Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 21:22 UTC
Static task
static1
Behavioral task
behavioral1
Sample
a69fcb9c9e98c922037d07b29617890e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a69fcb9c9e98c922037d07b29617890e_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
a69fcb9c9e98c922037d07b29617890e_JaffaCakes118.html
-
Size
4KB
-
MD5
a69fcb9c9e98c922037d07b29617890e
-
SHA1
76d63fbff143fa22a7c6aaf7a3d029b8d15ec638
-
SHA256
87c71563a526ac205164712b3de5d7d1130865a09cc139711c8498cb52797bbf
-
SHA512
1f401bad852a095418925f8d72925c9e8d9158222b4d470c75ff3c7c5fea2c24550eccb68d5095b79435449a8d8ba5d8aadcd098d34e8cd9e0743520e25f54b3
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8otKFd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDt
Malware Config
Signatures
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a69fcb9c9e98c922037d07b29617890e_JaffaCakes118.html1⤵PID:636
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4288 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:11⤵PID:5028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=756 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:11⤵PID:64
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2544 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:5040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5496 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:11⤵PID:4484
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5924 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:800
Network
-
Remote address:8.8.8.8:53Requestbusiness.bing.comIN AResponsebusiness.bing.comIN CNAMEbusiness-bing-com.b-0005.b-msedge.netbusiness-bing-com.b-0005.b-msedge.netIN CNAMEb-0005.b-msedge.netb-0005.b-msedge.netIN A13.107.6.158
-
Remote address:8.8.8.8:53Requestbusiness.bing.comIN UnknownResponsebusiness.bing.comIN CNAMEbusiness-bing-com.b-0005.b-msedge.netbusiness-bing-com.b-0005.b-msedge.netIN CNAMEb-0005.b-msedge.net
-
Remote address:8.8.8.8:53Requestwww.microsoft.comIN AResponsewww.microsoft.comIN CNAMEwww.microsoft.com-c-3.edgekey.netwww.microsoft.com-c-3.edgekey.netIN CNAMEwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netIN CNAMEe13678.dscb.akamaiedge.nete13678.dscb.akamaiedge.netIN A23.34.233.128
-
Remote address:8.8.8.8:53Requestwww.microsoft.comIN UnknownResponsewww.microsoft.comIN CNAMEwww.microsoft.com-c-3.edgekey.netwww.microsoft.com-c-3.edgekey.netIN CNAMEwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netIN CNAMEe13678.dscb.akamaiedge.net
-
Remote address:8.8.8.8:53Requestwww.microsoft.comIN AResponsewww.microsoft.comIN CNAMEwww.microsoft.com-c-3.edgekey.netwww.microsoft.com-c-3.edgekey.netIN CNAMEwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netIN CNAMEe13678.dscb.akamaiedge.nete13678.dscb.akamaiedge.netIN A23.34.233.128
-
Remote address:8.8.8.8:53Requestnav-edge.smartscreen.microsoft.comIN AResponsenav-edge.smartscreen.microsoft.comIN CNAMEtm-prod-wd-csp-edge.trafficmanager.nettm-prod-wd-csp-edge.trafficmanager.netIN CNAMEprod-agic-uw-3.ukwest.cloudapp.azure.comprod-agic-uw-3.ukwest.cloudapp.azure.comIN A51.11.108.188
-
Remote address:8.8.8.8:53Requestnav-edge.smartscreen.microsoft.comIN UnknownResponsenav-edge.smartscreen.microsoft.comIN CNAMEtm-prod-wd-csp-edge.trafficmanager.nettm-prod-wd-csp-edge.trafficmanager.netIN CNAMEprod-agic-uw-3.ukwest.cloudapp.azure.com
-
Remote address:8.8.8.8:53Requestbzib.nelreports.netIN AResponsebzib.nelreports.netIN CNAMEbzib.nelreports.net.akamaized.netbzib.nelreports.net.akamaized.netIN CNAMEa416.dscd.akamai.neta416.dscd.akamai.netIN A2.20.12.87a416.dscd.akamai.netIN A2.20.12.101
-
Remote address:8.8.8.8:53Requestbzib.nelreports.netIN UnknownResponsebzib.nelreports.netIN CNAMEbzib.nelreports.net.akamaized.netbzib.nelreports.net.akamaized.netIN CNAMEa416.dscd.akamai.net
