Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 23:48
Static task
static1
Behavioral task
behavioral1
Sample
15067ad48b14ea97001aaef299eb0529_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
15067ad48b14ea97001aaef299eb0529_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
15067ad48b14ea97001aaef299eb0529_JaffaCakes118.html
-
Size
17KB
-
MD5
15067ad48b14ea97001aaef299eb0529
-
SHA1
3287900e0f6de867187277960e60258bcc5c30c5
-
SHA256
56d9a64fc81bf1ea08712c3606ccc225ee5bf023715fde1d7b74ead9ffdbff5d
-
SHA512
1258f0095cacdf30e6b22dc48acf17505af612c130e3dd6c5e7b887b6deb3628ab3a20f6d702aed57cb5c04c14243c866adc4d6f3dabaf0966878f10346a7781
-
SSDEEP
192:SIM3t0I5fo9cKivXQWxZxdkVSoAI84qzUnjBhmI82qDB8:SIMd0I5nvHbsvmbxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4068 msedge.exe 4068 msedge.exe 1144 msedge.exe 1144 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe 5076 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1144 msedge.exe 1144 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe 1144 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1144 wrote to memory of 4808 1144 msedge.exe 83 PID 1144 wrote to memory of 4808 1144 msedge.exe 83 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 3288 1144 msedge.exe 84 PID 1144 wrote to memory of 4068 1144 msedge.exe 85 PID 1144 wrote to memory of 4068 1144 msedge.exe 85 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86 PID 1144 wrote to memory of 544 1144 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\15067ad48b14ea97001aaef299eb0529_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaeba946f8,0x7ffaeba94708,0x7ffaeba947182⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1983463122974633074,2565185171556321985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1983463122974633074,2565185171556321985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1983463122974633074,2565185171556321985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1983463122974633074,2565185171556321985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1983463122974633074,2565185171556321985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1983463122974633074,2565185171556321985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5076
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1428
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
Filesize
6KB
MD56a979b54dde839117e3382ca7269a532
SHA1f81a127b683979fbc20600ae870cf7260a20b489
SHA256305e1bd5e7a828f416ccb361861507cefbe691adb57fe1a402abd975db7098ee
SHA512721116ce84f7901960eb19f3c2ddf2f4c072e6161e53238c4767088dd2bddad2abd692eb608d1e8a19bd4e9f0c321f2cd40ef08e50ad0524aeb7a1338d479e29
-
Filesize
6KB
MD57c813fe305c05e0ac0ebb75269cd2486
SHA1f6bd359e146eb401dbe473287715ef4a38a7c182
SHA256d1d5288f879210f93cd0db8738f71c9c21123b816bc0dbb73c769cfa3790c224
SHA51283e0a0c9be4bf2d7085d344be6e0fd67c449e0673b742e2123f7aa3fbeea1b7746cd3266b3f7152b1bac9569a607e53097891a3e4f2d754ecabe0f7e18b5c7dd
-
Filesize
6KB
MD5ff9079c69487be9cda36356dc31abad9
SHA180be3d93fd22cf280600301d2ae82f3e19e73bf2
SHA2564c51f6acf8e62a70739eacc57efdfec1726c006296e6a32ac597d8bf94e065dc
SHA512de1fb6d844dff23d87fd7aa786bcab6e5379ebfb963dc3bb77e478bde5cfbde4a500666a7f7475728ca65c785825d2c4956dbd7130a88c56cd9248b1b658a56a
-
Filesize
11KB
MD5f33464b2f848d710b0d124d69a4a8a93
SHA19d9fb3b4d3431a829fb6c59c23e1ff0017014c31
SHA25628bbfe89c5d87a39bb525e20784551752f91307d51248f3413b6d14db62a31a1
SHA51274018ae053f72214989d4657bd124fea7a9781f9bd204f4a9cdbe2976c55cf158c5c82c0be9476b04285ed4136828aef9dbbb10f4b6f70361ea7482f95aa7a88