Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 21:49

General

  • Target

    21dbca0cbb0de0d7492ca39593a2940d_JaffaCakes118.html

  • Size

    158KB

  • MD5

    21dbca0cbb0de0d7492ca39593a2940d

  • SHA1

    2c653b0d7ee37af2ff272ca11be9439d5fbe64c1

  • SHA256

    d8fc585e9ef6f11be19bd285bc2295f68bb5baaeab9b5e0c7322ca264e60e910

  • SHA512

    73ceeee40ce51210ce98c5ebafdae82add5b44fad51ea3eef25b2ce886c5ddec04079ec82de5d3186f44e4d40b49ed5a69b189031a06b09a8539785b22ae9f33

  • SSDEEP

    1536:iyRTGlOuHiruhFyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:iAViFyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21dbca0cbb0de0d7492ca39593a2940d_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1008
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2260
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1536
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:537606 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1544

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      4eb0d0d5ff99aaa193095b5c717bf995

      SHA1

      3a64605e6a2ff0c81100240ec3d43932e9bdbe33

      SHA256

      d89e1066032067b67e6378918dbea7990ced392dcd1f955bdbe123a3dbc4208a

      SHA512

      162c5ca4d8c3f00eba864dddfc0dca59c07ab2c4daab484952decd05b96928490b1843cf131be3e49cdb216a68108fc7d04c866f632a0534f005792e87b83783

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      6830034257d65e74779c3baab43ac582

      SHA1

      572608b9862560e523926b231d4d5400708fcfb2

      SHA256

      18e41c83ed36003b205c07ac04118018e4cab5117ca49c89813f97d85f5c2c19

      SHA512

      754db2d94ab0b792fbb505c5f55bd1c3d6823efc446016a91ce78d3a9bbfd534b76d81c7362852ab1b30014814ed0af960135c590f96c495eb6c4343e1f1fccc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      336ae41e4c7a08af290bcc37e0aeec11

      SHA1

      ae77550688c62db50bb58aa6cd6aab5ec51cfc65

      SHA256

      ccff5db98e235b607f938acf3573d68e2c5bc9e40822b333c7cf9a4e88cb0961

      SHA512

      094975c5d7787db70df9b2231f9581ec3d3cffc5a32e5b9ac362cb6832ab488ccf439ae99ed3da2e2ec68bd4aebb1b82404f08806fdfe7c711ebf907f917c7d7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      20c63f6dc2022cb540b25c0a60326f10

      SHA1

      6a33c295d0b687080fe45828a9fa911750adba0e

      SHA256

      a2f37b2d44693e311ca9bc5a0033f6396a39b7df6f987cc58926d2690dbe8a25

      SHA512

      31f6a2724b4f99810cf98fcf1bdb6812a1a209528e3233e0854f24fada55763a0551a90808a9b14fdc515025a3726c682a8232f6fb905c01c043717f2333f05e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ec15305dc04c4dfa45d73c13206635d3

      SHA1

      1e1ab2976bb90f48834e80cd1d25df0b7aebeda7

      SHA256

      98e127b2d956862d8d77dd22a042c615c6b95b6245b9d8ad776104057d6ec366

      SHA512

      95adf052f00b62e37ba9297c91ab01468f4d85271e85d4bc010c31a3631b7993a03034c55c8bc24a76486a435b78e458f5ea10a421693f4437578cdb447f5213

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      c65c00dfe8ac97a6951b494a4d1ce368

      SHA1

      34159740d8de2069c237e0be39e5d1738a3444e6

      SHA256

      ef641c7a2ae152e593f47959ce4e84a960aae6041cd3d690dcfab3430aa72090

      SHA512

      03d178b4a7e09907847150e528a39d696ed242fddcad7f7e3655c4d4faed68d55113c5290efce1a0fb53c341f69cfc4ec41e75fb2dc2f5b04aa400124592e9b1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      31e71b2108f99f1cacd393ed04df9057

      SHA1

      0b6bc74f35b7fd02894a1183b5fffcad667625f6

      SHA256

      26d8467072afa2e27f942d035f2e91cd0385ae4ac16e96760743574218f04a03

      SHA512

      97468fa6bf4d074c0b429a0d053667833ad7814abef5aa43d5aeb5f2848d38e30456acb348b6ddf4bd5fbb2d4f042b9bf1b0ffdd5834c8eadca3f8b4d7607a1b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3625aa6fac1860ac3adba198338f8f8b

      SHA1

      f6d88c33aa03c50e9e790f162d70d20717c47cc8

      SHA256

      e54d6e2f2858df31fb7a17675392821881b2c8d458053ddd286fa30c00b9ea0d

      SHA512

      b200d6ade4e188b4a0b3652ad1b7bb6565a99482330556a29cc053347b40f4cbdb6a758624c930cc68403a47c3d12901635ca2340140c43571661a9474299675

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      25cfac1b68fce98692551e9dfd96bed6

      SHA1

      8c9c8d1b322b05f35d1b4b09fe23d76770c4998f

      SHA256

      e9046ab3283cf246a7b8cc55d999a3517f340b6e090a55dfcb0cff2e762d7bf5

      SHA512

      7d56b025c818eb67325e976ed2d448f8c2962c14cfe8791d9ff5440fdc337357b1c1229c2a53f81cae126e1d24c062c7d7df7a2936ed2e14e09569a48a35fa83

