Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
2d1e3273cace4499f3efcb4519774684_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2d1e3273cace4499f3efcb4519774684_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
2d1e3273cace4499f3efcb4519774684_JaffaCakes118.html
-
Size
57KB
-
MD5
2d1e3273cace4499f3efcb4519774684
-
SHA1
f29abe897dd86f60a7dac78ec1011792d5a96bc0
-
SHA256
9f66b63b9e88dc56270431441128a4c6c59a9744a58bf58e15413efadd115d4c
-
SHA512
6a0a5507d503a8ffddcc1f61198b4129a6debb6f690ff9904b1759dc82f60df9b039011d1f44f3abc0a97172b8d0a0611bee75936add00db4e0f9894cb05959b
-
SSDEEP
1536:gQZBCCOdg0IxCMlKMePtjIBev13Qmqap0VQHEcwnb0qX+YKP/MnElSeTdWfsShmQ:gk2G0IxKMePtEBev13Qmfp0VQkcwnb0I
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3488 msedge.exe 3488 msedge.exe 552 msedge.exe 552 msedge.exe 1716 identity_helper.exe 1716 identity_helper.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe 552 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 552 wrote to memory of 2304 552 msedge.exe 83 PID 552 wrote to memory of 2304 552 msedge.exe 83 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3688 552 msedge.exe 84 PID 552 wrote to memory of 3488 552 msedge.exe 85 PID 552 wrote to memory of 3488 552 msedge.exe 85 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86 PID 552 wrote to memory of 2320 552 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d1e3273cace4499f3efcb4519774684_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf11646f8,0x7ffbf1164708,0x7ffbf11647182⤵PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:22⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:1156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:12⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:1396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:82⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:12⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:2668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5422890850447224009,16184354133888630721,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3372
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1944
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7cb450b1315c63b1d5d89d98ba22da5
SHA1694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA25638355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
-
Filesize
152B
MD537f660dd4b6ddf23bc37f5c823d1c33a
SHA11c35538aa307a3e09d15519df6ace99674ae428b
SHA2564e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
-
Filesize
213KB
MD5f942900ff0a10f251d338c612c456948
SHA14a283d3c8f3dc491e43c430d97c3489ee7a3d320
SHA25638b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6
SHA5129b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD5cfcfbd6ada952deffe065ddfe73a6328
SHA10fce4e43b022ca5ed39d9b9365584f81269e8280
SHA2569526536175d3b180906bdacb87e82299a8f394bff9c07d0d615cec3eb22866f1
SHA5120c8d2ab0c0437db11a926d248a19f756faca6f4b8d31665bc18fe6766c83deebe51a5781263d15ea77d8bdcca746144bf86e9a06ab7c823f1f94e36953d055f4
-
Filesize
1KB
MD5a92077ceeaaedafae14e8eaad6f3ecbc
SHA18d85e0164dcd1ee35f7742f57f81787e853e29f7
SHA2562173a538229e74a0ef1ed992e6a0d415db14a3214b3374a24e63323abeed7fc0
SHA51257701304a52a9e1f99b4f079fa7f60878a1179ea74ea3a74990016018c0b832dea5858e96fd912bd4bc117932611db3cc2a8a4cc1200b05737a3df40a37e6551
-
Filesize
6KB
MD5ec13222a2d0c1e8c8f1fd8a8cfe03ecf
SHA16f8c7c2757ab952b84a610193ff025087b94ef97
SHA256434ba35ef7d5c71e74cf427e10ba07dba481eee427527d2a6fed25734b178727
SHA512d9c292a61699ddc66bb6dcafac742a12f9883e6df0426508e435c1d1318b668870e66a0fa86b4d017c9075a93891e322733d97181fc10803e534f132de9955f6
-
Filesize
6KB
MD52f3b92368c50d3e8ec873238728c6265
SHA1823484e2fd77e36a55c4a297de03cee489fd967a
SHA256c4e2d6d5083edf2fd67c86fa692f6641ebd45a74556e61d57ca819bf8f086c62
SHA512f98beb50aa3373b54fc6078943fc8063804644ed2624d9f0d49e209c4e86fb5ad9735e6ecf92056f547bfc5aa94d4b782809369d051b6f6ea00ad7c5a0428e54
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD54732bd338bd0a2b34d9054a2aebb97e5
SHA184a8fe1b267b9141f729772bd198367b4adbb142
SHA256ddbc640e99ed29faacf9bf5649e73849d19e11548322251cb6efb59220c52119
SHA512970d4be4c41408640a1516eafd9bab9e0e3bcd410c1902270b0f408f5e723759eaa8b80ffda23b016aae91449e430db88c1a310bba6a5ffc8176dddfdc9a93df