Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17/10/2024, 13:41
Static task
static1
Behavioral task
behavioral1
Sample
523ff3878d408b79bf93683ab78a30ed_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
523ff3878d408b79bf93683ab78a30ed_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ramsetup195.exe
Resource
win7-20241010-en
General
-
Target
$PLUGINSDIR/ramsetup195.exe
-
Size
1.4MB
-
MD5
ff08538cb3d45e33cd82657e4c11d679
-
SHA1
3f82bf971e5e0d8b08323f6f44e62fad42dd7f38
-
SHA256
b200bbb9320a0bf96874a2890565b30e3158e42ee0f3e3ae0ec7b7ce41104329
-
SHA512
cccf86fc6b3d9775f6bd91aa641131623e41d0051be03a7c54d61fb9456d7fb5eb8d0b13ff62ae9cd8260ac767843f8fc9e7da470cc242ce6ccf40bd2a397ca4
-
SSDEEP
24576:esSzlEqF+hVcO3BhSb8vVFwtLKeukot7slmtVQ0b4iDAWzCLietd:wl8eO3BhS8vwhKBkodNtnl2v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2432 irsetup.exe -
Loads dropped DLL 4 IoCs
pid Process 2220 ramsetup195.exe 2432 irsetup.exe 2432 irsetup.exe 2432 irsetup.exe -
resource yara_rule behavioral3/files/0x00060000000186bb-1.dat upx behavioral3/memory/2220-4-0x0000000002320000-0x0000000002447000-memory.dmp upx behavioral3/memory/2432-25-0x0000000000400000-0x0000000000527000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ÄÚ´æɨ°Ñ Setup Log.txt irsetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ramsetup195.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language irsetup.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2432 irsetup.exe 2432 irsetup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2432 2220 ramsetup195.exe 29 PID 2220 wrote to memory of 2432 2220 ramsetup195.exe 29 PID 2220 wrote to memory of 2432 2220 ramsetup195.exe 29 PID 2220 wrote to memory of 2432 2220 ramsetup195.exe 29 PID 2220 wrote to memory of 2432 2220 ramsetup195.exe 29 PID 2220 wrote to memory of 2432 2220 ramsetup195.exe 29 PID 2220 wrote to memory of 2432 2220 ramsetup195.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ramsetup195.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ramsetup195.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe__IRAOFF:520716 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ramsetup195.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
440KB
MD575ca7ff96bf5a316c3af2de6a412bd54
SHA10a093950790ff0dddff6f5f29c6b02c10997e0c5
SHA256d95b5bf9ca97c1900de5357743282bab655d61d616606485088e1708559b7cf1
SHA512b8da86f2f1e908955254e5168d0447f479cec7815a8b081a7b38eb87187cb2eb992109c67e006361b96bc1529ee8abc9dc477d78e9ca565e43f5415b492771d4