Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2025, 14:25 UTC

General

  • Target

    JaffaCakes118_3ecbf128cf4880643399faeb0e1481aa.exe

  • Size

    95KB

  • MD5

    3ecbf128cf4880643399faeb0e1481aa

  • SHA1

    087d74de76b891722b69ea4888d50ca0f35164f7

  • SHA256

    149a0cf3e399ab0a0cd2dacb83ea607a10878c91f995125eaec31a9d83a01ce1

  • SHA512

    ef5a44db5d6dc12504ccf114e8f2c099f3e50d736e3ae0eecf759c620eaf965b13b0615230ce9499ae54ee9f84ee4d64f6e73a8a006a4963b13e34c353201664

  • SSDEEP

    768:UM06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYwK:DR0vxn3Pc0LCH9MtbvabUDzJYWu3B

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:332
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:380
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:472
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:592
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    4⤵
                      PID:1048
                    • C:\Windows\system32\wbem\wmiprvse.exe
                      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                      4⤵
                        PID:2300
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k RPCSS
                      3⤵
                        PID:668
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                        3⤵
                          PID:732
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                          3⤵
                            PID:804
                            • C:\Windows\system32\Dwm.exe
                              "C:\Windows\system32\Dwm.exe"
                              4⤵
                                PID:1160
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs
                              3⤵
                                PID:844
                                • C:\Windows\system32\wbem\WMIADAP.EXE
                                  wmiadap.exe /F /T /R
                                  4⤵
                                    PID:288
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService
                                  3⤵
                                    PID:960
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k NetworkService
                                    3⤵
                                      PID:236
                                    • C:\Windows\System32\spoolsv.exe
                                      C:\Windows\System32\spoolsv.exe
                                      3⤵
                                        PID:344
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                        3⤵
                                          PID:1068
                                        • C:\Windows\system32\taskhost.exe
                                          "taskhost.exe"
                                          3⤵
                                            PID:1116
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                            3⤵
                                              PID:2076
                                            • C:\Windows\system32\sppsvc.exe
                                              C:\Windows\system32\sppsvc.exe
                                              3⤵
                                                PID:1840
                                            • C:\Windows\system32\lsass.exe
                                              C:\Windows\system32\lsass.exe
                                              2⤵
                                                PID:488
                                              • C:\Windows\system32\lsm.exe
                                                C:\Windows\system32\lsm.exe
                                                2⤵
                                                  PID:496
                                              • C:\Windows\system32\csrss.exe
                                                %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                1⤵
                                                  PID:388
                                                • C:\Windows\system32\winlogon.exe
                                                  winlogon.exe
                                                  1⤵
                                                    PID:428
                                                  • C:\Windows\Explorer.EXE
                                                    C:\Windows\Explorer.EXE
                                                    1⤵
                                                      PID:1196
                                                      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ecbf128cf4880643399faeb0e1481aa.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3ecbf128cf4880643399faeb0e1481aa.exe"
                                                        2⤵
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of UnmapMainImage
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2908
                                                        • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                                          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of UnmapMainImage
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2228
                                                          • C:\Windows\SysWOW64\svchost.exe
                                                            C:\Windows\system32\svchost.exe
                                                            4⤵
                                                            • Modifies WinLogon for persistence
                                                            • Drops file in System32 directory
                                                            • Drops file in Program Files directory
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2388
                                                          • C:\Windows\SysWOW64\svchost.exe
                                                            C:\Windows\system32\svchost.exe
                                                            4⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2588

                                                    Network

                                                    • flag-us
                                                      DNS
                                                      google.com
                                                      svchost.exe
                                                      Remote address:
                                                      8.8.8.8:53
                                                      Request
                                                      google.com
                                                      IN A
                                                      Response
                                                      google.com
                                                      IN A
                                                      142.250.180.14
                                                    • flag-us
                                                      DNS
                                                      rterybrstutnrsbberve.com
                                                      svchost.exe
                                                      Remote address:
                                                      8.8.8.8:53
                                                      Request
                                                      rterybrstutnrsbberve.com
                                                      IN A
                                                      Response
                                                      rterybrstutnrsbberve.com
                                                      IN A
                                                      34.253.216.9
                                                    • flag-us
                                                      DNS
                                                      erwbtkidthetcwerc.com
                                                      svchost.exe
                                                      Remote address:
                                                      8.8.8.8:53
                                                      Request
                                                      erwbtkidthetcwerc.com
                                                      IN A
                                                      Response
                                                      erwbtkidthetcwerc.com
                                                      IN A
                                                      34.253.216.9
                                                    • flag-us
                                                      DNS
                                                      rvbwtbeitwjeitv.com
                                                      svchost.exe
                                                      Remote address:
                                                      8.8.8.8:53
                                                      Request
                                                      rvbwtbeitwjeitv.com
                                                      IN A
                                                      Response
                                                      rvbwtbeitwjeitv.com
                                                      IN A
                                                      204.95.99.221
                                                    • 91.220.62.30:443
                                                      svchost.exe
                                                      152 B
                                                      3
                                                    • 142.250.180.14:80
                                                      google.com
                                                      svchost.exe
                                                      98 B
                                                      52 B
                                                      2
                                                      1
                                                    • 91.220.62.30:443
                                                      svchost.exe
                                                      152 B
                                                      3
                                                    • 34.253.216.9:443
                                                      rterybrstutnrsbberve.com
                                                      https
                                                      svchost.exe
                                                      190 B
                                                      216 B
                                                      4
                                                      5
                                                    • 34.253.216.9:443
                                                      rterybrstutnrsbberve.com
                                                      https
                                                      svchost.exe
                                                      268 B
                                                      216 B
                                                      4
                                                      5
                                                    • 34.253.216.9:443
                                                      erwbtkidthetcwerc.com
                                                      https
                                                      svchost.exe
                                                      282 B
                                                      296 B
                                                      6
                                                      7
                                                    • 34.253.216.9:443
                                                      erwbtkidthetcwerc.com
                                                      https
                                                      svchost.exe
                                                      360 B
                                                      296 B
                                                      6
                                                      7
                                                    • 204.95.99.221:443
                                                      rvbwtbeitwjeitv.com
                                                      https
                                                      svchost.exe
                                                      558 B
                                                      132 B
                                                      12
                                                      3
                                                    • 204.95.99.221:443
                                                      rvbwtbeitwjeitv.com
                                                      https
                                                      svchost.exe
                                                      1.3kB
                                                      132 B
                                                      14
                                                      3
                                                    • 142.250.180.14:80
                                                      google.com
                                                      svchost.exe
                                                      98 B
                                                      52 B
                                                      2
                                                      1
                                                    • 142.250.180.14:80
                                                      google.com
                                                      svchost.exe
                                                      98 B
                                                      52 B
                                                      2
                                                      1
                                                    • 8.8.8.8:53
                                                      google.com
                                                      dns
                                                      svchost.exe
                                                      56 B
                                                      72 B
                                                      1
                                                      1

