Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 15:38 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2fd38ed6161911a2b605f80122fabdb5_JaffaCakes118.js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2fd38ed6161911a2b605f80122fabdb5_JaffaCakes118.js
Resource
win10v2004-20240508-en
General
-
Target
2fd38ed6161911a2b605f80122fabdb5_JaffaCakes118.js
-
Size
122KB
-
MD5
2fd38ed6161911a2b605f80122fabdb5
-
SHA1
9e398b47ac9ad2eb8017702fbcfb699c66388d98
-
SHA256
fcff4ee82571df71e20220bafd152d9ec7f75f571d54c1c2f0ad081e3360f671
-
SHA512
581e4bb90b0e9e1a5a8d75e27b525fa21535892071768d5c68b459785ed3ed902dc99b63fa894cde6d1b4097b1167c6303c6deb35ca0af7e6bfa52efeaecd550
-
SSDEEP
1536:pdvjLeyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:pJyyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A204.79.197.237dual-a-0034.a-msedge.netIN A13.107.21.237
-
GEThttps://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82N4vcxBpUXCmSbb4kqdaPjVUCUxIhm6jo4bfkr23gytiKxXXKer_Rm5iwzRMfiFD-twptE4-8A2cDLO4sgf3qBM-Jeo68L1Hkc-zuwU43HZI_IBNbh3cnJEUDnyyAcN-yn3WPkfq3vDlObnGJ0RTzcIGfhl77Qy3J3GyVk63AEiXBm_D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D93114cfc7f1d17c337432ac71fc17867&TIME=20240508T112443Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48Remote address:204.79.197.237:443RequestGET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82N4vcxBpUXCmSbb4kqdaPjVUCUxIhm6jo4bfkr23gytiKxXXKer_Rm5iwzRMfiFD-twptE4-8A2cDLO4sgf3qBM-Jeo68L1Hkc-zuwU43HZI_IBNbh3cnJEUDnyyAcN-yn3WPkfq3vDlObnGJ0RTzcIGfhl77Qy3J3GyVk63AEiXBm_D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D93114cfc7f1d17c337432ac71fc17867&TIME=20240508T112443Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48 HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=3AC737B5FFBC6A032FFE23CEFE5C6BD7; domain=.bing.com; expires=Wed, 04-Jun-2025 15:38:40 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9D0DF47553894E13815E7CABD12762DE Ref B: LON04EDGE1008 Ref C: 2024-05-10T15:38:40Z
date: Fri, 10 May 2024 15:38:40 GMT
-
GEThttps://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82N4vcxBpUXCmSbb4kqdaPjVUCUxIhm6jo4bfkr23gytiKxXXKer_Rm5iwzRMfiFD-twptE4-8A2cDLO4sgf3qBM-Jeo68L1Hkc-zuwU43HZI_IBNbh3cnJEUDnyyAcN-yn3WPkfq3vDlObnGJ0RTzcIGfhl77Qy3J3GyVk63AEiXBm_D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D93114cfc7f1d17c337432ac71fc17867&TIME=20240508T112443Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48Remote address:204.79.197.237:443RequestGET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82N4vcxBpUXCmSbb4kqdaPjVUCUxIhm6jo4bfkr23gytiKxXXKer_Rm5iwzRMfiFD-twptE4-8A2cDLO4sgf3qBM-Jeo68L1Hkc-zuwU43HZI_IBNbh3cnJEUDnyyAcN-yn3WPkfq3vDlObnGJ0RTzcIGfhl77Qy3J3GyVk63AEiXBm_D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D93114cfc7f1d17c337432ac71fc17867&TIME=20240508T112443Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48 HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3AC737B5FFBC6A032FFE23CEFE5C6BD7; _EDGE_S=SID=1C58C08C0DB46E0E1CC7D4F70C1E6FD9
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=TRFRXYvk70Eu8q5s2V7iJEMeKiTo3vJwI0MF01Or7xM; domain=.bing.com; expires=Wed, 04-Jun-2025 15:38:40 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 02D53BD2543A4F6B871AD3DFAC48DEB5 Ref B: LON04EDGE1008 Ref C: 2024-05-10T15:38:40Z
date: Fri, 10 May 2024 15:38:40 GMT
-
GEThttps://www.bing.com/aes/c.gif?RG=e482f0a2da9a44ba9e3dc4f86d4637f5&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112443Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182Remote address:88.221.83.200:443RequestGET /aes/c.gif?RG=e482f0a2da9a44ba9e3dc4f86d4637f5&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112443Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182 HTTP/2.0
host: www.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3AC737B5FFBC6A032FFE23CEFE5C6BD7
ResponseHTTP/2.0 200
pragma: no-cache
vary: Origin
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 61E80F076081462B8FDAF300ECE3C3FE Ref B: DUS30EDGE0722 Ref C: 2024-05-10T15:38:40Z
content-length: 0
date: Fri, 10 May 2024 15:38:40 GMT
