Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/01/2025, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe
-
Size
95KB
-
MD5
5b1a0c379ccc8cab0d06cbeb1338451b
-
SHA1
ae615e94824e0547027768d74d03af8b23fefd4d
-
SHA256
2dccbfc709478a47a8c039619c5aecc11731f3fe8e3a70c26b4e6f668f190d29
-
SHA512
a4433852b9c404df4b8e2d68cabe0df3ff02a2c9ebda7ecc468e73d1651119bd1dc878474f3c508b8d42b8bb78c1c08d1fe5c93175f8e2b15a9765019179c581
-
SSDEEP
1536:MHj0v8OJ4gwubDS+8MSn/Dk7cyzrdYptjL87LU/o19Em+0rAfuILFxNSF5E8k8jw:MHo5e5im+8MIDgcEQVMLqEcmk6FFk8jw
Malware Config
Signatures
-
Ramnit family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe -
Executes dropped EXE 1 IoCs
pid Process 3152 mmtvghymrjwfyxwa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3668 4660 WerFault.exe 83 3336 1808 WerFault.exe 104 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mmtvghymrjwfyxwa.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3811697428" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3813415941" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443720608" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0ECD1A13-D357-11EF-A7EA-CE95CE932DF6} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4010446880" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31156067" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31156067" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31156067" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe Token: SeDebugPrivilege 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe Token: SeSecurityPrivilege 3152 mmtvghymrjwfyxwa.exe Token: SeLoadDriverPrivilege 3152 mmtvghymrjwfyxwa.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4784 IEXPLORE.EXE 4784 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4784 IEXPLORE.EXE 4784 IEXPLORE.EXE 1076 IEXPLORE.EXE 1076 IEXPLORE.EXE 1076 IEXPLORE.EXE 1076 IEXPLORE.EXE 4784 IEXPLORE.EXE 4784 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 3020 wrote to memory of 4660 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 83 PID 3020 wrote to memory of 4660 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 83 PID 3020 wrote to memory of 4660 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 83 PID 3020 wrote to memory of 4660 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 83 PID 3020 wrote to memory of 4660 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 83 PID 3020 wrote to memory of 4660 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 83 PID 3020 wrote to memory of 4660 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 83 PID 3020 wrote to memory of 4660 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 83 PID 3020 wrote to memory of 4660 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 83 PID 3020 wrote to memory of 3200 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 96 PID 3020 wrote to memory of 3200 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 96 PID 3020 wrote to memory of 3200 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 96 PID 3200 wrote to memory of 4784 3200 iexplore.exe 97 PID 3200 wrote to memory of 4784 3200 iexplore.exe 97 PID 4784 wrote to memory of 1076 4784 IEXPLORE.EXE 99 PID 4784 wrote to memory of 1076 4784 IEXPLORE.EXE 99 PID 4784 wrote to memory of 1076 4784 IEXPLORE.EXE 99 PID 3020 wrote to memory of 1808 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 104 PID 3020 wrote to memory of 1808 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 104 PID 3020 wrote to memory of 1808 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 104 PID 3020 wrote to memory of 1808 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 104 PID 3020 wrote to memory of 1808 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 104 PID 3020 wrote to memory of 1808 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 104 PID 3020 wrote to memory of 1808 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 104 PID 3020 wrote to memory of 1808 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 104 PID 3020 wrote to memory of 1808 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 104 PID 3020 wrote to memory of 3564 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 109 PID 3020 wrote to memory of 3564 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 109 PID 3020 wrote to memory of 3564 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 109 PID 3564 wrote to memory of 3792 3564 iexplore.exe 110 PID 3564 wrote to memory of 3792 3564 iexplore.exe 110 PID 4784 wrote to memory of 2860 4784 IEXPLORE.EXE 111 PID 4784 wrote to memory of 2860 4784 IEXPLORE.EXE 111 PID 4784 wrote to memory of 2860 4784 IEXPLORE.EXE 111 PID 3020 wrote to memory of 3152 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 114 PID 3020 wrote to memory of 3152 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 114 PID 3020 wrote to memory of 3152 3020 JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b1a0c379ccc8cab0d06cbeb1338451b.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 2043⤵
- Program crash
PID:3668
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4784 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1076
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4784 CREDAT:17416 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2860
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:1808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 2083⤵
- Program crash
PID:3336
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
PID:3792
-
-
-
C:\Users\Admin\AppData\Local\Temp\mmtvghymrjwfyxwa.exe"C:\Users\Admin\AppData\Local\Temp\mmtvghymrjwfyxwa.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4660 -ip 46601⤵PID:744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1808 -ip 18081⤵PID:824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD59e22a9c34466faf7bc9cf642444b3f30
SHA10ac45262532cce40083cc9049fb12d4efb06c01f
SHA25657569469879a3144b391cf9def258ad9ef29d7fd1d3d70a28cfb506443d7a119
SHA512c60649fb0ecdd14c9a6d8f9ea7ac4356b24a5e1a238705bbc8294b72ea2fda21965af200746ae20dd5f45e386fc30e2189de6007e08ff3d7ec72b8dfc39435fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD59661bac155854c5535cc2a81b2d257a5
SHA1c9b867acd32182ccd0b38fcce48d368a81f35cef
SHA256c7d391c64d9a764edb69bbb24ec8795bab6157bfb34f24582b437e673fac23fd
SHA512c1c97c060a554c95090d9ee4cd4a53853de352368121cbfffeb94dff18096187925747e02515f5b61feee4576f7e1670bd0eb36a6680591bfc3bb840b8fe3841
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
95KB
MD55b1a0c379ccc8cab0d06cbeb1338451b
SHA1ae615e94824e0547027768d74d03af8b23fefd4d
SHA2562dccbfc709478a47a8c039619c5aecc11731f3fe8e3a70c26b4e6f668f190d29
SHA512a4433852b9c404df4b8e2d68cabe0df3ff02a2c9ebda7ecc468e73d1651119bd1dc878474f3c508b8d42b8bb78c1c08d1fe5c93175f8e2b15a9765019179c581