Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2024, 04:16

General

  • Target

    dcf76fc3f75366e7fad541bd4d07b119_JaffaCakes118.dll

  • Size

    208KB

  • MD5

    dcf76fc3f75366e7fad541bd4d07b119

  • SHA1

    5f770d6c7c91e992a8bfd282ce2888832e9fa4a8

  • SHA256

    b38ba1183a45a0b5a73bfda0a24f9cec39ee7d3e00e83c5d7eaa0c2c9554689a

  • SHA512

    d509968288eeb39e6d07166d7b6d7d8ec420124d9863ad79a5d22253ab4f68e892545944135fd9fa18ab7ec87a6a5004089fb4d015fc7417fd227e94155cf0d8

  • SSDEEP

    3072:TvXmimD0k0QRW1PhI1sItKOgGdX3DUPSTM9Vu8rlJbGzwiOD9wy9Lrwa:T+fD/0QSzItKOgGFYa49VuAlJbGs+wL5

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\dcf76fc3f75366e7fad541bd4d07b119_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\dcf76fc3f75366e7fad541bd4d07b119_JaffaCakes118.dll,#1
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3484
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:4204
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:3152
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:3604
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 204
                6⤵
                • Program crash
                PID:736
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4312
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4312 CREDAT:17410 /prefetch:2
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:3320
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1124
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:17410 /prefetch:2
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3604 -ip 3604
      1⤵
        PID:1980

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        471B

        MD5

        2d1847b341a938389fc5b14b0bcd9eb2

        SHA1

        4036e71c4002e7ee173d59dc84a9cb5aa1390d34

        SHA256

        275c7427c6238d335e521a313e6cff2357b16e645202f11e3433cd56539ccc32

        SHA512

        384e910821ee8b786f70b5358f120cb3aea47f0e50d1f5c6e4c7304435c7d88f2c5ac9027c73823916149a369ac1c7640c18b13db8e6ee740c963e1b8bd51428

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        404B

        MD5

        32407b3cdcef9f229067cf46a3164a81

        SHA1

        301c9a3aeba4f40dfacaf2ab131bc9d22948998e

        SHA256

        3098e2b7c32737cb8e809425f75dd2b46f1054b538a4ff75d7943994b0deb219

        SHA512

        4a4d85665bc8e109613b4debef63268e94d9455c6ca0f49f0ffdf7c80841fd74f8198711cda2d23f2d0bc27f072f6bb957edf9b599f6b3e329ee5b0e50aa00b5

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        404B

        MD5

        2238fa4b96c6cefd094389f93f579b54

        SHA1

        5060673cc9a32a2fe286e8426f390174f5ac21cc

        SHA256

        76c0f55939dc851309c600bb8c66979183d27dafae4be8d0a5e378f51f9b8daa

        SHA512

        0b626434deb9bdc04923c52c2605bade8bff5218502a2a8886dc1a9f823ddc3288d442c825160fe23c7b433011c262bf914e00edec7db27eacbc7a68605d2ed3

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{83A14618-B6AD-11EF-B9D5-5EA348B38F9D}.dat

        Filesize

        3KB

        MD5

        128a1ec07b93b1f06f08475ab3261ebf

        SHA1

        f49b7dcd12f5a7d01299053ebffe4aae00ce4d10

        SHA256

        fd0c62497976e8135161a0c12d7bd484181745ad69e8d5713a0948507c786ebf

        SHA512

        dffb864b099c3e102369cbae251cb8df008c0fe430b47b5dd30241a5c7f4ae0863f1eaf369b3ff8c0a2c28f0f6541a060e4cc03c6b145619610711d40ba72e7c

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{83A3A951-B6AD-11EF-B9D5-5EA348B38F9D}.dat

        Filesize

        5KB

        MD5

        a89665f8ffe257a5f87a4128e4126106

        SHA1

        33b1f14b20d4cd630498ff3f5da92ff1d742647b

        SHA256

        b9b4db42fa3b7989f17ff04aa581fcc781e8b1f888d91b6541d6bbca2634bbf6

        SHA512

        6a40ece29cefc8870b191142a65b1b4a739448efe113f98ba00734f1eaaa980923db798b99c0e39f878117d55e17124139b23fffaed45e89e2f3fb6b2d5e2e52

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver1F6A.tmp

        Filesize

        15KB

        MD5

        1a545d0052b581fbb2ab4c52133846bc

        SHA1

        62f3266a9b9925cd6d98658b92adec673cbe3dd3

        SHA256

        557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

        SHA512

        bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FQRZN8O7\suggestions[1].en-US

        Filesize

        17KB

        MD5

        5a34cb996293fde2cb7a4ac89587393a

        SHA1

        3c96c993500690d1a77873cd62bc639b3a10653f

        SHA256

        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

        SHA512

        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      • C:\Windows\SysWOW64\rundll32mgr.exe

        Filesize

        115KB

        MD5

        50a0e1f79e2c4a873576fde02f8bb90b

        SHA1

        11596d44af32a1ae6d74435b3c070b6a47e8ac78

        SHA256

        58134ebb29f8d9f7bc6cfb1319a1f50054e138ede45f111feb081ff15e11b655

        SHA512

        f7627b15264ef3122bbf1217f81ac1ca077a811225d8d1b850d78272ffd2ef5b828be6015866207952c76e81dbd21648e4998c5d3680b55ff1874b8acb70f3c3

      • memory/3152-26-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

      • memory/3152-45-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3152-39-0x0000000000070000-0x0000000000071000-memory.dmp

        Filesize

        4KB

      • memory/3152-36-0x00000000778E2000-0x00000000778E3000-memory.dmp

        Filesize

        4KB

      • memory/3152-35-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3152-33-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3152-31-0x00000000005C0000-0x00000000005C1000-memory.dmp

        Filesize

        4KB

      • memory/3152-40-0x00000000778E2000-0x00000000778E3000-memory.dmp

        Filesize

        4KB

      • memory/3152-25-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

      • memory/3152-42-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

      • memory/3152-43-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3484-0-0x0000000010000000-0x0000000010034000-memory.dmp

        Filesize

        208KB

      • memory/3604-37-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

        Filesize

        4KB

      • memory/3604-38-0x0000000000B90000-0x0000000000B91000-memory.dmp

        Filesize

        4KB

      • memory/4204-6-0x0000000000401000-0x0000000000404000-memory.dmp

        Filesize

        12KB

      • memory/4204-8-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4204-9-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4204-11-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4204-13-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4204-14-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4204-30-0x0000000000401000-0x0000000000404000-memory.dmp

        Filesize

        12KB

      • memory/4204-15-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4204-12-0x0000000002040000-0x0000000002041000-memory.dmp

        Filesize

        4KB

      • memory/4204-10-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4204-7-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

      • memory/4204-4-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB