Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

2125b435e0...18.exe

windows7-x64

1

2125b435e0...18.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 04:58 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe

  • Size

    54KB

  • MD5

    2125b435e065ed4576810a64e5f50293

  • SHA1

    0d2906bd8fbd0f4140384bbc3ffaafae21a8ddbd

  • SHA256

    8d65dee17a45e8f144df50cbfab6a12010ed5db34b0447c3e15729608827dab2

  • SHA512

    9795cfc994bf494fd00488336a26161ed8e5ef59df77522d90b34b1c5a0d6a3368331a674448cc86ccaae5816de2ea3abfb946c384e1d59e65d40a0a75f1cdc4

  • SSDEEP

    1536:poMB4oy7pkr6C+RYWTORUI5DODt8PqPmI:GMVTWSOt8Pq+I

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2060

Network

  • flag-us
    DNS
    d.union.ijinshan.com
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    d.union.ijinshan.com
    IN A
    Response
    d.union.ijinshan.com
    IN CNAME
    d.union.ijinshan.com.c.cdnhwc1.com
    d.union.ijinshan.com.c.cdnhwc1.com
    IN CNAME
    hcdnd101.gslb.c.cdnhwc2.com
    hcdnd101.gslb.c.cdnhwc2.com
    IN A
    218.12.76.157
    hcdnd101.gslb.c.cdnhwc2.com
    IN A
    221.194.141.151
    hcdnd101.gslb.c.cdnhwc2.com
    IN A
    221.194.141.155
    hcdnd101.gslb.c.cdnhwc2.com
    IN A
    218.12.76.152
  • flag-us
    DNS
    download.shanhu99.com
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    download.shanhu99.com
    IN A
    Response
    download.shanhu99.com
    IN CNAME
    download.haozip.com
    download.haozip.com
    IN CNAME
    download.haozip.com.w.alikunlun.com
    download.haozip.com.w.alikunlun.com
    IN A
    101.226.28.235
    download.haozip.com.w.alikunlun.com
    IN A
    101.226.28.234
    download.haozip.com.w.alikunlun.com
    IN A
    101.226.28.241
    download.haozip.com.w.alikunlun.com
    IN A
    101.226.28.237
    download.haozip.com.w.alikunlun.com
    IN A
    101.226.28.239
    download.haozip.com.w.alikunlun.com
    IN A
    101.226.28.240
    download.haozip.com.w.alikunlun.com
    IN A
    101.226.28.236
    download.haozip.com.w.alikunlun.com
    IN A
    101.226.28.238
  • 218.12.76.157:80
    d.union.ijinshan.com
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    152 B
     3
  • 221.194.141.151:80
    d.union.ijinshan.com
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    152 B
     3
  • 221.194.141.155:80
    d.union.ijinshan.com
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    152 B
     3
  • 218.12.76.152:80
    d.union.ijinshan.com
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    152 B
     3
  • 101.226.28.235:80
    download.shanhu99.com
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    152 B
     3
  • 101.226.28.234:80
    download.shanhu99.com
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    152 B
     3
  • 101.226.28.241:80
    download.shanhu99.com
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    152 B
     3
  • 101.226.28.237:80
    download.shanhu99.com
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    52 B
     1
  • 8.8.8.8:53
    d.union.ijinshan.com
    dns
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    66 B
     213 B
     1
    1

    DNS Request

    d.union.ijinshan.com

    DNS Response

    218.12.76.157
    221.194.141.151
    221.194.141.155
    218.12.76.152

  • 8.8.8.8:53
    download.shanhu99.com
    dns
    2125b435e065ed4576810a64e5f50293_JaffaCakes118.exe
    67 B
     271 B
     1
    1

    DNS Request

    download.shanhu99.com

    DNS Response

    101.226.28.235
    101.226.28.234
    101.226.28.241
    101.226.28.237
    101.226.28.239
    101.226.28.240
    101.226.28.236
    101.226.28.238

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.