Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2024, 00:07
Static task
static1
Behavioral task
behavioral1
Sample
e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe
-
Size
132KB
-
MD5
e39cccd2c1f0998f0e34fa525132868d
-
SHA1
94b39b2dcf8682cb2b5b039428219ca4a6d6eb6b
-
SHA256
d9040bf8ad755cd41dc6266c0e0049f4bac0eaa23f18a26931357fe21c719701
-
SHA512
b3304da8e9fea96412b7b9122168f6e528016330a2d364700cfc4d4640d54a0b03e25d3a7c9748b0a49c34b48a1fc4a0e3259dab96503e78cf487a6fbb32f77b
-
SSDEEP
3072:Xu9+L1Dpafpq70qTfRSlO9ts42CvASp+2H8UeH:X6+L1DkfPqTJSAPs42CvzpFc
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Startup key = "C:\\Users\\Admin\\AppData\\Local\\Temp\\directory\\yourphoen.vbs" e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3908 e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe 4288 e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3908 set thread context of 4288 3908 e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe 95 -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3908 e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3908 e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3908 wrote to memory of 4288 3908 e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe 95 PID 3908 wrote to memory of 4288 3908 e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe 95 PID 3908 wrote to memory of 4288 3908 e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe 95 PID 3908 wrote to memory of 4288 3908 e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe"1⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e39cccd2c1f0998f0e34fa525132868d_JaffaCakes118.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4288
-