Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 17:57
Static task
static1
Behavioral task
behavioral1
Sample
3b574acf88275bb879e27a4e8f9dbf63_JaffaCakes118.html
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3b574acf88275bb879e27a4e8f9dbf63_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
3b574acf88275bb879e27a4e8f9dbf63_JaffaCakes118.html
-
Size
57KB
-
MD5
3b574acf88275bb879e27a4e8f9dbf63
-
SHA1
07cbc2f358079f044bb044bf4e16900f495c0e2e
-
SHA256
9b40a60dfd3d1b286a506ce3022e5daa5cba0c7c9cd69e64b9e0025513408408
-
SHA512
cd7adc8114135f005e00e6527d086c738e896863409eb14c07f60caf6cad1a07ffad7ed7ddde9ede2652d3558ebf404bc67ac5d46fe3faf703d32b0388f0a9bd
-
SSDEEP
1536:ijEQvK8OPHdsA6o2vgyHJv0owbd6zKD6CDK2RVroJtwpDK2RVy:ijnOPHdsK2vgyHJutDK2RVroJtwpDK2m
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4132 msedge.exe 4132 msedge.exe 1476 msedge.exe 1476 msedge.exe 1372 identity_helper.exe 1372 identity_helper.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1572 1476 msedge.exe 83 PID 1476 wrote to memory of 1572 1476 msedge.exe 83 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 1028 1476 msedge.exe 84 PID 1476 wrote to memory of 4132 1476 msedge.exe 85 PID 1476 wrote to memory of 4132 1476 msedge.exe 85 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86 PID 1476 wrote to memory of 2252 1476 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3b574acf88275bb879e27a4e8f9dbf63_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcad9f46f8,0x7ffcad9f4708,0x7ffcad9f47182⤵PID:1572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:2252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:82⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:12⤵PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:12⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6254565278835207129,9598640419392441364,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1268 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1448
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3688
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD59b734553ad3c6838aed2449372d3e5e0
SHA1c6c9d05a433a50d7e9bba9952325a99627ca0e59
SHA25640224f3194c6c5703b54157f64d6dd3ca0ed7310e6e7e89d0e2ecf10a5335fcd
SHA5129e933a594fe2258bd5fc75874be329b9950b9347ae683e5a9df362dbe134732d490c599d2614dd7fd0ace643efffc9ba092390f762bd0ab4c9108415d85c4723
-
Filesize
152B
MD5bffcefacce25cd03f3d5c9446ddb903d
SHA18923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA25623e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
SHA512761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7
-
Filesize
152B
MD5d22073dea53e79d9b824f27ac5e9813e
SHA16d8a7281241248431a1571e6ddc55798b01fa961
SHA25686713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
SHA51297152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize792B
MD5ea3e3091a298fe0b087724727a0b4594
SHA1334f1f945453fed7b2c852b56c4c9219e1019f9c
SHA256ba42b18160cda104a0cd3e17006304f4ef0d10420fb32eddee41977013b88f92
SHA51292076218093bec3799586a9659f7de6f58e11edc31eac66c105368a1eb750d7d90fbebcc4546531ed9fc35c2441d4c451cd36490754f0196c6928a296572f5a4
-
Filesize
1KB
MD5ffa63991714e6b4cfc08894cd6758cba
SHA10cde5f1ede2398d27e18e74cebf220b64836d352
SHA256486c097156458088873494f5c608a0a560a09efb24373de25ac243152ed019b1
SHA51266089dfb5c21bc8d317d85c7e6907debdb1fac368121d604c9fe8d87af0b80d3d7494e940364fb57996496123732d77cc8acb24e0fb99c9f646137aa94001270
-
Filesize
6KB
MD59f4b654116c2c6eeb43fa701570807f9
SHA12cd37a06fa023e5ae395e907c1e988f1ef8fdcaa
SHA256330f899a4a2b029a46fb05cf6744f24e5aa20571454a7f3addc9021cd59c1045
SHA512f7ff11e7bda89a282122d7e9441f5bd0a5da30e9a5f6ea3c3f1a72449deb8c08455abb19e6bfa5f438417a08bb571e1720bb538a231bc824ae8b305f1700f855
-
Filesize
6KB
MD57f927a3825c237327e14cabbd464bd63
SHA174a139c4bde3d0d845e10354ba681db583064d12
SHA256e9977e4d07b703a08d186908c0c361f799df6f3d145ed5fba20f67741fb0e0fa
SHA5125e5d6e04dfc203c0f7179e8ccd447af19c57410bec344c733b9a63cadba0de018b169cb4f73afdb25e4bf31f7fbb17c16f46c46b92d8adfa730385612c170514
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389