set-cookie: _EDGE_S=SID=1C58C08C0DB46E0E1CC7D4F70C1E6FD9; path=/; httponly; domain=bing.com
set-cookie: MUIDB=3AC737B5FFBC6A032FFE23CEFE5C6BD7; path=/; httponly; expires=Wed, 04-Jun-2025 15:38:40 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c453dd58.1715355520.16e719c6
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request77.190.18.2.in-addr.arpaIN PTRResponse77.190.18.2.in-addr.arpaIN PTRa2-18-190-77deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request77.190.18.2.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request237.197.79.204.in-addr.arpaIN PTRResponse
-
GEThttps://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90Remote address:88.221.83.200:443RequestGET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
cookie: MUID=3AC737B5FFBC6A032FFE23CEFE5C6BD7; _EDGE_S=SID=1C58C08C0DB46E0E1CC7D4F70C1E6FD9; MSPTC=TRFRXYvk70Eu8q5s2V7iJEMeKiTo3vJwI0MF01Or7xM; MUIDB=3AC737B5FFBC6A032FFE23CEFE5C6BD7
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1107
date: Fri, 10 May 2024 15:38:41 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.c453dd58.1715355521.16e71cad
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.83.221.88.in-addr.arpaIN PTRResponse200.83.221.88.in-addr.arpaIN PTRa88-221-83-200deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request25.14.97.104.in-addr.arpaIN PTRResponse25.14.97.104.in-addr.arpaIN PTRa104-97-14-25deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request100.58.20.217.in-addr.arpaIN PTRResponse
-
204.79.197.237:443https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82N4vcxBpUXCmSbb4kqdaPjVUCUxIhm6jo4bfkr23gytiKxXXKer_Rm5iwzRMfiFD-twptE4-8A2cDLO4sgf3qBM-Jeo68L1Hkc-zuwU43HZI_IBNbh3cnJEUDnyyAcN-yn3WPkfq3vDlObnGJ0RTzcIGfhl77Qy3J3GyVk63AEiXBm_D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D93114cfc7f1d17c337432ac71fc17867&TIME=20240508T112443Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48tls, http22.5kB 9.0kB 20 17
HTTP Request
GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82N4vcxBpUXCmSbb4kqdaPjVUCUxIhm6jo4bfkr23gytiKxXXKer_Rm5iwzRMfiFD-twptE4-8A2cDLO4sgf3qBM-Jeo68L1Hkc-zuwU43HZI_IBNbh3cnJEUDnyyAcN-yn3WPkfq3vDlObnGJ0RTzcIGfhl77Qy3J3GyVk63AEiXBm_D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D93114cfc7f1d17c337432ac71fc17867&TIME=20240508T112443Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82N4vcxBpUXCmSbb4kqdaPjVUCUxIhm6jo4bfkr23gytiKxXXKer_Rm5iwzRMfiFD-twptE4-8A2cDLO4sgf3qBM-Jeo68L1Hkc-zuwU43HZI_IBNbh3cnJEUDnyyAcN-yn3WPkfq3vDlObnGJ0RTzcIGfhl77Qy3J3GyVk63AEiXBm_D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D93114cfc7f1d17c337432ac71fc17867&TIME=20240508T112443Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48HTTP Response
204 -
88.221.83.200:443https://www.bing.com/aes/c.gif?RG=e482f0a2da9a44ba9e3dc4f86d4637f5&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112443Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182tls, http21.4kB 5.3kB 16 10
HTTP Request
GET https://www.bing.com/aes/c.gif?RG=e482f0a2da9a44ba9e3dc4f86d4637f5&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112443Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182HTTP Response
200 -
88.221.83.200:443https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90tls, http21.6kB 6.4kB 17 12
HTTP Request
GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90HTTP Response
200
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.23713.107.21.237
-
132 B 90 B 2 1
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
8.8.8.8.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
14.160.190.20.in-addr.arpa
DNS Request
14.160.190.20.in-addr.arpa
-
140 B 133 B 2 1
DNS Request
77.190.18.2.in-addr.arpa
DNS Request
77.190.18.2.in-addr.arpa
-
73 B 143 B 1 1
DNS Request
237.197.79.204.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
200.83.221.88.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
26.165.165.52.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
25.14.97.104.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
-
72 B 132 B 1 1
DNS Request
100.58.20.217.in-addr.arpa