Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 07:40
Static task
static1
Behavioral task
behavioral1
Sample
563910fba4919269133f3684bf8d6d99_JaffaCakes118.html
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
563910fba4919269133f3684bf8d6d99_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
563910fba4919269133f3684bf8d6d99_JaffaCakes118.html
-
Size
7KB
-
MD5
563910fba4919269133f3684bf8d6d99
-
SHA1
ebbaf35bc416d4a87602bfe100627b176148db97
-
SHA256
e22f888844d74338bfe4745731471b4361a118d0e45961a74fdf7a6c76b44bdf
-
SHA512
cc9a9dad73f6bcb38e35ea528df6371177296089f14a749ee5a4b9397d3d02564176f8b98bb22a629e85dc78fc0eb60493801b73e6f9698da4ebc3a982900e07
-
SSDEEP
48:ImMq1Up8vmbBssgAiEgVr+CflxYOZAyNGWBXtz44xt5YWDrWN8VKSeK5Iakq/jxT:SIbf9NBXYwoIkO017gz1dRrcRC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4032 msedge.exe 4032 msedge.exe 3540 msedge.exe 3540 msedge.exe 4588 identity_helper.exe 4588 identity_helper.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3540 wrote to memory of 3672 3540 msedge.exe 84 PID 3540 wrote to memory of 3672 3540 msedge.exe 84 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4024 3540 msedge.exe 85 PID 3540 wrote to memory of 4032 3540 msedge.exe 86 PID 3540 wrote to memory of 4032 3540 msedge.exe 86 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87 PID 3540 wrote to memory of 1960 3540 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\563910fba4919269133f3684bf8d6d99_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc02b446f8,0x7ffc02b44708,0x7ffc02b447182⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:12⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:82⤵PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1416 /prefetch:12⤵PID:4084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:12⤵PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1731195018105329172,17810838033211143408,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4000 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1236
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3800
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\879be623-5f70-4a41-9bbc-a6a025afa0f5.tmp
Filesize5KB
MD597af15e989b981a90efe4460ffa59353
SHA1a12b106d26a6d49d1ce38e8a4b87d1d2f90fe4e7
SHA256f5ce0b2f20cb1cdaee13f8d502e7da4201ce99160dca9393ba36c8c225edb46a
SHA512dfa8cbab05d6da3408c4b134a6de7e949c58046204fdf1d39b29ad516f1981126de49fdd33d958f400105964591c65af846ea572ac446a918e5fc279e551a4db
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD56269c1672a4a1ed445f21e1565f002e0
SHA156f8a388a8a240170dd8c75f1ef483595f5b201b
SHA256c4f30547ad7cc6e535f298cac8ce92f9fd00bc8e436aa684f9aa2e7020da68ee
SHA51281cc0f0fea9a28f52ab03668b9734c704de9cab3030063b12573980e1406c1013915a6dece4c93546aff0bb8381f1c5effffaddf8880affb27816c55d8087d86
-
Filesize
182B
MD59142b251885531ea20ad790f115ee80f
SHA1bb6c5b9641a2c59b86e2cd01febbcde2357fb68a
SHA2562fdd7ce8cc41a618d93ccbb41ddfaae5c629e970f35faa4dc5c1f2161c27d28d
SHA51223899fb4fc810ea72300ad7b817bddac1b7a8d931e7097ceea6a342d12ef70065138812c8324b3aedffe8dffda4eb64f347e989840ed227a7f5fcad84130bedf
-
Filesize
6KB
MD5526bfc6297cff50588a78c8035864fc0
SHA1241cd0d9f235851de85db4bf40018fc394eae9a8
SHA25639e4cf3ad23c5c005b3be6bc7ad3b625bfc98a98b8386901f5b606c05b98df4b
SHA512c3d2adfba52dc7139eb9e706e5ae9088754018312f9f42688fea2170e7f79e2b0a3f22a7a67d0f089702bb1622611ebea653a2effadbf63ee086ecd0de5f397b
-
Filesize
6KB
MD56a2ba8cc7681db4c3b5d1066c5db806f
SHA1b54eb45e59094557c21aa20154e3694c47f3ee04
SHA2568ffda126c5a47df5a20e6740b414b063e8ffaa47fa9ae4c5491792dc05d4944b
SHA512c5dbe6681880595d4006c13c26b137a36955864c47735a14d6880a4394fa65c0e9614d4eedb58c039f0109d2e9f4c5aba3f86f0e0cc943a6bd271c6025e29b5d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5194bf9982dab674b7e45972290ae1cbb
SHA1432dc989edf128494efeebc8df09a42d744d97ff
SHA256e6fb20a8582ecdd1a5665a533c3a83495a7f59d0098150d5f41f1f081e397055
SHA512f549c9e5d0021ab4881838b64ebfd0f4b95bb8b23659df2ad38ee146f2065008df4172bce6b928005308e2a604cf9bdb12c7904e03932b94bc47b8e95818ca72