Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2025, 22:25

General

  • Target

    JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe

  • Size

    95KB

  • MD5

    19c8b353cf7afa719c6ce799c0796923

  • SHA1

    d485bf1c0a5b86e8aa1c6375e2e6d5ad3d8439a9

  • SHA256

    2d15161f3fa63e0d2267e59adcc6b9f4c9a6a0e154174d5231f272c4d40eb278

  • SHA512

    c17916bf3e134598d748e4994b663576f28380aad03eb4e0a645b79be80c2558148d06b7f32502151d612d4ee8cee7ca2404a1b7d75e7e0ef47121d387921b7f

  • SSDEEP

    768:j06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:hR0vxn3Pc0LCH9MtbvabUDzJYWu3B

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:464
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:4908
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 204
            4⤵
            • Program crash
            PID:4940
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1288
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:17410 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1072
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies Internet Explorer settings
          PID:3212
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4908 -ip 4908
      1⤵
        PID:4904

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\WaterMark.exe

        Filesize

        95KB

        MD5

        19c8b353cf7afa719c6ce799c0796923

        SHA1

        d485bf1c0a5b86e8aa1c6375e2e6d5ad3d8439a9

        SHA256

        2d15161f3fa63e0d2267e59adcc6b9f4c9a6a0e154174d5231f272c4d40eb278

        SHA512

        c17916bf3e134598d748e4994b663576f28380aad03eb4e0a645b79be80c2558148d06b7f32502151d612d4ee8cee7ca2404a1b7d75e7e0ef47121d387921b7f

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        471B

        MD5

        975df3dbca02c4223ad98b4405ec0cd8

        SHA1

        62c3b5b2d32df9cedede3d746956a999d34beff1

        SHA256

        87d1e303201f45a5b0080b4580575bb564446751cafe9da1e8ce11a9c6a842fd

        SHA512

        1277f93b24c89c39cee767c05e3e450da71aa5bade2fcc2559ef39c3b747c3db491488e63e8d21911e668885308d717fb7d47e2b3a70ff24b0a7250b5f671417

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        404B

        MD5

        fcb6ae482bb5bef676a9ebc06e6b4fb4

        SHA1

        b082effa3f447f81cfb784b395051e9f4271cbde

        SHA256

        6b35152ea75b96cbcfb1568adcf68548d86b2b51409ec5ce61211ba42d502c32

        SHA512

        1f6a3fe1fa0dd8b9d25935fb4f508bd941a4e601d8f290b5c106bd9048ca6defe9f23ace4617fd9c6a82d7514f2fc269736447cc2209dfd76046fc7fdd32683c

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FQRZN8O7\suggestions[1].en-US

        Filesize

        17KB

        MD5

        5a34cb996293fde2cb7a4ac89587393a

        SHA1

        3c96c993500690d1a77873cd62bc639b3a10653f

        SHA256

        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

        SHA512

        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      • memory/464-31-0x00000000777C2000-0x00000000777C3000-memory.dmp

        Filesize

        4KB

      • memory/464-32-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/464-34-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/464-30-0x0000000000070000-0x0000000000071000-memory.dmp

        Filesize

        4KB

      • memory/464-25-0x0000000000060000-0x0000000000061000-memory.dmp

        Filesize

        4KB

      • memory/464-26-0x00000000777C2000-0x00000000777C3000-memory.dmp

        Filesize

        4KB

      • memory/464-24-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/464-23-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3668-9-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3668-2-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3668-3-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3668-10-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3668-0-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

      • memory/3668-4-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3668-8-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3668-7-0x00000000001F0000-0x00000000001F1000-memory.dmp

        Filesize

        4KB

      • memory/3668-6-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3668-1-0x0000000000401000-0x0000000000402000-memory.dmp

        Filesize

        4KB

      • memory/4908-28-0x00000000002C0000-0x00000000002C1000-memory.dmp

        Filesize

        4KB

      • memory/4908-29-0x00000000002A0000-0x00000000002A1000-memory.dmp

        Filesize

        4KB