                                                      DNS Request

                                                      google.com

                                                      DNS Response

                                                      142.250.180.14

                                                    • 8.8.8.8:53
                                                      rterybrstutnrsbberve.com
                                                      dns
                                                      svchost.exe
                                                      70 B
                                                      86 B
                                                      1
                                                      1

                                                      DNS Request

                                                      rterybrstutnrsbberve.com

                                                      DNS Response

                                                      34.253.216.9

                                                    • 8.8.8.8:53
                                                      erwbtkidthetcwerc.com
                                                      dns
                                                      svchost.exe
                                                      67 B
                                                      83 B
                                                      1
                                                      1

                                                      DNS Request

                                                      erwbtkidthetcwerc.com

                                                      DNS Response

                                                      34.253.216.9

                                                    • 8.8.8.8:53
                                                      rvbwtbeitwjeitv.com
                                                      dns
                                                      svchost.exe
                                                      65 B
                                                      81 B
                                                      1
                                                      1

                                                      DNS Request

                                                      rvbwtbeitwjeitv.com

                                                      DNS Response

                                                      204.95.99.221

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

                                                      Filesize

                                                      204KB

                                                      MD5

                                                      613718eede0849ce8c0f0f43ce5af921

                                                      SHA1

                                                      4dfd865e6c035e738d02f365bd7acd75ad385837

                                                      SHA256

                                                      cc97f1d9c237624b525a2be370decfcd3532067b94272d24dafe2f6d9078b7a7

                                                      SHA512

                                                      351ffdeac806b40826b99bc6bf774c5d019a271acee1fbdb893b3f887f75d4d4b47119a98acc62b922b72e497691d289fc271940d1e6327c4caa05f9a99b1bfe

                                                    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

                                                      Filesize

                                                      200KB

                                                      MD5

                                                      dfc4454e53461127f0ee2967989c5739

                                                      SHA1

                                                      3adeb9f45d3273d58df50976735b4aa827c5ebf0

                                                      SHA256

                                                      614945997552d91166923be18ded1385e1b23e33d34bff9c50aeca8e15051169

                                                      SHA512

                                                      f715d6294c678d56500caa17ee4458fbf9b42c2fcaeff40dc4eec55b5e959ee0878bea4f0705b75f35620cf614f453edd9c3a0c2d8bd43ee053bff8e71aa6f29

                                                    • \Program Files (x86)\Microsoft\WaterMark.exe

                                                      Filesize

                                                      95KB

                                                      MD5

                                                      3ecbf128cf4880643399faeb0e1481aa

                                                      SHA1

                                                      087d74de76b891722b69ea4888d50ca0f35164f7

                                                      SHA256

                                                      149a0cf3e399ab0a0cd2dacb83ea607a10878c91f995125eaec31a9d83a01ce1

                                                      SHA512

                                                      ef5a44db5d6dc12504ccf114e8f2c099f3e50d736e3ae0eecf759c620eaf965b13b0615230ce9499ae54ee9f84ee4d64f6e73a8a006a4963b13e34c353201664

                                                    • memory/2228-26-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2228-551-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2228-315-0x000000007740F000-0x0000000077410000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2228-75-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2228-58-0x0000000000100000-0x0000000000101000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2228-27-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2228-29-0x000000007740F000-0x0000000077410000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2228-28-0x00000000000F0000-0x00000000000F1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2388-46-0x0000000020010000-0x0000000020022000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2388-53-0x0000000000090000-0x0000000000091000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2388-318-0x0000000020010000-0x0000000020022000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2388-33-0x0000000000090000-0x0000000000091000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2388-31-0x0000000020010000-0x0000000020022000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2388-50-0x0000000020010000-0x0000000020022000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2388-41-0x0000000020010000-0x0000000020022000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2388-52-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2388-54-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2588-76-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2588-77-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2588-80-0x0000000000200000-0x0000000000201000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2588-81-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2588-60-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2588-70-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2588-74-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2588-79-0x0000000077410000-0x0000000077411000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2588-78-0x0000000020010000-0x000000002001B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2908-0-0x0000000000400000-0x0000000000455000-memory.dmp

                                                      Filesize

                                                      340KB

                                                    • memory/2908-1-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2908-5-0x0000000000140000-0x0000000000141000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/2908-4-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2908-3-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2908-6-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2908-2-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2908-9-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2908-8-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    • memory/2908-7-0x0000000000400000-0x0000000000421000-memory.dmp

                                                      Filesize

                                                      132KB

                                                    We care about your privacy.

                                                    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.