Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2024, 03:01

General

  • Target

    4c889bbb32888fac576629a454a7cd0b_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    4c889bbb32888fac576629a454a7cd0b

  • SHA1

    515cdd48ea8f4647b73bdcde29305d90eb754f32

  • SHA256

    442f209fb18d78eb30f5e3cdaf73a4a03edff0d8801f63432ff9ffe67f475a9e

  • SHA512

    d2c164e2c416083a9ffb882f3acdfea55f6f2f60f6a458bd457a4a747740fcbb8cb13c2cc293695b3044294afe1435f646c77f393ab351a2d741179f87047ef9

  • SSDEEP

    3072:FwYLn4919swCk4OR3I9UGVk8jwaaHw7Koj4rDMHRO:LLnQ19sWRG4Sc

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c889bbb32888fac576629a454a7cd0b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4c889bbb32888fac576629a454a7cd0b_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:2716
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 204
          3⤵
          • Program crash
          PID:1416
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4020
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4020 CREDAT:17410 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:3272
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4020 CREDAT:17416 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:3520
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:4324
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 204
            3⤵
            • Program crash
            PID:5032
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3488
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
            3⤵
            • Modifies Internet Explorer settings
            PID:3544
        • C:\Users\Admin\AppData\Local\Temp\ifsvbyamavckdycn.exe
          "C:\Users\Admin\AppData\Local\Temp\ifsvbyamavckdycn.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2716 -ip 2716
        1⤵
          PID:2064
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4324 -ip 4324
          1⤵
            PID:4476

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AF6HG05X\suggestions[1].en-US

            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          • C:\Users\Admin\AppData\Local\Temp\ifsvbyamavckdycn.exe

            Filesize

            100KB

            MD5

            4c889bbb32888fac576629a454a7cd0b

            SHA1

            515cdd48ea8f4647b73bdcde29305d90eb754f32

            SHA256

            442f209fb18d78eb30f5e3cdaf73a4a03edff0d8801f63432ff9ffe67f475a9e

            SHA512

            d2c164e2c416083a9ffb882f3acdfea55f6f2f60f6a458bd457a4a747740fcbb8cb13c2cc293695b3044294afe1435f646c77f393ab351a2d741179f87047ef9

          • memory/2716-9-0x0000000000230000-0x0000000000231000-memory.dmp

            Filesize

            4KB

          • memory/2716-8-0x0000000000250000-0x0000000000251000-memory.dmp

            Filesize

            4KB

          • memory/4284-16-0x0000000077902000-0x0000000077903000-memory.dmp

            Filesize

            4KB

          • memory/4284-15-0x0000000000400000-0x000000000043A5C8-memory.dmp

            Filesize

            233KB

          • memory/4284-5-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

            Filesize

            4KB

          • memory/4284-4-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

            Filesize

            4KB

          • memory/4284-10-0x0000000000400000-0x000000000043A5C8-memory.dmp

            Filesize

            233KB

          • memory/4284-11-0x0000000000432000-0x000000000043B000-memory.dmp

            Filesize

            36KB

          • memory/4284-0-0x0000000000400000-0x000000000043A5C8-memory.dmp

            Filesize

            233KB

          • memory/4284-6-0x0000000000400000-0x000000000043A5C8-memory.dmp

            Filesize

            233KB

          • memory/4284-18-0x0000000000400000-0x000000000043A5C8-memory.dmp

            Filesize

            233KB

          • memory/4284-19-0x0000000077902000-0x0000000077903000-memory.dmp

            Filesize

            4KB

          • memory/4284-2-0x0000000000400000-0x000000000043A5C8-memory.dmp

            Filesize

            233KB

          • memory/4284-1-0x0000000000432000-0x000000000043B000-memory.dmp

            Filesize

            36KB

          • memory/4400-38-0x0000000000400000-0x000000000043A5C8-memory.dmp

            Filesize

            233KB

          • memory/4400-37-0x0000000000400000-0x000000000043A5C8-memory.dmp

            Filesize

            233KB

          • memory/4400-42-0x0000000000400000-0x000000000043A5C8-memory.dmp

            Filesize

            233KB

          • memory/4400-36-0x0000000000438000-0x0000000000439000-memory.dmp

            Filesize

            4KB