Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/01/2025, 00:26

General

  • Target

    JaffaCakes118_618b202cab71cf24b730c76c90d5a4b1.exe

  • Size

    65KB

  • MD5

    618b202cab71cf24b730c76c90d5a4b1

  • SHA1

    2ea352456fb807e31ce4195bdc72fb2c59392bff

  • SHA256

    07878acff54ac0dce8b62a25774290bc6d190695cf4326db4e475bee84ab20cd

  • SHA512

    e215bf5efd8410f417d096836dbc611fd7bd19e73cf4fa86f4ca5340eb11282e9eecf4b6b715d1405eff82cdcf4d71e26cacb3de68f066634e054c41e4fbb362

  • SSDEEP

    1536:SVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApE:CnxwgxgfR/DVG7wBpE

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_618b202cab71cf24b730c76c90d5a4b1.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_618b202cab71cf24b730c76c90d5a4b1.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3188
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:4936
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 208
            4⤵
            • Program crash
            PID:4488
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2908
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:17410 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:224
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1280
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:17410 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4364
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4936 -ip 4936
      1⤵
        PID:4876

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\WaterMark.exe

        Filesize

        65KB

        MD5

        618b202cab71cf24b730c76c90d5a4b1

        SHA1

        2ea352456fb807e31ce4195bdc72fb2c59392bff

        SHA256

        07878acff54ac0dce8b62a25774290bc6d190695cf4326db4e475bee84ab20cd

        SHA512

        e215bf5efd8410f417d096836dbc611fd7bd19e73cf4fa86f4ca5340eb11282e9eecf4b6b715d1405eff82cdcf4d71e26cacb3de68f066634e054c41e4fbb362

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        471B

        MD5

        30f59b20e935520badc298242cb4cff1

        SHA1

        00622b2054eb148a8459c2ccd0b22606c2d5c7f6

        SHA256

        4a981d199e551f2b8c8fa22f0e3fbc264e876e5ed243d83331b2a6083a753e3c

        SHA512

        f22ca09eb3266cee3f363e4f3f955745382679d136d61e7c27f81081cd77efa5f82f82220526928f73049e692b7c060f64032dfae0f967c579c6e6acfd2e8d21

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        404B

        MD5

        f66890944ee09af3c88d8bb0cac652e5

        SHA1

        aa314838b9e0111ab378850007fdcb86dfae310b

        SHA256

        ba47d17716a1275aaa960a7cbf4165a139d5d05b17fb782d05ff00bee4170635

        SHA512

        eab44f1500444133c2963467824ff622c1b2095989af251a488887f9def9a6362d94db9dcbccb8d3b78fd57bef09426d8b832eb5f2e0e938a568c8ace608a515

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2C3976DF-C8A0-11EF-9361-5EA348B38F9D}.dat

        Filesize

        5KB

        MD5

        5069ba8316d6c2b373c779439401bde4

        SHA1

        564390de7f08531837204abb17270d36e0acbbf9

        SHA256

        cf843930c56e5d400a0fba82e7bc76cfe9de80f02302a45481c56d634229208d

        SHA512

        54ce58b132ee2f9e5e43718eb332b55844ed0a278cb24afa662fb4ca63e39932c99e3cf1afda65a6474f08e745bbaf6b783795a103c42780c67d33e4a0d0013e

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2C3BD9E8-C8A0-11EF-9361-5EA348B38F9D}.dat

        Filesize

        3KB

        MD5

        1d8fcb58b1b0319dc2c52b7d2b035e0e

        SHA1

        afe46e2b60e1b3243ca06ef862512baa8981cbd9

        SHA256

        6eab18ff5d7fba24c05e75cbfca0356ed81547a6b9ca0ec9a5fdb3a85df314cb

        SHA512

        db963cb686aae226eb2a9cc007bd19bda04cd4475cef3301d83921d48f80a844f2e7fe26f7c649fadef59bbd6a3e46a80eb6fe5fb40f46458b6b6ed8757a4bb5

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver3B6E.tmp

        Filesize

        15KB

        MD5

        1a545d0052b581fbb2ab4c52133846bc

        SHA1

        62f3266a9b9925cd6d98658b92adec673cbe3dd3

        SHA256

        557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

        SHA512

        bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BHOTC3C\suggestions[1].en-US

        Filesize

        17KB

        MD5

        5a34cb996293fde2cb7a4ac89587393a

        SHA1

        3c96c993500690d1a77873cd62bc639b3a10653f

        SHA256

        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

        SHA512

        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      • memory/2368-3-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2368-9-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2368-25-0x0000000000401000-0x0000000000404000-memory.dmp

        Filesize

        12KB

      • memory/2368-1-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2368-4-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2368-6-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2368-5-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2368-0-0x0000000000401000-0x0000000000404000-memory.dmp

        Filesize

        12KB

      • memory/2368-2-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2368-7-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2368-10-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3188-36-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3188-33-0x0000000077A02000-0x0000000077A03000-memory.dmp

        Filesize

        4KB

      • memory/3188-32-0x0000000000070000-0x0000000000071000-memory.dmp

        Filesize

        4KB

      • memory/3188-26-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3188-37-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3188-29-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3188-27-0x0000000077A02000-0x0000000077A03000-memory.dmp

        Filesize

        4KB

      • memory/3188-21-0x0000000000870000-0x0000000000871000-memory.dmp

        Filesize

        4KB

      • memory/3188-24-0x00000000008D0000-0x00000000008D1000-memory.dmp

        Filesize

        4KB

      • memory/4936-31-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

        Filesize

        4KB

      • memory/4936-30-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

        Filesize

        4KB