Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
307a3273b99...18.exe
windows7-x64
707a3273b99...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...te.dll
windows7-x64
1$PLUGINSDI...te.dll
windows10-2004-x64
1EBcds.exe
windows7-x64
1EBcds.exe
windows10-2004-x64
1EBcdssvc.exe
windows7-x64
5EBcdssvc.exe
windows10-2004-x64
1uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 09:12
Static task
static1
Behavioral task
behavioral1
Sample
07a3273b9918b7ecbd2a22b3a8e61bc1_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
07a3273b9918b7ecbd2a22b3a8e61bc1_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/SelfDelete.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/SelfDelete.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
EBcds.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
EBcds.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
EBcdssvc.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral10
Sample
EBcdssvc.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
uninstall.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral12
Sample
uninstall.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
EBcdssvc.exe
-
Size
20KB
-
MD5
134454ccda9649c659682fa0b1d5d687
-
SHA1
1db5be866ccf1f677ae54196489e4abbbc1b1c29
-
SHA256
3c3d9f236f4b70f2bdc48a61953b5f72696628e86c3f53f8070df66e70d5e347
-
SHA512
77ada47a7bb607224db3ace6274b6e27a497389c8573046decad6409beba1392e53a95bf4971ee0c212611145ed48003de3f72d8534b9fa7f520ca0ebe56107c
-
SSDEEP
192:zN71oEkRd/1FB0dFjXqCZX19xK9C6a0BuCBWLSTU8Ru01oy7l:unFB0dFj6Cp1+s6xBW+Tz1b
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe 2996 EBcdssvc.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe Token: SeTcbPrivilege 2996 EBcdssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EBcdssvc.exe"C:\Users\Admin\AppData\Local\Temp\EBcdssvc.exe"1⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\EBcdssvc.exeC:\Users\Admin\AppData\Local\Temp\EBcdssvc.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4060,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:81⤵PID:1924