Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 04:33
Static task
static1
Behavioral task
behavioral1
Sample
15fe99b64cb3b169d18dd0c870d3f08c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
15fe99b64cb3b169d18dd0c870d3f08c_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
15fe99b64cb3b169d18dd0c870d3f08c_JaffaCakes118.html
-
Size
1KB
-
MD5
15fe99b64cb3b169d18dd0c870d3f08c
-
SHA1
258669cd13dcf4b26cbe08bee19c988a92b3b9c8
-
SHA256
b0cbf06bf581b49928d0946a2ee973a9cf2a31c8fe8028f3b6e1c6f26561ee37
-
SHA512
39dc66ce3aa61165c289c98005a0eda38447f92f2f3ecfc2e0be3a3ef06a3b9713e3e4e76f8f805d398a8a6fcdb4f6c47d672855c3a5973375d10ffb8ecf40c4
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1388 msedge.exe 1388 msedge.exe 1284 msedge.exe 1284 msedge.exe 4416 identity_helper.exe 4416 identity_helper.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe 1636 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1388 wrote to memory of 3132 1388 msedge.exe 85 PID 1388 wrote to memory of 3132 1388 msedge.exe 85 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 2536 1388 msedge.exe 86 PID 1388 wrote to memory of 1284 1388 msedge.exe 87 PID 1388 wrote to memory of 1284 1388 msedge.exe 87 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88 PID 1388 wrote to memory of 2064 1388 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\15fe99b64cb3b169d18dd0c870d3f08c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeb4546f8,0x7ffdeb454708,0x7ffdeb4547182⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2472 /prefetch:82⤵PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:12⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3876837148968049714,13108888854511888632,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1636
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1940
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
Filesize
5KB
MD554dbf418d5393953334abc2ef9728a92
SHA14078cb6ea10b11ccc2a6b7236e2ce19581c2eb2b
SHA256c10298758e59a014aef3c4e26647de94178d5d3c2207598b3e524b71a7a7f7d5
SHA512dafae1a75053ef2f1cda62174271fd9be9d36f25a29564d8a78f6608d345c1a6a175b83335dfab858ce5e9834d703860dac60f981b51297d846384d0bbbe473b
-
Filesize
6KB
MD5fb3461138dfa9b32bdabe16efe80ace5
SHA11052df1dd427a651ab6b692496348b8375094a4b
SHA256f6c64b199903c77ef1f0ff1302572f212f6d70b21a0f6eefbaa911fc88894972
SHA512497fa9fc5996596066b89d2ab029bf43d9ad8289b80fc4bdb05b4bb7ac6ea2919eea595f63a02f35e1aa539b8428165e3374fb8c6906cfaa2f88ce57e51a3118
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD52325c6dad4564de52dc14e615b0a6f19
SHA1c48a06c0e92ed7550aff83ec97fd33b5068b939a
SHA2561cee662cde467992d27e96b9bbfc4bfb2a5b5e097f071db481a7bc8d7b14e5a6
SHA512a4ff0e2472484ed151bb05135e1730efe4a7bc5557052520feeb4ce90b8dd377283541191666b6bdbd9502c37c4d281a507cfb0b0db3575ac6c31182b029cf1b