Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 07:08 UTC
Static task
static1
Behavioral task
behavioral1
Sample
f08b71e04eccb6384f4e3a4d2be4f9cc_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f08b71e04eccb6384f4e3a4d2be4f9cc_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f08b71e04eccb6384f4e3a4d2be4f9cc_JaffaCakes118.exe
-
Size
113KB
-
MD5
f08b71e04eccb6384f4e3a4d2be4f9cc
-
SHA1
6882efb0151c46b6682e348fe34c778f33a6aa1b
-
SHA256
e602d97efcb54b3235b6aaa338b2fd5a0d25dbf7a4934ffc3e7e605bcd6396a6
-
SHA512
f593e8ff4c105807a86de3cdd857e7101404ad0a8f3a2e457a640c6c380aadb87461b53c2f800b52d6b5b1fec55a5e2c46ed37419b33914749eceefea4c5e8eb
-
SSDEEP
1536:czq4Q5uC0HVZxpDgOsuuHYg9napUvK94mYgiO0Cg73Hz2tu8HTLyIg:cOpY6uHg5+UvK6mYgiO1gjHirPzg
Malware Config
Signatures
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4748 f08b71e04eccb6384f4e3a4d2be4f9cc_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4748 wrote to memory of 2736 4748 f08b71e04eccb6384f4e3a4d2be4f9cc_JaffaCakes118.exe 84 PID 4748 wrote to memory of 2736 4748 f08b71e04eccb6384f4e3a4d2be4f9cc_JaffaCakes118.exe 84 PID 4748 wrote to memory of 2736 4748 f08b71e04eccb6384f4e3a4d2be4f9cc_JaffaCakes118.exe 84 PID 4748 wrote to memory of 2736 4748 f08b71e04eccb6384f4e3a4d2be4f9cc_JaffaCakes118.exe 84 PID 4748 wrote to memory of 2736 4748 f08b71e04eccb6384f4e3a4d2be4f9cc_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f08b71e04eccb6384f4e3a4d2be4f9cc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f08b71e04eccb6384f4e3a4d2be4f9cc_JaffaCakes118.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:2736
-
Network
-
Remote address:8.8.8.8:53Request203.197.17.2.in-addr.arpaIN PTRResponse203.197.17.2.in-addr.arpaIN PTRa2-17-197-203deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request74.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A204.79.197.237dual-a-0034.a-msedge.netIN A13.107.21.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa24f69c4cf54c4ba8f879bc3eb16fda&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa24f69c4cf54c4ba8f879bc3eb16fda&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=1D35886084A1673821FA9C0285416659; domain=.bing.com; expires=Sat, 10-May-2025 07:08:14 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1A0B6CACB55C4D5299E51726EC9DF7F2 Ref B: LON04EDGE1213 Ref C: 2024-04-15T07:08:14Z
date: Mon, 15 Apr 2024 07:08:14 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=aa24f69c4cf54c4ba8f879bc3eb16fda&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=aa24f69c4cf54c4ba8f879bc3eb16fda&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1D35886084A1673821FA9C0285416659
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=qCJ2hCAcQ6Z0-AGbUm9nSdFVhzEsoZxV48O9FTrYos4; domain=.bing.com; expires=Sat, 10-May-2025 07:08:14 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 84659C60F9FA45C5B8A70CE5272CDAC3 Ref B: LON04EDGE1213 Ref C: 2024-04-15T07:08:14Z
date: Mon, 15 Apr 2024 07:08:14 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa24f69c4cf54c4ba8f879bc3eb16fda&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa24f69c4cf54c4ba8f879bc3eb16fda&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1D35886084A1673821FA9C0285416659; MSPTC=qCJ2hCAcQ6Z0-AGbUm9nSdFVhzEsoZxV48O9FTrYos4
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B6039B1600684FB5A8AB31CFA88705FF Ref B: LON04EDGE1213 Ref C: 2024-04-15T07:08:14Z
date: Mon, 15 Apr 2024 07:08:14 GMT
-
Remote address:8.8.8.8:53Request237.197.79.204.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request21.114.53.23.in-addr.arpaIN PTRResponse21.114.53.23.in-addr.arpaIN PTRa23-53-114-21deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.197.17.2.in-addr.arpaIN PTRResponse240.197.17.2.in-addr.arpaIN PTRa2-17-197-240deploystaticakamaitechnologiescom
-
204.79.197.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa24f69c4cf54c4ba8f879bc3eb16fda&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=tls, http22.0kB 9.2kB 21 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa24f69c4cf54c4ba8f879bc3eb16fda&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=aa24f69c4cf54c4ba8f879bc3eb16fda&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa24f69c4cf54c4ba8f879bc3eb16fda&localId=w:82014CF4-DC18-5C6E-6DB2-ACA702FC47E3&deviceId=6896199938616243&anid=HTTP Response
204
-
71 B 135 B 1 1
DNS Request
203.197.17.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
74.32.126.40.in-addr.arpa
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.23713.107.21.237
-
73 B 143 B 1 1
DNS Request
237.197.79.204.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
21.114.53.23.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
26.165.165.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
240.197.17.2.in-addr.arpa
-