Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2024, 00:19
Static task
static1
Behavioral task
behavioral1
Sample
9ec0f5449893f1fd643e858ce4b518ff_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9ec0f5449893f1fd643e858ce4b518ff_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
9ec0f5449893f1fd643e858ce4b518ff_JaffaCakes118.html
-
Size
27KB
-
MD5
9ec0f5449893f1fd643e858ce4b518ff
-
SHA1
95d1e0e1ec8f0b6454cf5cf9fb33e66a251c35b2
-
SHA256
5b762fdde2f1431bd530341d20c2d91a3ce9f8fff4b63f93e82b507ab9ed13fd
-
SHA512
0713f00ecfebc6422aa9b68d3eeb075327980713a6e9449d1561b8f7e05d2682d146a7943653a0564cf2d1c6d72bf4b68940d03d619b4078e623774004295918
-
SSDEEP
768:DkdlSUlcT++HYCayA+snyOy59f5/E9YzGvJa+G:DkdlSU2T++HY5+snyOybVE9YzGvJa+G
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3104 msedge.exe 3104 msedge.exe 4816 msedge.exe 4816 msedge.exe 3640 identity_helper.exe 3640 identity_helper.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe 4816 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 2792 4816 msedge.exe 83 PID 4816 wrote to memory of 2792 4816 msedge.exe 83 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 4540 4816 msedge.exe 84 PID 4816 wrote to memory of 3104 4816 msedge.exe 85 PID 4816 wrote to memory of 3104 4816 msedge.exe 85 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86 PID 4816 wrote to memory of 1640 4816 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\9ec0f5449893f1fd643e858ce4b518ff_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb993b46f8,0x7ffb993b4708,0x7ffb993b47182⤵PID:2792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:22⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:12⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:12⤵PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:82⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:12⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,10809190439106544313,14045289558368360840,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5536 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1708
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4440
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
20KB
MD54b3121a05808b99aa6e0cc12924f77db
SHA1ee5805bb76c384d1e1667aea2976bd2f4f94c7cc
SHA256e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c
SHA5129b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD51ee378ca6bd5f536008a4a9d4acd529e
SHA153030c8b977fae6629ac544ba03d200f00e6d40b
SHA256598bb4a7b4115385fc43d5f69ba7016f6a519fc9d31a494ece94004b727d632f
SHA51256ddeffde2a5432fcecffc393a10f1efb1c92f240d3a7dc774e18ba6f3c629649f707d7ff90f6b41862330d214838e515f3f4c14c9c5e3bfe77924f7ce8174f4
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
7KB
MD522eeb2b226d15a6ffa73535a22b2aa15
SHA13ed87dd44201931163f64af9558d9e897f448918
SHA256d5cf228f12dd7061a86854a2b3d1c2346456e4856b4dadfe194ac35526bae9d3
SHA512490338c688ed90dda687741e825e8cd23c41deea222fc7bbf267f670cf93dc9eb136a691bd2929b4fca1e24511a36a2ff6da043f99c5e379106e6e1bcefdf590
-
Filesize
5KB
MD5266cc367b77ebf874316f6c2735bb44e
SHA148404a19f1354e25abeb1998161784821bf87538
SHA25625c5a7ee55cdd32ce53bfaff3714a9e0983e3af10d4129bab00b5b55f49f6b94
SHA512bae03ab7c029c632c003179275e5b8348450cd481b5565faeb683e635b2857d6c1d417c2b2509bc09c4e51990b7e0c3d21153f3eef10f3e9cb97d663dad4a9ca
-
Filesize
6KB
MD5172dfa1a762947306bd75da27d3fe386
SHA17999ea1a4e9e068abe75f2b881582304cf523da6
SHA256810a06cee8e948a0715c1fe27bb70c917493593c4332b09578c3da380b8546d8
SHA512045e44b1c08c0f74e47dda6f8330519a0ef9889a0a8000184f12f374c08411943027a3f8d1320aa0f34922fa650406f43a8ec4e0a12bfb0d34d86b2dc6f3bb1a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD58671078d8b92acd03f77629ab15f8b48
SHA15a1340b81dc8f7fb4ef573c948f21b5ae4426b17
SHA25679a7c707d3dd253759b13ff3b7d5a2c097d6b9714c80ef287736da07a137ea4c
SHA5120faff9cf55afc3bedee88b11237871cb13620950b9961654b135b3d5d64b04b9eabdd7c4b3220e2ba87da35139b5bfbbedbaef928f0579cadb09c93562049bac