Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
3ba79b04e125662dabac05bba2035d7f_JaffaCakes118.html
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3ba79b04e125662dabac05bba2035d7f_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
3ba79b04e125662dabac05bba2035d7f_JaffaCakes118.html
-
Size
15KB
-
MD5
3ba79b04e125662dabac05bba2035d7f
-
SHA1
0655bfa954f8fe77809a73871f2d3623da706d9d
-
SHA256
72bf9e25dbc1ca0620eb616df60cddfd9ac473d7c2f4ba76dd21875890fded4b
-
SHA512
b66684d9b53a655edffd8eab4159a1c3d3b08ffe7240995a2cec9d0be4a820221e90744ce6d0e3840c7dcdbbdb5073f495d3b5cbd42b050096de9f4686e9da3a
-
SSDEEP
384:INvNpNWbGNDcDNENyWNYFND0Nbd1NTNFLNFEy4NUtPNONNcb55Na9SNaChN0qNfO:IlrDlcDGAWm+lRzJFE1GPKOfASoqeqZO
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3352 msedge.exe 3352 msedge.exe 4596 msedge.exe 4596 msedge.exe 3272 identity_helper.exe 3272 identity_helper.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe 348 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4596 wrote to memory of 4660 4596 msedge.exe 83 PID 4596 wrote to memory of 4660 4596 msedge.exe 83 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 320 4596 msedge.exe 84 PID 4596 wrote to memory of 3352 4596 msedge.exe 85 PID 4596 wrote to memory of 3352 4596 msedge.exe 85 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86 PID 4596 wrote to memory of 3824 4596 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ba79b04e125662dabac05bba2035d7f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff84a846f8,0x7fff84a84708,0x7fff84a847182⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:3824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:12⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:12⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:12⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:12⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:82⤵PID:2460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:12⤵PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16077315609720329629,8522800704679432166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:348
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:208
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD55d8532f92a716d099b47d12cfb810f73
SHA1fe3cf198966f9db6d14aa9d697459c5d4c8d95af
SHA256b1546dbc658594f09f7b7b79985282801e604cf29a3e39bf9381632961713a18
SHA512e353f6477006d1f2eda82cf2b481e79872cf2d02971993509f93224fd35c783f4a4cb8b7dc4ddffd1ce870c8412f8c59b74f6ed8c9fe3697b86195452a954eb6
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1KB
MD57af57a0f2bd3f61e571a2f29ff4ac854
SHA1bd288b15cc8052bad6fa9c3a01b95e7a6b772e03
SHA25607e4698229387a35713c5d42f9b2d171241830055b810c4596c7d598c021ffae
SHA5129313c6887e35702fa8d17a48986190e259aed647a7ff978dc0b836ab421d946e50d6aeb5ec831e8402e2c696eff11862c8fbdc85b7167e564998b6a094e04e57
-
Filesize
6KB
MD5e538124f6cae973732af11093dc8c4bf
SHA13d2decbe0f806b615861bd4a8abd4dd82730e3c1
SHA256a7af3d84a3dba022cdc6d00dbf9b2ee7635ec6d1b8472bc6dabda226d53e3128
SHA512376708d3fc7d7b3e814e8ab8466b463ddec96a3ba224e93bb93deeb65754059b711359bfb7fc8123c8afd05d0e7917301a97bb88a8416c3d2086db308a222c7e
-
Filesize
6KB
MD5e52f16a71a746acb1f8527c651393cb3
SHA1c3e27d1aa4cee6b4e5fb71c9f34e17c590de55c3
SHA2568cd576260550f7e69c6d855f88965485cf44bd84cb2f46dc8616b53f8d1708c7
SHA5128400e8eb8280ab6129fae0e429e2753f6879598390604ca22656e0dcd58fbce594519f2206f667b96b0f36a8c8971ce0f218d23f5b163b1ee175a96dd7d4bf68
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD52dc8e4a29593c38fe79904bdd7819973
SHA18c04ec10c9d58e7cef77d681e93e52bdf234716e
SHA2560c764738869e22f71a9450b689cd4de319dd63cfc84058c21b3cbdc4a2505b0c
SHA512f41dd7ba8f7eeec843d46e304ccbc4c68f3064a750de0ce4d604412e5e559d53c0be0af5240df56263980d13dc2d8042521c08f0412ac5abe5b3be187b12559a