-
Remote address:8.8.8.8:53Request188.108.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request128.233.34.23.in-addr.arpaIN PTRResponse128.233.34.23.in-addr.arpaIN PTRa23-34-233-128deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request76.234.34.23.in-addr.arpaIN PTRResponse76.234.34.23.in-addr.arpaIN PTRa23-34-234-76deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request87.12.20.2.in-addr.arpaIN PTRResponse87.12.20.2.in-addr.arpaIN PTRa2-20-12-87deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestwww.microsoft.comIN AResponsewww.microsoft.comIN CNAMEwww.microsoft.com-c-3.edgekey.netwww.microsoft.com-c-3.edgekey.netIN CNAMEwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netIN CNAMEe13678.dscb.akamaiedge.nete13678.dscb.akamaiedge.netIN A23.34.233.128
-
Remote address:8.8.8.8:53Requestcdn-adef.akamaized.netIN AResponsecdn-adef.akamaized.netIN CNAMEa326.d.akamai.neta326.d.akamai.netIN A2.20.12.103a326.d.akamai.netIN A2.20.12.90
-
Remote address:8.8.8.8:53Requestcdn-adef.akamaized.netIN UnknownResponsecdn-adef.akamaized.netIN CNAMEa326.d.akamai.net
-
Remote address:8.8.8.8:53Request103.12.20.2.in-addr.arpaIN PTRResponse103.12.20.2.in-addr.arpaIN PTRa2-20-12-103deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestedgestatic.azureedge.netIN AResponseedgestatic.azureedge.netIN CNAMEedgestatic.afd.azureedge.netedgestatic.afd.azureedge.netIN CNAMEazureedge-t-prod.trafficmanager.netazureedge-t-prod.trafficmanager.netIN CNAMEshed.dual-low.s-part-0036.t-0009.t-msedge.netshed.dual-low.s-part-0036.t-0009.t-msedge.netIN CNAMEs-part-0036.t-0009.t-msedge.nets-part-0036.t-0009.t-msedge.netIN A13.107.246.64
-
Remote address:8.8.8.8:53Requestedgestatic.azureedge.netIN UnknownResponseedgestatic.azureedge.netIN CNAMEedgestatic.afd.azureedge.netedgestatic.afd.azureedge.netIN CNAMEazureedge-t-prod.trafficmanager.netazureedge-t-prod.trafficmanager.netIN CNAMEshed.dual-low.s-part-0036.t-0009.t-msedge.netshed.dual-low.s-part-0036.t-0009.t-msedge.netIN CNAMEs-part-0036.t-0009.t-msedge.net
-
Remote address:8.8.8.8:53Requestc.s-microsoft.comIN AResponsec.s-microsoft.comIN CNAMEc-s.cms.ms.akadns.netc-s.cms.ms.akadns.netIN CNAMEc.s-microsoft.com-c.edgekey.netc.s-microsoft.com-c.edgekey.netIN CNAMEe13678.dscg.akamaiedge.nete13678.dscg.akamaiedge.netIN A23.34.233.128
-
Remote address:8.8.8.8:53Requestc.s-microsoft.comIN UnknownResponsec.s-microsoft.comIN CNAMEc-s.cms.ms.akadns.netc-s.cms.ms.akadns.netIN CNAMEc.s-microsoft.com-c.edgekey.netc.s-microsoft.com-c.edgekey.netIN CNAMEe13678.dscg.akamaiedge.net
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.251.17.2.in-addr.arpaIN PTRResponse88.251.17.2.in-addr.arpaIN PTRa2-17-251-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestnw-umwatson.events.data.microsoft.comIN AResponsenw-umwatson.events.data.microsoft.comIN CNAMEblobcollector.events.data.trafficmanager.netblobcollector.events.data.trafficmanager.netIN CNAMEonedsblobprdcus17.centralus.cloudapp.azure.comonedsblobprdcus17.centralus.cloudapp.azure.comIN A13.89.179.12
-
Remote address:13.89.179.12:443RequestPOST /Telemetry.Request HTTP/1.1
Connection: Keep-Alive
Content-Type: application/xml
User-Agent: Crashpad/0.8.0 WinHTTP/10.0.19041.1151 Windows_NT/10.0.19041.1202 (x64)
Content-Length: 3685
Host: nw-umwatson.events.data.microsoft.com
ResponseHTTP/1.1 200 200 OK
Content-Type: text/xml
Server: Microsoft-HTTPAPI/2.0
Strict-Transport-Security: max-age=31536000
Date: Thu, 13 Jun 2024 21:22:48 GMT
-
