Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2025, 10:47

General

  • Target

    JaffaCakes118_0cec7c07ef770859d4ce2770d230cd15.exe

  • Size

    138KB

  • MD5

    0cec7c07ef770859d4ce2770d230cd15

  • SHA1

    624dce8a6a7a4afae18b4514b6c37e947df756d2

  • SHA256

    618be017f3b79e1f119e7cfcc41943ad65b1f4b0fdcc6d788277ec300b0b0316

  • SHA512

    0ea2b0989842b52b1e34e2e0ef5a0e07630b6afe35794a74bd05ac7fdfd26a275bf5fc88ff28bbc87c0b36d4f253b88e0091642f4373165062cce38a0149f12a

  • SSDEEP

    3072:64qG0nUuHuLeKvJMrjRXnucaaHw7Koj4rtQsDmz4oe41KfSBnU:XqG0UEuLenpq4oP

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • UAC bypass 3 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0cec7c07ef770859d4ce2770d230cd15.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0cec7c07ef770859d4ce2770d230cd15.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:5036
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 204
          3⤵
          • Program crash
          PID:3852
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3164
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1676
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:17410 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4520
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:17416 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2928
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:2656
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 204
            3⤵
            • Program crash
            PID:4076
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4220
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
            3⤵
            • Modifies Internet Explorer settings
            PID:4556
        • C:\Users\Admin\AppData\Local\Temp\itxpapdiwesfkwec.exe
          "C:\Users\Admin\AppData\Local\Temp\itxpapdiwesfkwec.exe" elevate
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3476
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\itxpapdiwesfkwec.exe"" admin
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3252
            • C:\Users\Admin\AppData\Local\Temp\itxpapdiwesfkwec.exe
              "C:\Users\Admin\AppData\Local\Temp\itxpapdiwesfkwec.exe" admin
              4⤵
              • UAC bypass
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of AdjustPrivilegeToken
              • System policy modification
              PID:3736
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5036 -ip 5036
        1⤵
          PID:2904
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2656 -ip 2656
          1⤵
            PID:1556

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            471B

            MD5

            2c48c73220d62a8faffe599e95896274

            SHA1

            452cd4222360fe7e881055d815ec65a2bbac564b

            SHA256

            35a3978f9dea3056b0c4a0a1945d785bb7a0022484782f414fa9ffa04f3d5967

            SHA512

            6547f2798297acc7ac11506328ef05f29074655f3e5a60adb188106c769806a2b1a8a15c7bd38c39da560df7df953798561398245667095536fc5748692cc9d8

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            404B

            MD5

            7bb7d36220f75636bd100ee96298fbef

            SHA1

            1472146f77a96494c05128ae27d920f75b0e6d45

            SHA256

            afaf77aa85b668e3252a371c2a41590c183e8767a80594b274848b4ce393edb8

            SHA512

            f77ea949910b290adfeb52182a84c044066f4ab78ab5ec3f546f6dd658ea35fb2b132b331a3fba83ccd248ec8c0a5be838bb8cdf230c14c50dc7a3a15a4fc461

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\suggestions[1].en-US

            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          • C:\Users\Admin\AppData\Local\Temp\itxpapdiwesfkwec.exe

            Filesize

            138KB

            MD5

            0cec7c07ef770859d4ce2770d230cd15

            SHA1

            624dce8a6a7a4afae18b4514b6c37e947df756d2

            SHA256

            618be017f3b79e1f119e7cfcc41943ad65b1f4b0fdcc6d788277ec300b0b0316

            SHA512

            0ea2b0989842b52b1e34e2e0ef5a0e07630b6afe35794a74bd05ac7fdfd26a275bf5fc88ff28bbc87c0b36d4f253b88e0091642f4373165062cce38a0149f12a

          • memory/1680-10-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/1680-16-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/1680-8-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/1680-14-0x0000000077B72000-0x0000000077B73000-memory.dmp

            Filesize

            4KB

          • memory/1680-0-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/1680-15-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/1680-17-0x0000000077B72000-0x0000000077B73000-memory.dmp

            Filesize

            4KB

          • memory/1680-2-0x00000000004D0000-0x00000000004D1000-memory.dmp

            Filesize

            4KB

          • memory/1680-3-0x00000000005C0000-0x00000000005C1000-memory.dmp

            Filesize

            4KB

          • memory/1680-4-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/3476-30-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/3736-34-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/3736-37-0x0000000000400000-0x000000000043A000-memory.dmp

            Filesize

            232KB

          • memory/5036-6-0x0000000001280000-0x0000000001281000-memory.dmp

            Filesize

            4KB

          • memory/5036-7-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

            Filesize

            4KB