Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/01/2025, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_61fe0a37b0de1bc3ce52aec777073cb9.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_61fe0a37b0de1bc3ce52aec777073cb9.dll
-
Size
103KB
-
MD5
61fe0a37b0de1bc3ce52aec777073cb9
-
SHA1
d06c021be37a026bf9b9270806353fe9a1cfb254
-
SHA256
a30632f77ef9942d20ca201115af2275e86e2cdc593f877b62c5b202ef44d4e7
-
SHA512
9c4368d0df25ac5b96d1900f7a67419805f0df7a14d0a53c4c7f73cdf367462a9fd42bcf0943bf5f712aa6475eded42e5f26578d5e03ba415073d8fbc7d4bf5e
-
SSDEEP
3072:RIVVK4jGRAMhi8lWODGuIkFRXMFn1hLjQW/:RIVVKefMhV0ODGuIKFMF1hLjQ
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\okicccmg\\wqaomfsw.exe" svchost.exe -
Ramnit family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ovxjohudxlqdcmah.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wqaomfsw.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wqaomfsw.exe svchost.exe -
Executes dropped EXE 3 IoCs
pid Process 2092 goMCn23 2624 ovxjohudxlqdcmah.exe 1132 ovxjohudxlqdcmah.exe -
Loads dropped DLL 6 IoCs
pid Process 2292 rundll32.exe 2292 rundll32.exe 2092 goMCn23 2092 goMCn23 872 cmd.exe 872 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\WqaOmfsw = "C:\\Users\\Admin\\AppData\\Local\\okicccmg\\wqaomfsw.exe" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ovxjohudxlqdcmah.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2084 2292 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ovxjohudxlqdcmah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language goMCn23 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeSecurityPrivilege 2092 goMCn23 Token: SeDebugPrivilege 2092 goMCn23 Token: SeSecurityPrivilege 2408 svchost.exe Token: SeSecurityPrivilege 2824 svchost.exe Token: SeDebugPrivilege 2824 svchost.exe Token: SeSecurityPrivilege 2624 ovxjohudxlqdcmah.exe Token: SeSecurityPrivilege 1132 ovxjohudxlqdcmah.exe Token: SeLoadDriverPrivilege 1132 ovxjohudxlqdcmah.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2292 1704 rundll32.exe 30 PID 1704 wrote to memory of 2292 1704 rundll32.exe 30 PID 1704 wrote to memory of 2292 1704 rundll32.exe 30 PID 1704 wrote to memory of 2292 1704 rundll32.exe 30 PID 1704 wrote to memory of 2292 1704 rundll32.exe 30 PID 1704 wrote to memory of 2292 1704 rundll32.exe 30 PID 1704 wrote to memory of 2292 1704 rundll32.exe 30 PID 2292 wrote to memory of 2092 2292 rundll32.exe 31 PID 2292 wrote to memory of 2092 2292 rundll32.exe 31 PID 2292 wrote to memory of 2092 2292 rundll32.exe 31 PID 2292 wrote to memory of 2092 2292 rundll32.exe 31 PID 2292 wrote to memory of 2084 2292 rundll32.exe 32 PID 2292 wrote to memory of 2084 2292 rundll32.exe 32 PID 2292 wrote to memory of 2084 2292 rundll32.exe 32 PID 2292 wrote to memory of 2084 2292 rundll32.exe 32 PID 2092 wrote to memory of 2408 2092 goMCn23 33 PID 2092 wrote to memory of 2408 2092 goMCn23 33 PID 2092 wrote to memory of 2408 2092 goMCn23 33 PID 2092 wrote to memory of 2408 2092 goMCn23 33 PID 2092 wrote to memory of 2408 2092 goMCn23 33 PID 2092 wrote to memory of 2408 2092 goMCn23 33 PID 2092 wrote to memory of 2408 2092 goMCn23 33 PID 2092 wrote to memory of 2408 2092 goMCn23 33 PID 2092 wrote to memory of 2408 2092 goMCn23 33 PID 2092 wrote to memory of 2408 2092 goMCn23 33 PID 2092 wrote to memory of 2824 2092 goMCn23 34 PID 2092 wrote to memory of 2824 2092 goMCn23 34 PID 2092 wrote to memory of 2824 2092 goMCn23 34 PID 2092 wrote to memory of 2824 2092 goMCn23 34 PID 2092 wrote to memory of 2824 2092 goMCn23 34 PID 2092 wrote to memory of 2824 2092 goMCn23 34 PID 2092 wrote to memory of 2824 2092 goMCn23 34 PID 2092 wrote to memory of 2824 2092 goMCn23 34 PID 2092 wrote to memory of 2824 2092 goMCn23 34 PID 2092 wrote to memory of 2824 2092 goMCn23 34 PID 2092 wrote to memory of 2624 2092 goMCn23 35 PID 2092 wrote to memory of 2624 2092 goMCn23 35 PID 2092 wrote to memory of 2624 2092 goMCn23 35 PID 2092 wrote to memory of 2624 2092 goMCn23 35 PID 2624 wrote to memory of 872 2624 ovxjohudxlqdcmah.exe 36 PID 2624 wrote to memory of 872 2624 ovxjohudxlqdcmah.exe 36 PID 2624 wrote to memory of 872 2624 ovxjohudxlqdcmah.exe 36 PID 2624 wrote to memory of 872 2624 ovxjohudxlqdcmah.exe 36 PID 872 wrote to memory of 1132 872 cmd.exe 38 PID 872 wrote to memory of 1132 872 cmd.exe 38 PID 872 wrote to memory of 1132 872 cmd.exe 38 PID 872 wrote to memory of 1132 872 cmd.exe 38 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ovxjohudxlqdcmah.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_61fe0a37b0de1bc3ce52aec777073cb9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_61fe0a37b0de1bc3ce52aec777073cb9.dll,#12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\goMCn23"goMCn23"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- UAC bypass
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Users\Admin\AppData\Local\Temp\ovxjohudxlqdcmah.exe"C:\Users\Admin\AppData\Local\Temp\ovxjohudxlqdcmah.exe" elevate4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\ovxjohudxlqdcmah.exe"" admin5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\ovxjohudxlqdcmah.exe"C:\Users\Admin\AppData\Local\Temp\ovxjohudxlqdcmah.exe" admin6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1132
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 2483⤵
- Program crash
PID:2084
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5e9639538d169c463914f6b2940eae754
SHA19d4fcf5d5cf2dcfb1ec07be9861b946f81f91647
SHA256d36631b46cdce695237f408057ca3463a2487a9a9a32887e8b5001ff50c0718d
SHA512b8b708a2ebcec4897ce27c97caf79105f0500937f0ec716f72aefa675968479645c0c5ddf8aa73ee7d12ff4ed565a53436902c7a1477c007bd2ce21a14d0fb21