde210329e7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefb2f46f8,0x7ffefb2f4708,0x7ffefb2f47182⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:12⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:12⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:82⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:12⤵PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:12⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8498976119062998650,14578156689577428831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4048
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
213KB
MD5f942900ff0a10f251d338c612c456948
SHA14a283d3c8f3dc491e43c430d97c3489ee7a3d320
SHA25638b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6
SHA5129b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD5319612ac127b813689152e5926a46f16
SHA1255ca22052a3633591f5ca9538c747e065101065
SHA256fa6018670bc06ac39316f07631304aac5c6cca10eab3a64e8dc4d1953bd700c1
SHA512e04ad0a54cddca2102acc4592c49aa16b7a07820630c0f3532ad2464d58ba1aae1244666b53378db084227723f25623d0a94ecdac1e6f3c570c9fa29bff05b16
-
Filesize
1KB
MD5d60508e6a5f08435128e68eb874c0c74
SHA1e180f3395f0e399c1d38fe27c158642cf30a7ddd
SHA256b4be49b491c3461d7c90ffd1253f43cfe186c9add8ac9241e0874d1a3b5c1629
SHA512290baadb9dc323c59aa14dbd9845240056a31177e3d5e456177db551f5ffe2f4a4415a6c020d0b8db38e2b4e42912433608486947c2295db30e55f41e439eff0
-
Filesize
6KB
MD56aca1f80daa35fc86ce30255709f53d5
SHA12a869354d16d27f16b1fd7cd3d7f8e470095dbb9
SHA2562e85721867d8165bc60ee51e505d17c5a6f9aeaec972e0c40a290479d197085a
SHA512f068f55fe37422238f892055ce74bd80deba6b16c670454d2ebd944d733c76221db721e9b5aca0d4d0ba3c7a59ed83b6f1694d0e7b28ef667bd8bac774045a77
-
Filesize
6KB
MD51e1ca11772b8e628e2cbbfb398a5ce37
SHA185f7bd9cd97666f6b641d3de5803fc978b181c34
SHA256e269fbc094f0171ecac99048dc9c3f9e1901d6913e183a5db3ca7b6841db9aae
SHA51250c9448c36c4c961e724cb863c68d5cd4deacea8928c546ecc005506257f2b5311f62058b2a3cc330519aa2c1061513736e0bbe83322b1022b7b9976aed01ed3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5e759248db35553714c0ecc488079b029
SHA1e776859da1e0ef732b2184cfe898258e78d59c75
SHA2563521a10b8c2ab470f2fa433a7222c1b47898fb6ff424e3971da03052410a6dd7
SHA51232329a4aa6168228871c6d6653a72e97d2cc874d81f86dadf4c4e34134be36fa7ccab3194b2f32fb69f8d3a92fad93ac8c3f6d06823d3e9f610cf670ae80ef46