Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 07:01

General

  • Target

    eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe

  • Size

    100KB

  • MD5

    eacf4b7f8034890b3027188d63101a7a

  • SHA1

    a29065ba9cc060581120a9654a8a17cfea0af547

  • SHA256

    1496ef9cf3d0311bf111defeaabdec1006cca1177561715cd79ae2246e410d5e

  • SHA512

    a8e7565717e5b52d6d4594dbf1d29ac564af588a5dc3998cc4f89877226883b9833c765464dd9acd0f148c9847274b02ed37ee2d8844ac04dd64cc970c21b40e

  • SSDEEP

    3072:uWddijJxspyRcPXmdekp2GVk8jwaaHw7Koj4rDMxx:xddij7swMXqVuW

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eacf4b7f8034890b3027188d63101a7a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4332
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:1356
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 208
          3⤵
          • Program crash
          PID:1864
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4024
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:17410 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1044
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:17416 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:5080
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:844
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 208
            3⤵
            • Program crash
            PID:4836
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3780
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
            3⤵
            • Modifies Internet Explorer settings
            PID:4632
        • C:\Users\Admin\AppData\Local\Temp\davvddspadoxdkno.exe
          "C:\Users\Admin\AppData\Local\Temp\davvddspadoxdkno.exe"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1700
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1356 -ip 1356
        1⤵
          PID:1120
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 844 -ip 844
          1⤵
            PID:4104

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            471B

            MD5

            33bac9325241193616461afd5a0deb0c

            SHA1

            e78ed72996568bc9616f4d6b20403749252b4859

            SHA256

            cb0b78d15b774b91ab6f6ef315a14f301b85b40122a72622818753212538f5b7

            SHA512

            3054cbd1551e36a747fc4c7086d3cc484530ea13d44279b4f5f92d462d91d7e3322bb240edeedd517751c00949a6264b50322464e446290726fde18ac4eb2e2e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            404B

            MD5

            79caec5de366fdf3aef9579e1b39b143

            SHA1

            137fe71836733735f1b0c9072af80ecab1373833

            SHA256

            aa5d5391fcda147651838f2ceece71b0e3b9e6ff2d87d9a6faf0b61af1b955e0

            SHA512

            560e075db32b501eb8c844f85a072e003da787c3c70c988f7943984e0f2e87b028975646db1386ffe3b62efaf14b5bfe6533ed8193e38a78b53f6f6f89b04d39

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            404B

            MD5

            e6a637924858adbefaab7021293bca86

            SHA1

            58e10cfe611c229eb8c1c6bd51018be92c7395ce

            SHA256

            43c199a212d47fac285144ee588483436a438ac184dc484430a5cff478e2ebd8

            SHA512

            055abb3550a935db02bccd48afb4394a4bb2707ffc376cecd086c5d7b596b0c1e846f0ccbf4afc9d73134da43b0ec9f328aeb7b61d6b344f4d7177752997c07d

          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver6378.tmp

            Filesize

            15KB

            MD5

            1a545d0052b581fbb2ab4c52133846bc

            SHA1

            62f3266a9b9925cd6d98658b92adec673cbe3dd3

            SHA256

            557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

            SHA512

            bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BRZNMQLE\suggestions[1].en-US

            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          • C:\Users\Admin\AppData\Local\Temp\davvddspadoxdkno.exe

            Filesize

            100KB

            MD5

            eacf4b7f8034890b3027188d63101a7a

            SHA1

            a29065ba9cc060581120a9654a8a17cfea0af547

            SHA256

            1496ef9cf3d0311bf111defeaabdec1006cca1177561715cd79ae2246e410d5e

            SHA512

            a8e7565717e5b52d6d4594dbf1d29ac564af588a5dc3998cc4f89877226883b9833c765464dd9acd0f148c9847274b02ed37ee2d8844ac04dd64cc970c21b40e

          • memory/1356-8-0x00000000005B0000-0x00000000005B1000-memory.dmp

            Filesize

            4KB

          • memory/1356-9-0x0000000000590000-0x0000000000591000-memory.dmp

            Filesize

            4KB

          • memory/1700-52-0x0000000000400000-0x000000000043A6BC-memory.dmp

            Filesize

            233KB

          • memory/1700-53-0x0000000000400000-0x000000000043A6BC-memory.dmp

            Filesize

            233KB

          • memory/1700-50-0x0000000000438000-0x0000000000439000-memory.dmp

            Filesize

            4KB

          • memory/4332-0-0x0000000000400000-0x000000000043A6BC-memory.dmp

            Filesize

            233KB

          • memory/4332-7-0x0000000000400000-0x000000000043A6BC-memory.dmp

            Filesize

            233KB

          • memory/4332-19-0x0000000000400000-0x000000000043A6BC-memory.dmp

            Filesize

            233KB

          • memory/4332-20-0x00000000779E2000-0x00000000779E3000-memory.dmp

            Filesize

            4KB

          • memory/4332-13-0x0000000000400000-0x000000000043A6BC-memory.dmp

            Filesize

            233KB

          • memory/4332-4-0x0000000000B90000-0x0000000000B91000-memory.dmp

            Filesize

            4KB

          • memory/4332-5-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

            Filesize

            4KB

          • memory/4332-18-0x0000000000400000-0x000000000043A6BC-memory.dmp

            Filesize

            233KB

          • memory/4332-48-0x0000000000400000-0x000000000043B000-memory.dmp

            Filesize

            236KB

          • memory/4332-17-0x00000000779E2000-0x00000000779E3000-memory.dmp

            Filesize

            4KB

          • memory/4332-11-0x0000000000400000-0x000000000043A6BC-memory.dmp

            Filesize

            233KB

          • memory/4332-10-0x0000000000400000-0x000000000043B000-memory.dmp

            Filesize

            236KB

          • memory/4332-2-0x0000000000400000-0x000000000043A6BC-memory.dmp

            Filesize

            233KB

          • memory/4332-1-0x0000000000400000-0x000000000043B000-memory.dmp

            Filesize

            236KB