Remote address:8.8.8.8:53Request12.179.89.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestwcpstatic.microsoft.comIN AResponsewcpstatic.microsoft.comIN CNAMEconsentdeliveryfd.azurefd.netconsentdeliveryfd.azurefd.netIN CNAMEfirstparty-azurefd-prod.trafficmanager.netfirstparty-azurefd-prod.trafficmanager.netIN CNAMEshed.dual-low.s-part-0036.t-0009.t-msedge.netshed.dual-low.s-part-0036.t-0009.t-msedge.netIN CNAMEs-part-0036.t-0009.t-msedge.nets-part-0036.t-0009.t-msedge.netIN A13.107.246.64
-
Remote address:8.8.8.8:53Requestwcpstatic.microsoft.comIN UnknownResponsewcpstatic.microsoft.comIN CNAMEconsentdeliveryfd.azurefd.netconsentdeliveryfd.azurefd.netIN CNAMEfirstparty-azurefd-prod.trafficmanager.netfirstparty-azurefd-prod.trafficmanager.netIN CNAMEshed.dual-low.s-part-0036.t-0009.t-msedge.netshed.dual-low.s-part-0036.t-0009.t-msedge.netIN CNAMEs-part-0036.t-0009.t-msedge.net
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request98.58.20.217.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.61.62.23.in-addr.arpaIN PTRResponse97.61.62.23.in-addr.arpaIN PTRa23-62-61-97deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request75.61.62.23.in-addr.arpaIN PTRResponse75.61.62.23.in-addr.arpaIN PTRa23-62-61-75deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request15.173.189.20.in-addr.arpaIN PTRResponse
-
1.9kB 9.8kB 17 21
-
2.7kB 22.9kB 26 36
-
10.6kB 12.9kB 30 34
-
1.2kB 7.5kB 11 12
-
2.5kB 6.0kB 13 15
-
1.8kB 9.6kB 12 15
-
86.8kB 4.7MB 1818 3362
-
1.8kB 7.8kB 12 13
-
1.8kB 7.6kB 11 11
-
4.9kB 8.0kB 13 11
HTTP Request
POST https://nw-umwatson.events.data.microsoft.com/Telemetry.RequestHTTP Response
200 -
8.0kB 272.5kB 124 214
-
4.1kB 91.0kB 53 78
-
1.1kB 5.1kB 9 11
-
1.2kB 898 B 7 7
-
63 B 144 B 1 1
DNS Request
business.bing.com
DNS Response
13.107.6.158
-
63 B 185 B 1 1
DNS Request
business.bing.com
-
63 B 230 B 1 1
DNS Request
www.microsoft.com
DNS Response
23.34.233.128
-
63 B 275 B 1 1
DNS Request
www.microsoft.com
-
63 B 230 B 1 1
DNS Request
www.microsoft.com
DNS Response
23.34.233.128
-
80 B 199 B 1 1
DNS Request
nav-edge.smartscreen.microsoft.com
DNS Response
51.11.108.188
-
80 B 243 B 1 1
DNS Request
nav-edge.smartscreen.microsoft.com
-
65 B 172 B 1 1
DNS Request
bzib.nelreports.net
DNS Response
2.20.12.872.20.12.101
-
65 B 204 B 1 1
DNS Request
bzib.nelreports.net
-
72 B 158 B 1 1
DNS Request
188.108.11.51.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
128.233.34.23.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
76.234.34.23.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
87.12.20.2.in-addr.arpa
-
63 B 230 B 1 1
DNS Request
www.microsoft.com
DNS Response
23.34.233.128
-
68 B 128 B 1 1
DNS Request
cdn-adef.akamaized.net
DNS Response
2.20.12.1032.20.12.90
-
68 B 157 B 1 1
DNS Request
cdn-adef.akamaized.net
-
70 B 133 B 1 1
DNS Request
103.12.20.2.in-addr.arpa
-
70 B 231 B 1 1
DNS Request
edgestatic.azureedge.net
DNS Response
13.107.246.64
-
70 B 275 B 1 1
DNS Request
edgestatic.azureedge.net
-
63 B 193 B 1 1
DNS Request
c.s-microsoft.com
DNS Response
23.34.233.128
-
63 B 238 B 1 1
DNS Request
c.s-microsoft.com
-
204 B 3
-
72 B 158 B 1 1
DNS Request
140.32.126.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.251.17.2.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
83 B 214 B 1 1
DNS Request
nw-umwatson.events.data.microsoft.com
DNS Response
13.89.179.12
-
71 B 145 B 1 1
DNS Request
12.179.89.13.in-addr.arpa
-
69 B 251 B 1 1
DNS Request
wcpstatic.microsoft.com
DNS Response
13.107.246.64
-
69 B 282 B 1 1
DNS Request
wcpstatic.microsoft.com
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
71 B 131 B 1 1
DNS Request
98.58.20.217.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
97.61.62.23.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
75.61.62.23.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
15.173.189.20.in-addr.arpa