Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 19:05
Static task
static1
Behavioral task
behavioral1
Sample
ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe
-
Size
10.6MB
-
MD5
ebc74288f42a0c390a0eddd12807a9d2
-
SHA1
7c3de60bd047eb1e3cbacbbbafd48354a8acb875
-
SHA256
e2ddc3acaa676596c8a5922c449f9d235610854cf9a8796885ae547726fc99bb
-
SHA512
6a6bdef1a17f93adab911e8ce9f6b1344332da0ab5d89db22d38f4d44d5a28195f3efba20051549e944ebc9a2078ae3df9cf4d8499b50f2ea4f246a4b0c92f75
-
SSDEEP
24576:8pvxh4TO4OsVZRzALvx44ApeIknRC9EpXdPC+P+NvZLuksQtZaemNmWxNxxfc25u:K0TYsq24lICNPoNvtshwYzRDdYfX
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\claujyosoq.exe clip.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\claujyosoq.exe clip.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2844 set thread context of 1084 2844 ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe 91 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1084 clip.exe 1084 clip.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2844 wrote to memory of 1084 2844 ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe 91 PID 2844 wrote to memory of 1084 2844 ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe 91 PID 2844 wrote to memory of 1084 2844 ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe 91 PID 2844 wrote to memory of 1084 2844 ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe 91 PID 2844 wrote to memory of 1084 2844 ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe 91 PID 2844 wrote to memory of 1084 2844 ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe 91 PID 2844 wrote to memory of 1084 2844 ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe 91 PID 2844 wrote to memory of 1084 2844 ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe 91 PID 2844 wrote to memory of 1084 2844 ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe 91 PID 2844 wrote to memory of 1084 2844 ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ebc74288f42a0c390a0eddd12807a9d2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\clip.exe"C:\Windows\system32\clip.exe"2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:81⤵PID:3984