Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 08:31 UTC
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ba93114e75c50c960c0c5519036659d_JaffaCakes118.exe
Resource
win7-20240221-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2ba93114e75c50c960c0c5519036659d_JaffaCakes118.exe
Resource
win10v2004-20240704-en
0 signatures
150 seconds
General
-
Target
2ba93114e75c50c960c0c5519036659d_JaffaCakes118.exe
-
Size
31KB
-
MD5
2ba93114e75c50c960c0c5519036659d
-
SHA1
c83a9e73f0bbbb1036e3733b4ffe1d95705fd462
-
SHA256
f072635e461769d5087e64817c5ff989d3b074cec8708413fa86a2f221afbaef
-
SHA512
cd26e141b23784389cacd20d565a11e1271bf33f5e27b5803a8e90d003cb3c48dbbef3e4bdf8282e9c75726ac53581b06e26ca801f5c07d3feedd7ca7f8b4682
-
SSDEEP
384:nuf3bxBkFs/WydTfgfOYp46o1NYmXTKgbrj8C2kfUdHvUHzxMRlqq4VriokJtoqX:nufu/+gf1p4tYmjr8CQPUTx2lq9itd/
Score
1/10
Malware Config
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A204.79.197.237dual-a-0034.a-msedge.netIN A13.107.21.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ce2ee0541a4472a8d83117392a544ca&localId=w:80C42694-01F1-B8D2-8770-8E8AF68950B9&deviceId=6825836536513024&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ce2ee0541a4472a8d83117392a544ca&localId=w:80C42694-01F1-B8D2-8770-8E8AF68950B9&deviceId=6825836536513024&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=31AAF154715B6289113EE5E270F16388; domain=.bing.com; expires=Sat, 02-Aug-2025 14:10:52 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 10C5D71CA8604DE18D5D27C7A1F2128D Ref B: DUS30EDGE0911 Ref C: 2024-07-08T14:10:52Z
date: Mon, 08 Jul 2024 14:10:51 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8ce2ee0541a4472a8d83117392a544ca&localId=w:80C42694-01F1-B8D2-8770-8E8AF68950B9&deviceId=6825836536513024&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8ce2ee0541a4472a8d83117392a544ca&localId=w:80C42694-01F1-B8D2-8770-8E8AF68950B9&deviceId=6825836536513024&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=31AAF154715B6289113EE5E270F16388
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=nQn589Q7Z-N2xMDwSV7oceceJ9yZUXl7ftt1vjq5FjY; domain=.bing.com; expires=Sat, 02-Aug-2025 14:10:52 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6C07A41BA13B4709BBFCF72ABC121C1B Ref B: DUS30EDGE0911 Ref C: 2024-07-08T14:10:52Z
date: Mon, 08 Jul 2024 14:10:52 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ce2ee0541a4472a8d83117392a544ca&localId=w:80C42694-01F1-B8D2-8770-8E8AF68950B9&deviceId=6825836536513024&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ce2ee0541a4472a8d83117392a544ca&localId=w:80C42694-01F1-B8D2-8770-8E8AF68950B9&deviceId=6825836536513024&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=31AAF154715B6289113EE5E270F16388; MSPTC=nQn589Q7Z-N2xMDwSV7oceceJ9yZUXl7ftt1vjq5FjY
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E72B81B29B0B4D34BA961C279090F3CF Ref B: DUS30EDGE0911 Ref C: 2024-07-08T14:10:53Z
date: Mon, 08 Jul 2024 14:10:52 GMT
-
Remote address:8.8.8.8:53Request22.177.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request237.197.79.204.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request147.142.123.92.in-addr.arpaIN PTRResponse147.142.123.92.in-addr.arpaIN PTRa92-123-142-147deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request8.173.189.20.in-addr.arpaIN PTRResponse
-
204.79.197.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ce2ee0541a4472a8d83117392a544ca&localId=w:80C42694-01F1-B8D2-8770-8E8AF68950B9&deviceId=6825836536513024&anid=tls, http22.0kB 9.3kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ce2ee0541a4472a8d83117392a544ca&localId=w:80C42694-01F1-B8D2-8770-8E8AF68950B9&deviceId=6825836536513024&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8ce2ee0541a4472a8d83117392a544ca&localId=w:80C42694-01F1-B8D2-8770-8E8AF68950B9&deviceId=6825836536513024&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8ce2ee0541a4472a8d83117392a544ca&localId=w:80C42694-01F1-B8D2-8770-8E8AF68950B9&deviceId=6825836536513024&anid=HTTP Response
204
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.23713.107.21.237
-
72 B 158 B 1 1
DNS Request
22.177.190.20.in-addr.arpa
-
73 B 143 B 1 1
DNS Request
237.197.79.204.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
147.142.123.92.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
31.243.111.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
8.173.189.20.in-addr.arpa