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e45806e171f3a439ea492cfdaabd57d0

      SHA1

      15258d0514a25266448afafedb5834c4ef5dc64c

      SHA256

      0179d585e5b1e26b3131b5aa79fd1ab33008f96547d35e9064384623c00aec1c

      SHA512

      7598fe55329ba2c0fde5b3c5457f31339a82e6e3812f04d0b4fccac29736d485bcc532461cb3b7dc7b66afe1de7586dc868c9b1e9fd4d08a92c0c6fc03276664

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      2851ea73dd0a7407542bff5e9cfe7bda

      SHA1

      a8d4344f68d31006e19f7de908d950fc6739b13c

      SHA256

      8133561b92388f6c904ad17254ff13db860ae7dcf8435b0ca7206e691c7909c9

      SHA512

      f2e57e0d6ef10abae19cf5f08adc52242ceacb7c9a21e6d2440c2979d25e0cca3b17aeb8b9453d8ce0e2188811eeacd6902183fbc1e48cc64d41c2ae6cd71e5c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      a5c239a1a5b7d50e2e68c53be3d6a6ca

      SHA1

      db821a2bef727b95a1cc97f62274054a44a3b30c

      SHA256

      5d84753b3ab8fdf339e1c81a7023786a90625f21c6c50da7365a75997b534b2b

      SHA512

      e650c69aab8453eb5ca6aedb6246daa69cbd135de0691930d43f2a50fd0e75de71f514ed722cff213912f9dc5a05ba757d21bfa3e180b6bb2ce8ec05475fc0dd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      7ec3ba2d2764d911536fca4a2cf60e52

      SHA1

      4beaa143b8bb784d3e3810a8c22fa4ce57754237

      SHA256

      90d16c8a8104c0ba426dcd216341cfb78d041ec8f170c7cf4c71a224112e7b61

      SHA512

      4cbb62b182dc387a1ee37d3ed75af6bc1ebcc52ce258c0f9ec25b8ce01156547674d4b10e0d3460b0b4f75f6d969e04933495569ef1ee7c97be86b71a6c056a7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      54fa6f0faf5758f0926cee417784f485

      SHA1

      caf159254035ef9933b249ac278ed73d958dcfe2

      SHA256

      f301cef2f9db350721835705b1426ccb3b777357b80ffb658534aa370b08fc98

      SHA512

      e542996acd6ed6270219cc1ba35c78245588286142e7702b3601125199d5a7978ca3a17ce37e2e11d7ba51fdf9c960be59008244274d6663d83e2c59f89ba649

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      cef00f2d70c5dbab4d81dc07afe7f895

      SHA1

      3f6afb351a0aae5cb4c47db916a3253391f5f0c5

      SHA256

      581d47ec520b1e508fc2119c9fdddc53e9acd4207c3aab71e70625de7b986164

      SHA512

      012f0d140b6b88f0aeb009c97e97118eb1767f929e8548e94771986f7f814852ba7225f7c92ee84b5d4d8f5c5c9a00285c582b52d2f4ad5008c1e6780026f700

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3052055ea79c16f4e8e0e3e35b71f14d

      SHA1

      39467843449b553e02697011c04d7a5167ba863d

      SHA256

      241f3ec5c51a4c83759f7894d538a8f74aacdd7f47184a1913741f6452f4acf7

      SHA512

      8c9f1846a8ddb4453e45ec3bbe6e1542e369dc1b3c71886fe2a2d23b3a5bf1c0ea95e7474fa451257ffde6b031b3d942b35b35b39ee46b631a008fe5f668d062

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ea1677c9fe16a5421f8023a37b09e5c7

      SHA1

      bfdf0c6e237018f89b7e09e44146c6c154623c9f

      SHA256

      f9de61929651fd695962b95018760981db55fe1fd68e444558f309bdc0876933

      SHA512

      bc96641474edbbf891cf5736e8dfe218d3c0472e71c6bc5d49557d959e4fdbaed6ef3762bf292be3be3518c81a12e34ad9539c8f13e4c3c3e813790ce1823af7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      67f7040cd86b247d7c44722dde4cf4ec

      SHA1

      1ddebab34d428d2abae235459d1a8f151ec2fc37

      SHA256

      1960bf0e61e6b4dd90ecced89b643671db8163611e3849dad7164c1ddc291ba4

      SHA512

      ac32a57203e6c92d6477d93d9b5e78f9b3e64a1bf4ffb4d0a2fb2b44e2e20f419d50bbc46b7810903fe50c8977cc0b1b83d8b020d83a7fb50f7f02587382dae0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      822f97ecdb14ef621d36b9c5a6ae9db6

      SHA1

      dde9f9ad0c92774fa082173536d243a8be8ce5de

      SHA256

      cb86dae3981c10da3bc31a4044dd39cf65378fb966b7a8bc5c1fb68e6be1c8de

      SHA512

      0a108a1562b5f06b603825c78913914c3f808cb5f205a23c7cecdaccd116a8e100af8af1fffb743de2ca3c6fa722be5b0e92d36f2397ae04ac15d1673f73783e

    • C:\Users\Admin\AppData\Local\Temp\CabFD54.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\TarFE26.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1008-482-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1008-483-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/2260-490-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2260-491-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2260-493-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2260-492-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB