Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 05:46

General

  • Target

    2bee9df1419903f140ff65c7703c874e_JaffaCakes118.exe

  • Size

    838KB

  • MD5

    2bee9df1419903f140ff65c7703c874e

  • SHA1

    bfacd5769eeadd2e23338f0940ac90e4bc9aec7c

  • SHA256

    f55becb79884a973b1119216aeb951fb088cc8abf41a8e31550eccbde3ba78d3

  • SHA512

    67421befb7337b6959b58e4f6dd906e32330d03b361645e365fc8c52dfd282af353e43fb0152285d462356a352232aec5d454826fe6745341b3d62fab1fa7694

  • SSDEEP

    24576:hnJi0+xxQCj7Kc2ckATjAC+HpFkSJVv1t/2JrbEO0L4lnfjZmR:FJi0+xxQCfHhkATjAC+HpFkSJVv1ZE/8

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Disables RegEdit via registry modification 2 IoCs
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:336
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:384
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:476
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:616
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    4⤵
                      PID:1764
                    • C:\Windows\system32\wbem\wmiprvse.exe
                      C:\Windows\system32\wbem\wmiprvse.exe
                      4⤵
                        PID:1828
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k RPCSS
                      3⤵
                        PID:696
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                        3⤵
                          PID:768
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                          3⤵
                            PID:832
                            • C:\Windows\system32\Dwm.exe
                              "C:\Windows\system32\Dwm.exe"
                              4⤵
                                PID:1180
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs
                              3⤵
                                PID:868
                                • C:\Windows\system32\wbem\WMIADAP.EXE
                                  wmiadap.exe /F /T /R
                                  4⤵
                                    PID:1820
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService
                                  3⤵
                                    PID:980
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k NetworkService
                                    3⤵
                                      PID:292
                                    • C:\Windows\System32\spoolsv.exe
                                      C:\Windows\System32\spoolsv.exe
                                      3⤵
                                        PID:1012
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                        3⤵
                                          PID:1080
                                        • C:\Windows\system32\taskhost.exe
                                          "taskhost.exe"
                                          3⤵
                                            PID:1128
                                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                            3⤵
                                              PID:1064
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                              3⤵
                                                PID:1724
                                              • C:\Windows\system32\sppsvc.exe
                                                C:\Windows\system32\sppsvc.exe
                                                3⤵
                                                  PID:2300
                                              • C:\Windows\system32\lsass.exe
                                                C:\Windows\system32\lsass.exe
                                                2⤵
                                                  PID:492
                                                • C:\Windows\system32\lsm.exe
                                                  C:\Windows\system32\lsm.exe
                                                  2⤵
                                                    PID:500
                                                • C:\Windows\system32\csrss.exe
                                                  %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                  1⤵
                                                    PID:392
                                                  • C:\Windows\system32\winlogon.exe
                                                    winlogon.exe
                                                    1⤵
                                                      PID:432
                                                    • C:\Windows\Explorer.EXE
                                                      C:\Windows\Explorer.EXE
                                                      1⤵
                                                        PID:1216
                                                        • C:\Users\Admin\AppData\Local\Temp\2bee9df1419903f140ff65c7703c874e_JaffaCakes118.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\2bee9df1419903f140ff65c7703c874e_JaffaCakes118.exe"
                                                          2⤵
                                                          • Disables RegEdit via registry modification
                                                          • Loads dropped DLL
                                                          • Drops file in System32 directory
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2092
                                                          • C:\Windows\SysWOW64\netsh.exe
                                                            "netsh.exe" firewall set opmode disable
                                                            3⤵
                                                            • Modifies Windows Firewall
                                                            • Event Triggered Execution: Netsh Helper DLL
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2564
                                                          • C:\lostsaga.exe
                                                            C:\lostsaga.exe
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2352
                                                            • C:\lostsagamgr.exe
                                                              C:\lostsagamgr.exe
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of UnmapMainImage
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2876
                                                              • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                                                "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of UnmapMainImage
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2664
                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                  C:\Windows\system32\svchost.exe
                                                                  6⤵
                                                                  • Modifies WinLogon for persistence
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Program Files directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1004
                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                  C:\Windows\system32\svchost.exe
                                                                  6⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1104
                                                          • C:\Users\Admin\AppData\Roaming\Application.exe
                                                            "C:\Users\Admin\AppData\Roaming\Application.exe"
                                                            3⤵
                                                            • Disables RegEdit via registry modification
                                                            • Drops file in Drivers directory
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2848

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

                                                        Filesize

                                                        197KB

                                                        MD5

                                                        1b9b236ddfa6c74c2a0ab5d10d8af6cf

                                                        SHA1

                                                        e857e3f606d8351012b6bbd42748d2c84534bd2b

                                                        SHA256

                                                        483ff58b58d4171f64eae71f985c86eecc2c52e254ec63ef9c206a5cf0878322

                                                        SHA512

                                                        643a3609dd5ff21d9f5a523484bb25b98de19f04adf790163b905b59f3c348efa85f3fee40941aa42d077b76e01fe2792e07e6383b2d7613e030807c9720debf

