Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 08:06

General

  • Target

    899f7a7e45a4da66ddd2be41d57ff085_JaffaCakes118.dll

  • Size

    670KB

  • MD5

    899f7a7e45a4da66ddd2be41d57ff085

  • SHA1

    4409693bbe1a94c939589d0086552f7327755994

  • SHA256

    9567fe10e815c505de5d83bc33b02e8f28d7379caa6e5599f7acd8444d897d52

  • SHA512

    e3583b5742d833f31fd16669b7788c0476662f70996e23386364dd1ad4b79aa0d96c60e59d179150954f331872148ad7e892b3073e51ec7e6730f7749e372e30

  • SSDEEP

    12288:jbg04agUYlothAbgr1sya/vdnx1MHQbRLSnvB:jbnGshAUr1EHRmQbRLSvB

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wininit.exe
    wininit.exe
    1⤵
      PID:384
      • C:\Windows\system32\services.exe
        C:\Windows\system32\services.exe
        2⤵
          PID:476
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch
            3⤵
              PID:592
              • C:\Windows\system32\wbem\wmiprvse.exe
                C:\Windows\system32\wbem\wmiprvse.exe
                4⤵
                  PID:864
                • C:\Windows\system32\DllHost.exe
                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                  4⤵
                    PID:1744
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k RPCSS
                  3⤵
                    PID:668
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                    3⤵
                      PID:748
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                      3⤵
                        PID:812
                        • C:\Windows\system32\Dwm.exe
                          "C:\Windows\system32\Dwm.exe"
                          4⤵
                            PID:1180
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs
                          3⤵
                            PID:848
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService
                            3⤵
                              PID:968
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k NetworkService
                              3⤵
                                PID:108
                              • C:\Windows\System32\spoolsv.exe
                                C:\Windows\System32\spoolsv.exe
                                3⤵
                                  PID:348
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                  3⤵
                                    PID:1036
                                  • C:\Windows\system32\taskhost.exe
                                    "taskhost.exe"
                                    3⤵
                                      PID:1116
                                    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                      3⤵
                                        PID:1624
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                        3⤵
                                          PID:3024
                                        • C:\Windows\system32\sppsvc.exe
                                          C:\Windows\system32\sppsvc.exe
                                          3⤵
                                            PID:1996
                                        • C:\Windows\system32\lsass.exe
                                          C:\Windows\system32\lsass.exe
                                          2⤵
                                            PID:492
                                          • C:\Windows\system32\lsm.exe
                                            C:\Windows\system32\lsm.exe
                                            2⤵
                                              PID:500
                                          • C:\Windows\system32\csrss.exe
                                            %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                            1⤵
                                              PID:392
                                            • C:\Windows\system32\winlogon.exe
                                              winlogon.exe
                                              1⤵
                                                PID:432
                                              • C:\Windows\Explorer.EXE
                                                C:\Windows\Explorer.EXE
                                                1⤵
                                                  PID:1240
                                                  • C:\Windows\system32\rundll32.exe
                                                    rundll32.exe C:\Users\Admin\AppData\Local\Temp\899f7a7e45a4da66ddd2be41d57ff085_JaffaCakes118.dll,#1
                                                    2⤵
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1600
                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                      rundll32.exe C:\Users\Admin\AppData\Local\Temp\899f7a7e45a4da66ddd2be41d57ff085_JaffaCakes118.dll,#1
                                                      3⤵
                                                      • Loads dropped DLL
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2688
                                                      • C:\Windows\SysWOW64\rundll32mgr.exe
                                                        C:\Windows\SysWOW64\rundll32mgr.exe
                                                        4⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Drops file in System32 directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: MapViewOfSection
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of UnmapMainImage
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2156
                                                        • C:\Windows\SysWOW64\rundll32mgrmgr.exe
                                                          C:\Windows\SysWOW64\rundll32mgrmgr.exe
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of UnmapMainImage
                                                          PID:2940

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Windows\SysWOW64\rundll32mgr.exe

