Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 03:09
Static task
static1
Behavioral task
behavioral1
Sample
3d787990f546afe0612b7b4403f94823_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3d787990f546afe0612b7b4403f94823_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
3d787990f546afe0612b7b4403f94823_JaffaCakes118.html
-
Size
4KB
-
MD5
3d787990f546afe0612b7b4403f94823
-
SHA1
6aa013fd680a991434f3e0126de6cd3d9f53d9b8
-
SHA256
f085a0f9891858a12f5d2eb9e48b21e9f6b2c33be0ba2d2278e02c04b98a939f
-
SHA512
e04a180f3c8269781a5de778db17fe538afc3d17ff89ecb8779cdb1408dfa110cd33031889b3a6e2926f55e6e4e29ddf85a6a07d5a128ec9982263b7c5266dfe
-
SSDEEP
96:1Vd9hwVPcoGg/j5yntxI8vq/5K/u04Xz0Qpy/:rdbwWo1/j5sxI8vE4/uPjP4
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2116 msedge.exe 2116 msedge.exe 2100 msedge.exe 2100 msedge.exe 4292 identity_helper.exe 4292 identity_helper.exe 3836 msedge.exe 3836 msedge.exe 3836 msedge.exe 3836 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 5056 2100 msedge.exe 83 PID 2100 wrote to memory of 5056 2100 msedge.exe 83 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 3500 2100 msedge.exe 84 PID 2100 wrote to memory of 2116 2100 msedge.exe 85 PID 2100 wrote to memory of 2116 2100 msedge.exe 85 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86 PID 2100 wrote to memory of 864 2100 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3d787990f546afe0612b7b4403f94823_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff61bd46f8,0x7fff61bd4708,0x7fff61bd47182⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:22⤵PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:12⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵PID:3900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:12⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:12⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,16318431843425929686,12693997312301045611,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3836
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2132
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5fd82b5271dfe502a714b177f3d228085
SHA15cd2c1dce73a7e97cc06b8c563baad2f3f3bb008
SHA2563fc819850835e76a84d62a5c66d18aa5005f272dd29c177ee7a1c7ebc384f4b8
SHA512d6b56cf6df2f586aa818fbd4d47fce9c1295d62559317f541b38fc847f44041dbced8bc5c62ec956d4719cb30668a066459c2faa3eeecf14fad554c453704cd5
-
Filesize
189B
MD5443319881835b14fda88caab9945e84c
SHA1adb420bd20774e8eabc4d3d53ecfccb20ae7cb54
SHA256fd79d0831e92ccbffc20eed3a0d07b39a121b4f3be4f720d2981fdd2e7b5b8da
SHA51239c2c7fd638c04ce244473831d3dc8175e8e9ecb9a0df38370300233202d7d7fa9166912b8d97b34efd7b90eab6da376191e1c5c9ce253e96c9686b886ab29fb
-
Filesize
6KB
MD59f27fba10386df5a50655a8a55bae68e
SHA1757c498cb7a11e0f3363d678bc6df1e2587a3a5c
SHA256f58e666429fd60cc81892fce61ca822cf09d6ede146645fe36e461b3f744531b
SHA512c6dee0aa229ccb208296cd660c6f79e4dfd7e332cffbdc234d9cac0022356f8f14584e1e7840c638e1f60c70bd411c198b9208e701b226af5e14f6c83bd6214a
-
Filesize
6KB
MD553d705b01563534adc5d96a42d98f07b
SHA19857a7d4d5cf4c9a56f14d75d9ead056db3712fb
SHA25656748d909d869886be7207b99ef4ff5a93b059a78a0ed00d228e3a74b80a628d
SHA51232cbf7c658efb1b37c60ea705a3c014d23006d0b547eab34624c3ce86ed208e0cee605bef39d763148ca48abbae27cdf87a71db3435125583957c4aac43519a8
-
Filesize
6KB
MD5e12b43b7999e5bdefb5d74481743614d
SHA1805f340646777fc04c3f7fc83585aee3336c1cd0
SHA256ba896c0d1a1a1db92e2f7415965aca21d204495fd682fa462158cdb31b64b4b6
SHA51294f3b96f539846586f9585971229219e4c6439a0067798fc93894032f26d5435d227620ee91da280093c5a9c19eba424737bfa607e49c6e0897b46db48d8a6d6
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD56d0927d4d8e0b39f7dca71486c8c258e
SHA1c09daefed06644985ea7ad7d623c0cab2f3ca251
SHA256d23e9714850af08b4c9217542121f699e4b52501c5a27ecad8c562cc41b63637
SHA5123dc4bf366e4f6d5cd337bbfca986bc69ba1c6bdb6bf4192026de5159421fa7dde0962ceec7eb30f98aacd9e92e79ef7df6b69dac8cd06c44cad9ce952137bb28