                                                      • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

                                                        Filesize

                                                        193KB

                                                        MD5

                                                        3762e519f151ad521c4750278c2579fb

                                                        SHA1

                                                        d87cf7234757260d669de1440dceecb3b627e1a2

                                                        SHA256

                                                        8f8edaaa912258408983286e9f465301e44c7c045009756f3efbff8711b244a5

                                                        SHA512

                                                        bf9f81eb33ac9da5054e3ca33ef874f3ef0870b24ce12825a6a8d4fc8f76cd6d087c115218b0f63a0fa696cc00d3008fbcc27dd1753f0585fdf456935481722d

                                                      • C:\Users\Admin\AppData\Roaming\Application.exe

                                                        Filesize

                                                        154KB

                                                        MD5

                                                        c2004abcda1a230cf75da74a8b56a276

                                                        SHA1

                                                        62f8de3e2f270ffe96518ccf0e5bfbb444733031

                                                        SHA256

                                                        e9945c6721d022e33508ad1326063bcdd12c67bc9d062db0f160ac058bc5e6cb

                                                        SHA512

                                                        db31f45e604dce12e4010879475bccc094e4b215d30e329f8f1460d724a37ec649319006b0aa70a8e05d6779f2b184fcd31750e5ca784829338b2609df81a7e8

                                                      • C:\lostsaga.exe

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        4428c969f83fe0fb6bb2a635fe605bce

                                                        SHA1

                                                        15efa531bc399c5e92d72cf266f8e18b4ec78bb0

                                                        SHA256

                                                        458b17876c0ea9ce182b9966f97d7617600ac6cb95c363cc7f33aec420424151

                                                        SHA512

                                                        4896c3e06391a7caca83ae36fd2a093af81ad6165979ed23232fb35a4d85a7188ecbbc66e720c4cd3d86e4c5546848ce7b02e5d8e28cd02ca0c246b091e9d809

                                                      • C:\lostsagamgr.exe

                                                        Filesize

                                                        92KB

                                                        MD5

                                                        e015c13f29b01ce78e2c066674362ee5

                                                        SHA1

                                                        37ad4196953a2741d1bd52aed19f82f9947f119d

                                                        SHA256

                                                        c062802dfa0fcd5fdba4feef534d80e8686a3a5de9fe441848d0a08433bf07d9

                                                        SHA512

                                                        c5da6b6424d713df43e5c6dad91d21a74db3a6c5adbbee48d6d9238cbf7d554ecbaf46a37aa9e38db583ede5c2c295c82e5703e17b35fc3a5c0dcf504544bc36

                                                      • memory/1004-81-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/1004-73-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/1004-85-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/1004-89-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/1004-71-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/1104-114-0x0000000020010000-0x000000002001B000-memory.dmp

                                                        Filesize

                                                        44KB

                                                      • memory/1104-111-0x0000000020010000-0x000000002001B000-memory.dmp

                                                        Filesize

                                                        44KB

                                                      • memory/1104-101-0x0000000020010000-0x000000002001B000-memory.dmp

                                                        Filesize

                                                        44KB

                                                      • memory/2092-2-0x00000000740D0000-0x000000007467B000-memory.dmp

                                                        Filesize

                                                        5.7MB

                                                      • memory/2092-1-0x00000000740D0000-0x000000007467B000-memory.dmp

                                                        Filesize

                                                        5.7MB

                                                      • memory/2092-51-0x00000000740D0000-0x000000007467B000-memory.dmp

                                                        Filesize

                                                        5.7MB

                                                      • memory/2092-0-0x00000000740D1000-0x00000000740D2000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2352-15-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                        Filesize

                                                        820KB

                                                      • memory/2352-28-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                        Filesize

                                                        820KB

                                                      • memory/2352-10-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                        Filesize

                                                        820KB

                                                      • memory/2352-29-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                        Filesize

                                                        820KB

                                                      • memory/2352-69-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                        Filesize

                                                        820KB

                                                      • memory/2352-98-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                        Filesize

                                                        820KB

                                                      • memory/2352-12-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                        Filesize

                                                        820KB

                                                      • memory/2352-14-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                        Filesize

                                                        820KB

                                                      • memory/2352-40-0x0000000000160000-0x0000000000188000-memory.dmp

                                                        Filesize

                                                        160KB

                                                      • memory/2352-39-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                        Filesize

                                                        820KB

                                                      • memory/2352-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2352-18-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                        Filesize

                                                        820KB

                                                      • memory/2352-21-0x0000000000400000-0x00000000004CD000-memory.dmp

                                                        Filesize

                                                        820KB

                                                      • memory/2664-60-0x0000000000400000-0x0000000000428000-memory.dmp

                                                        Filesize

                                                        160KB

                                                      • memory/2664-70-0x0000000020010000-0x0000000020022000-memory.dmp

                                                        Filesize

                                                        72KB

                                                      • memory/2664-685-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                      • memory/2664-67-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2664-99-0x0000000000060000-0x0000000000061000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2664-68-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                      • memory/2876-42-0x0000000000400000-0x0000000000428000-memory.dmp

                                                        Filesize

                                                        160KB

                                                      • memory/2876-33-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                      • memory/2876-32-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                      • memory/2876-46-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                      • memory/2876-45-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                      • memory/2876-43-0x0000000000140000-0x0000000000141000-memory.dmp

                                                        Filesize

                                                        4KB

                                                      • memory/2876-34-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                      • memory/2876-49-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB

                                                      • memory/2876-31-0x0000000000400000-0x0000000000421000-memory.dmp

                                                        Filesize

                                                        132KB