Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...ab.dll

windows7-x64

7

JaffaCakes...ab.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2025, 16:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_5cf81624d2492b71ae0f3d298eab1bab.dll

  • Size

    572KB

  • MD5

    5cf81624d2492b71ae0f3d298eab1bab

  • SHA1

    a0e9537f9bcd84515c26c796cb5f4230b93cc6b6

  • SHA256

    7e8108814cece759ca212c07585ac24abccacecf96c9527ab457b47642261099

  • SHA512

    fd9a71f09eea3ce1d810b50e637a2bf52b0bacfa0746bdc6437402e973583cb0a74d92e9efde8e10bf567c29fb06df834661819bb9f9d256db8245be0f7be3a2

  • SSDEEP

    12288:aehnaNPpSVZmNxRCwnwm3W3OHIIf5fIBlcjOQ/qqq9jW3+xkt:aeh0PpS6NxNnwYeOHXuBLQMVxkt

Score
10/10
ramnitsalitybackdoorbankerdiscoveryevasionpersistenceprivilege_escalationspywarestealertrojanupxworm

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Ramnit family
    ramnit
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 55 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5cf81624d2492b71ae0f3d298eab1bab.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5cf81624d2492b71ae0f3d298eab1bab.dll,#1
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5112
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Windows security modification
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1964
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall set opmode disable
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2028
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:1612
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:232
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3708
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3708 CREDAT:17410 /prefetch:2
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:716
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3592
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3592 CREDAT:17410 /prefetch:2
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2076
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 608
          3⤵
          • Program crash
          PID:1672
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5112 -ip 5112
      1⤵
        PID:520

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Impair Defenses

      4
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Disable or Modify Tools

      3
      T1562.001

      Modify Registry

      5
      T1112

      Credential Access

      Discovery

      System Information Discovery

      1
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        471B

        MD5

        30f59b20e935520badc298242cb4cff1

        SHA1

        00622b2054eb148a8459c2ccd0b22606c2d5c7f6

        SHA256

        4a981d199e551f2b8c8fa22f0e3fbc264e876e5ed243d83331b2a6083a753e3c

        SHA512

        f22ca09eb3266cee3f363e4f3f955745382679d136d61e7c27f81081cd77efa5f82f82220526928f73049e692b7c060f64032dfae0f967c579c6e6acfd2e8d21

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        404B

        MD5

        00f9f3cb27b78a352abe67dd1c95442a

        SHA1

        c69b78cdd6bf521f878af800c4069a6641c0816b

        SHA256

        8e68b740aeb590c9074e5eaca6a83488e12e11c269caef8f38930998d5956771

        SHA512

        2004e16bd9aee0361056ee9992ffd868565d68cca9a2943b6c978cf61ef32d1e99b0240b7bcf66963bd012c85da66c531422e8387797a206cdcef657b5f22aae

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0F163FFB-C861-11EF-AF2A-C67090DD1599}.dat
        Filesize

        5KB

        MD5

        eaad97570f0253a7c34e5f271988093f

        SHA1

        4e90502cd2670e99d0f88bf7dc40a00400ed43cd

        SHA256

        d12f919627d5966ea033f4977c8b5f29f0d587ef262378f0e6f92f6a5bc7d23b

        SHA512

        297c61db3f248879a5ffe7867b75c460c6db258149a79b71cd8d22c39d6b396f43a31c40956ca7a59611c060cfd1c37a9f8d80d2ca10a3aed9bb1400a19d3b40

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0F18A222-C861-11EF-AF2A-C67090DD1599}.dat
        Filesize

        3KB

        MD5

        4f1f7e611d386f3630c49e4d50e66d7a

        SHA1

        bc162e24e571749407ac28ad41e873fd4f80d1e3

        SHA256

        f43e53e00b43521042a6b812e6f73e70886407d4f4204e0e507bae9d8e627f08

        SHA512

        3c002374dc220a67f501df5b9a871b5f2c42e12d530eb2200ab57f4ec847d5d5f58503a57821ddca4cac1103b032b6b829748efa8a73a98aa9fef58a6ed067d2

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verE3A9.tmp
        Filesize

        15KB

        MD5

        1a545d0052b581fbb2ab4c52133846bc

        SHA1

        62f3266a9b9925cd6d98658b92adec673cbe3dd3

        SHA256

        557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

        SHA512

        bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\suggestions[1].en-US
        Filesize

        17KB

        MD5

        5a34cb996293fde2cb7a4ac89587393a

        SHA1

        3c96c993500690d1a77873cd62bc639b3a10653f

        SHA256

        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

        SHA512

        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        Download Submit

      • C:\Windows\SysWOW64\rundll32mgr.exe
        Filesize

        186KB

        MD5

        d1cf33b3fb134d96475c1e6d3df0f341

        SHA1

        26cb92871856fc3e903e432e638cd09f7d64fca5

        SHA256

        52515cc80821a94d293e12fa06b546b90e1c66dcfc7af74beacfb5e97ca2c6fa

        SHA512

        1df8810ab5948813eefef7264c8dfb7b40f8ddb6f7d21ce203c4afef8ef28748fc80d3dc1560c16a05fcae543b8cd1e7655cd6102286accc6865c47b69ad54a1

        Download Submit

      • memory/1612-40-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/1612-37-0x0000000000070000-0x0000000000071000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1612-39-0x0000000077282000-0x0000000077283000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1612-38-0x0000000000400000-0x000000000043A000-memory.dmp

        Filesize

        232KB

        Download

      • memory/1612-33-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/1612-23-0x0000000000400000-0x000000000043A000-memory.dmp

        Filesize

        232KB

        Download

      • memory/1612-31-0x0000000000430000-0x0000000000431000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1612-34-0x0000000077282000-0x0000000077283000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1964-9-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/1964-18-0x0000000002580000-0x00000000035B2000-memory.dmp

        Filesize

        16.2MB

        Download

      • memory/1964-7-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/1964-12-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/1964-8-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/1964-14-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/1964-15-0x0000000000B60000-0x0000000000B61000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1964-21-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/1964-10-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/1964-6-0x0000000002580000-0x00000000035B2000-memory.dmp

        Filesize

        16.2MB

        Download

      • memory/1964-5-0x0000000000400000-0x000000000043A000-memory.dmp

        Filesize

        232KB

        Download

      • memory/5112-36-0x0000000010000000-0x0000000010091000-memory.dmp

        Filesize

        580KB

        Download

      • memory/5112-1-0x0000000010000000-0x0000000010091000-memory.dmp

        Filesize

        580KB

        Download