Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 07:49
Static task
static1
Behavioral task
behavioral1
Sample
3ea6c83c21400626189e324979729230_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
3ea6c83c21400626189e324979729230_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
3ea6c83c21400626189e324979729230_JaffaCakes118.html
-
Size
70KB
-
MD5
3ea6c83c21400626189e324979729230
-
SHA1
795a145f001495da177d9fc6a45cc8d5347466ed
-
SHA256
633c8211fce5ebe33e92c882aa9e87dd6ba42ca8d7180413a7414c4bdea55ff9
-
SHA512
4760f430b0ce8fa926d17bf4fca86e76fa0ac46c192e94a48f2204d2741e03f15578c197d06e47cfd0556b69c4d64456f0fa1d1105797b6cffa5405d94f39fd5
-
SSDEEP
1536:gQZBCCOdw0IxCC1/39bxgUHnUCIkfFwEeynR9iSiishwDF70xCcph4grW2YaCqxb:gk2m0Ixf39bxgUHnUCIkfFwEeynR9iSK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1128 msedge.exe 1128 msedge.exe 228 msedge.exe 228 msedge.exe 2640 identity_helper.exe 2640 identity_helper.exe 3776 msedge.exe 3776 msedge.exe 3776 msedge.exe 3776 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe 228 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 228 wrote to memory of 1788 228 msedge.exe 83 PID 228 wrote to memory of 1788 228 msedge.exe 83 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 3020 228 msedge.exe 85 PID 228 wrote to memory of 1128 228 msedge.exe 86 PID 228 wrote to memory of 1128 228 msedge.exe 86 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87 PID 228 wrote to memory of 1684 228 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ea6c83c21400626189e324979729230_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf2ba46f8,0x7ffdf2ba4708,0x7ffdf2ba47182⤵PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:3020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:12⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:12⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:82⤵PID:1364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:12⤵PID:1116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:12⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:12⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4059837688568427662,5642965108675212351,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3776
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5068
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56960857d16aadfa79d36df8ebbf0e423
SHA1e1db43bd478274366621a8c6497e270d46c6ed4f
SHA256f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
SHA5126deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
-
Filesize
152B
MD5f426165d1e5f7df1b7a3758c306cd4ae
SHA159ef728fbbb5c4197600f61daec48556fec651c1
SHA256b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
SHA5128d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
-
Filesize
215KB
MD51585c4c0ffdb55b2a4fdc0b0f5c317be
SHA1aac0e0f12332063c75c690458b2cfe5acb800d0a
SHA25618a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5
SHA5127021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD581489aec17a5ccbccb8dc2322ce58e8c
SHA12dc0a7fc81f2836d09f7e3db5189ba9c14525dcb
SHA25621b397864c8ff14e5224672a383af258968cae8c7eed1d050281754c77d51d1e
SHA512e1c105b9a8193fbc17c7a71ecf4ebd4d0a3ab27fb1f9a7a9320f9b872a3d25cc857d686e347963cbec432741b857fd695ed328480adbd5a41bde9d5a509951d9
-
Filesize
1KB
MD512a6a036e6304acc8ef3ceeffa18c35e
SHA1764beea4a8f16921958c18e2561ee7af25ca157a
SHA256dee51fb5320d9be480d4189cd04602c8af405718ad771f077e063cb9b2a6b09d
SHA51288f3df6463a52eaff98081adb145796b1b32c2710ac5b788c98167f9763f31726a6dd25f755ec2cdabb9ce9a4b0dd60da1d14bc4d1959711a8883eb46042547b
-
Filesize
6KB
MD5d6b5516b39b26425781dcfc8058f0bc6
SHA169d9e708828997f957ef5e05dac6428278061a73
SHA2569701c391de9ea153e4f9d5458ca5cd9113ffa35773013a60726c467b8c61338e
SHA512c7216f761bbe8456f6dc55fdcc7f2b8d3da5ad8e18381a818c4f75686637087b1db29e17e1bf9e6d1bfe135511c4f7ad846f1007b918e5320b01be3e610171d0
-
Filesize
6KB
MD5824dad638443ad345291618a147d6eee
SHA184c2b05a86355562b873a139043e6e5408e2854d
SHA256d723b43c6bcc15eb596d0e8d55378f81011ac98f9e253f233cb3683ef9675e4f
SHA5129bff73e6517b652a2fac7d4ed5d6e652ecee8613faa3e72fa2db8265ee325714ea29d1f57d4cfc0800b322a846cffc906286a2146cde7ff23346c8d67f1bd274
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD500d83aae5dc70b05f49af3e9b7a145e8
SHA1b2c57b6e5fa4a57487db98c9ac4448cae108e004
SHA256e107ed7cfe8870c7e86a724d739629cb6f65f63e0cacc7dc11f379404038d906
SHA512b3b05a26bf358887d1d44d2bd9286fe5a9729c41c85c61d0aaf4d7962d35fbcbbbf73e01a1787b73a0db9b8ff8175f0d97519807c74ddc708b7c7f4142b4b60e