Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 12:42

General

  • Target

    JaffaCakes118_c81fd03698ac39336710545a59e31fdc.exe

  • Size

    95KB

  • MD5

    c81fd03698ac39336710545a59e31fdc

  • SHA1

    836b52d47757d6875564aa481ba87dee50134bd3

  • SHA256

    1e7e7c06c63d3cf8626579a3bec0aa11bb15b43a65313d5ec8bf86afaad69fe0

  • SHA512

    9e64e5e199a8e385e386dbfca7ee0780f786e00b9601c7d785b057fc2c42ab9d8fba0ac7857176f262d1ea2ea1fec07e445967d2ce219e2c822a64d9d85df604

  • SSDEEP

    768:i06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:oR0vxn3Pc0LCH9MtbvabUDzJYWu3B

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:336
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:384
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:476
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:608
                  • C:\Windows\system32\wbem\wmiprvse.exe
                    C:\Windows\system32\wbem\wmiprvse.exe
                    4⤵
                      PID:636
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                      4⤵
                        PID:1564
                      • C:\Windows\system32\wbem\wmiprvse.exe
                        C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                        4⤵
                          PID:1472
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k RPCSS
                        3⤵
                          PID:672
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                          3⤵
                            PID:752
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                            3⤵
                              PID:820
                              • C:\Windows\system32\Dwm.exe
                                "C:\Windows\system32\Dwm.exe"
                                4⤵
                                  PID:1060
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs
                                3⤵
                                  PID:860
                                  • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                                    wmiadap.exe /F /T /R
                                    4⤵
                                      PID:2232
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService
                                    3⤵
                                      PID:972
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k NetworkService
                                      3⤵
                                        PID:268
                                      • C:\Windows\system32\taskhost.exe
                                        "taskhost.exe"
                                        3⤵
                                          PID:1072
                                        • C:\Windows\System32\spoolsv.exe
                                          C:\Windows\System32\spoolsv.exe
                                          3⤵
                                            PID:1092
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                            3⤵
                                              PID:1172
                                            • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                              "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                              3⤵
                                                PID:1220
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                                3⤵
                                                  PID:2368
                                                • C:\Windows\system32\sppsvc.exe
                                                  C:\Windows\system32\sppsvc.exe
                                                  3⤵
                                                    PID:700
                                                • C:\Windows\system32\lsass.exe
                                                  C:\Windows\system32\lsass.exe
                                                  2⤵
                                                    PID:492
                                                  • C:\Windows\system32\lsm.exe
                                                    C:\Windows\system32\lsm.exe
                                                    2⤵
                                                      PID:500
                                                  • C:\Windows\system32\csrss.exe
                                                    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                    1⤵
                                                      PID:396
                                                    • C:\Windows\system32\winlogon.exe
                                                      winlogon.exe
                                                      1⤵
                                                        PID:432
                                                      • C:\Windows\Explorer.EXE
                                                        C:\Windows\Explorer.EXE
                                                        1⤵
                                                          PID:1144
                                                          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c81fd03698ac39336710545a59e31fdc.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c81fd03698ac39336710545a59e31fdc.exe"
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of UnmapMainImage
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2064
                                                            • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                                              "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of UnmapMainImage
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1228
                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                C:\Windows\system32\svchost.exe
                                                                4⤵
                                                                • Modifies WinLogon for persistence
                                                                • Drops file in System32 directory
                                                                • Drops file in Program Files directory
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2096
                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                C:\Windows\system32\svchost.exe
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2728

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

                                                          Filesize

                                                          204KB

                                                          MD5

                                                          d08310ae4add4fd9afaea93823b20f99

                                                          SHA1

                                                          8c875c4bc2f93350d1c8b49b40d93d7646a71f6f

                                                          SHA256

                                                          f4dd261d097685defd6fb4a0cba090ea4699e57b54a870ccd6e708c89a788436

                                                          SHA512

                                                          e3fcab6078926b1cb914ce3f65b4833881d8d744cc2419eb54f70fa69aa2ba661545f8e353715a712c7cf422e365accada86d5ce96d295770fbda4985030dbcc

                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

                                                          Filesize

                                                          200KB

                                                          MD5

                                                          de4b40cbe50095037cffaecb424eaba9

                                                          SHA1

                                                          e9a132726d1d9bc995c0bf66963d20286a6a2e82

                                                          SHA256

                                                          1bf2362357dfa9f3a6c71845e47d9f9242429c6f43a5159b941afeb88c8cf453

                                                          SHA512

                                                          d423be9c7ec323d6c13cdb34474687b46bf55f4519f3e4ddf8a65bdb6904e06ddb8ac3b760772bcfdd89eb6f31268ba803be43e9d00383b8a3ab1e9e8527e171

                                                        • \Program Files (x86)\Microsoft\WaterMark.exe

                                                          Filesize

                                                          95KB

                                                          MD5

                                                          c81fd03698ac39336710545a59e31fdc

                                                          SHA1

                                                          836b52d47757d6875564aa481ba87dee50134bd3

                                                          SHA256

                                                          1e7e7c06c63d3cf8626579a3bec0aa11bb15b43a65313d5ec8bf86afaad69fe0

                                                          SHA512

                                                          9e64e5e199a8e385e386dbfca7ee0780f786e00b9601c7d785b057fc2c42ab9d8fba0ac7857176f262d1ea2ea1fec07e445967d2ce219e2c822a64d9d85df604

                                                        • memory/1228-30-0x0000000077ABF000-0x0000000077AC0000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1228-608-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/1228-77-0x0000000077ABF000-0x0000000077AC0000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1228-71-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/1228-28-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/1228-29-0x0000000000220000-0x0000000000221000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1228-19-0x0000000000400000-0x0000000000439000-memory.dmp

                                                          Filesize

                                                          228KB

                                                        • memory/1228-60-0x0000000000230000-0x0000000000231000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2064-7-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2064-3-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2064-2-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2064-8-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2064-1-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2064-6-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2064-4-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2064-0-0x0000000000400000-0x0000000000439000-memory.dmp

                                                          Filesize

                                                          228KB

                                                        • memory/2064-5-0x00000000000E0000-0x00000000000E1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2096-42-0x00000000000E0000-0x00000000000E1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2096-43-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2096-51-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/2096-32-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/2096-48-0x00000000000D0000-0x00000000000D1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2096-34-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2096-44-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/2096-49-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/2096-345-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/2096-55-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/2728-76-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/2728-72-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/2728-81-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/2728-83-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/2728-82-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2728-78-0x00000000001A0000-0x00000000001A1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2728-80-0x0000000077AC0000-0x0000000077AC1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2728-79-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB

                                                        • memory/2728-62-0x0000000020010000-0x000000002001B000-memory.dmp

                                                          Filesize

                                                          44KB