                                                  Filesize

                                                  288KB

                                                  MD5

                                                  5f8951eba93c310639727b49bc888558

                                                  SHA1

                                                  52a0e98ad6276293f9094cd0c7d2767ab25ace2e

                                                  SHA256

                                                  192b1e73eb1d9dde9751887445a5af57ec8b7a8e89a744053d9c42cd133cc63c

                                                  SHA512

                                                  69c443e095739209960dcfe54929962c10687028a3c2224afcb2eaaf9dc547af0ccd1c7a0c2df88ef2195b932aab771ae7b7e2901f24ffed8e7484d8d340c0f4

                                                • \Windows\SysWOW64\rundll32mgrmgr.exe

                                                  Filesize

                                                  143KB

                                                  MD5

                                                  357a495e970dc3466ff982f52ff8eb84

                                                  SHA1

                                                  2851fd90e8c194099e0ca8eeb6511b4273a7a821

                                                  SHA256

                                                  f4dea7059898534cb61e0d63217c50ef4eda751e153ba9d1faa5bacf4202e42f

                                                  SHA512

                                                  5a819cf9e917d865e8e3d7ffc90b709debb3134a1c253beb9e3f1627073c32141925008d6ab103f0577c1cc3cf731b27b0053d1d7a04bc9b52ef4d77e6ac2f18

                                                • memory/2156-30-0x0000000000400000-0x000000000041A000-memory.dmp

                                                  Filesize

                                                  104KB

                                                • memory/2156-23-0x0000000000320000-0x0000000000348000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/2156-29-0x0000000000400000-0x000000000041A000-memory.dmp

                                                  Filesize

                                                  104KB

                                                • memory/2156-13-0x0000000000400000-0x000000000044D000-memory.dmp

                                                  Filesize

                                                  308KB

                                                • memory/2156-22-0x0000000000320000-0x0000000000348000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/2156-25-0x0000000077E9F000-0x0000000077EA0000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2156-38-0x0000000000401000-0x0000000000410000-memory.dmp

                                                  Filesize

                                                  60KB

                                                • memory/2156-37-0x0000000000410000-0x0000000000419000-memory.dmp

                                                  Filesize

                                                  36KB

                                                • memory/2156-36-0x0000000000400000-0x000000000041A000-memory.dmp

                                                  Filesize

                                                  104KB

                                                • memory/2156-33-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2156-32-0x0000000000400000-0x000000000041A000-memory.dmp

                                                  Filesize

                                                  104KB

                                                • memory/2156-28-0x0000000000400000-0x000000000041A000-memory.dmp

                                                  Filesize

                                                  104KB

                                                • memory/2156-26-0x0000000077EA0000-0x0000000077EA1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2156-27-0x0000000000400000-0x000000000041A000-memory.dmp

                                                  Filesize

                                                  104KB

                                                • memory/2156-31-0x0000000000400000-0x000000000041A000-memory.dmp

                                                  Filesize

                                                  104KB

                                                • memory/2688-1-0x00000000753A0000-0x000000007544D000-memory.dmp

                                                  Filesize

                                                  692KB

                                                • memory/2688-3-0x00000000753A0000-0x000000007544D000-memory.dmp

                                                  Filesize

                                                  692KB

                                                • memory/2688-0-0x0000000075450000-0x00000000754FD000-memory.dmp

                                                  Filesize

                                                  692KB

                                                • memory/2688-12-0x00000000001F0000-0x000000000023D000-memory.dmp

                                                  Filesize

                                                  308KB

                                                • memory/2688-2-0x0000000075450000-0x00000000754FD000-memory.dmp

                                                  Filesize

                                                  692KB

                                                • memory/2688-52-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/2940-49-0x0000000000400000-0x000000000041A000-memory.dmp

                                                  Filesize

                                                  104KB

                                                • memory/2940-24-0x0000000000400000-0x0000000000428000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/2940-39-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/2940-51-0x0000000000401000-0x0000000000410000-memory.dmp

                                                  Filesize

                                                  60KB

                                                • memory/2940-50-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

                                                  Filesize

                                                  48KB

                                                • memory/2940-46-0x00000000003E0000-0x00000000003E1000-memory.dmp

                                                  Filesize

                                                  4KB