Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2024, 23:55 UTC

General

  • Target

    31b08ab8c325605fed5e253ca3513e1c_JaffaCakes118.html

  • Size

    347KB

  • MD5

    31b08ab8c325605fed5e253ca3513e1c

  • SHA1

    2f1cf4deeb445162afb2ef8c91ac19da14adba31

  • SHA256

    b8de93950ca38be36dcb141bca053a02a7243efb1e36afda081023dbb8c659e6

  • SHA512

    5841db197673d07d6348a005ca6f4d0219fcbff2c83e7c2a48d1c264713d3beaa43b8d382314da88d592c1ca61879e817dac51b22a26678414db9eb3a5473a81

  • SSDEEP

    6144:dsMYod+X3oI+Y2sMYod+X3oI+Y5sMYod+X3oI+YQ:p5d+X365d+X3f5d+X3+

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31b08ab8c325605fed5e253ca3513e1c_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2924
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3040
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1808
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:1296
          • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
            "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2552
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
                PID:2392
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:2412
            • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
              "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2844
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe"
                5⤵
                  PID:2860
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275464 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2096
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275471 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2324
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:603143 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2364

        Network

        • flag-us
          DNS
          api.bing.com
          iexplore.exe
          Remote address:
          8.8.8.8:53
          Request
          api.bing.com
          IN A
          Response
          api.bing.com
          IN CNAME
          api-bing-com.e-0001.e-msedge.net
          api-bing-com.e-0001.e-msedge.net
          IN CNAME
          e-0001.e-msedge.net
          e-0001.e-msedge.net
          IN A
          13.107.5.80
        • flag-us
          DNS
          td4h.cn
          IEXPLORE.EXE
          Remote address:
          8.8.8.8:53
          Request
          td4h.cn
          IN A
          Response
        • 204.79.197.200:443
          ieonline.microsoft.com
          tls
          iexplore.exe
          799 B
          7.7kB
          10
          13
        • 204.79.197.200:443
          ieonline.microsoft.com
          tls
          iexplore.exe
          753 B
          7.7kB
          9
          13
        • 204.79.197.200:443
          ieonline.microsoft.com
          tls
          iexplore.exe
          779 B
          7.6kB
          9
          12
        • 8.8.8.8:53
          api.bing.com
          dns
          iexplore.exe
          58 B
          134 B
          1
          1

          DNS Request

          api.bing.com

          DNS Response

          13.107.5.80

        • 8.8.8.8:53
          td4h.cn
          dns
          IEXPLORE.EXE
          53 B
          106 B
          1
          1

          DNS Request

          td4h.cn

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe

          Filesize

          55KB

          MD5

          42bacbdf56184c2fa5fe6770857e2c2d

          SHA1

          521a63ee9ce2f615eda692c382b16fc1b1d57cac

          SHA256

          d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

          SHA512

          0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          f3263be83587ecc204ebd34e244a3132

          SHA1

          e82be20edc2c3160f66b3a970a0e4698260b8098

          SHA256

          3b745c83667bc26c3b917580df630e72665cd45dda6cba811d3fee4bce58b085

          SHA512

          7b98ed4417be2e6f21b0c3368625981dc3951ba5c284357743a3d044532406a0832ea7a2347e4ad50fd057ae767d4795810472ffed612d8ba95804c397d54ac6

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          8a98595d5f55ef166072030730fefdb1

          SHA1

          3d795a5559105874dbd8d056a1748b4ec1f7313a

          SHA256

          3fd38573b7f03212488d3020896f05a2c0fd73245ca0d25dae22cdfcf4f5ef74

          SHA512

          e441bbd625a63b1d13f20e5ae9c3689ed807860cdd681f56d932e6cc2358694ca481a19f9eac6094ae0ebe9b43b6839a5bbf753a3c7969127a800cd48fdee1a0

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          02ab2db75c8254b1746484b4b69e5d5b

          SHA1

          a810f759d7f5586a9cced7165b1cebff946ceda2

          SHA256

          baa8028633b45c8f9dfe547972cec020541c0952f0dfad9e3399fa431fec2c58

          SHA512

          303185ac29c2e69709b26552a1af595484ba869cc59f693ffc820800f70a2f46f1649f5f5d012906c95c212d21f5646a93c9db270f24d85ec1f51be41de8f81a

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          c87c5b5241262c0ae16139dbef48674b

          SHA1

          51e589953c69c77eeb0cd5879a9af3023b6ce4a7

          SHA256

          10164c794ec18d548e340c1af6fe2d57816c4d94ced70d23d833224ff9457f7b

          SHA512

          140faf69511593c69adff60febb104c1cfae6786336cac72136cd3d8a813ccefaf4afd6fffde9fbc5e3fa86ff625a6cd0572bc809258124abd5e09509312d270

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          a2d0f03f5f7fd87f1f3ba08bb178c317

          SHA1

          29a75c7ee56d541d450d212692fde34b7b09889a

          SHA256

          af8be5c53944cd1aa82944f6e12874d6091a8331205d795c21086599df56b022

          SHA512

          d54bb3d28bb7c94c0f93db4b29b1fbb9aa9c88d96b459ca24ba2d14ef7f70d9dde1d2e8ab273b0bc8c54ba03037d507d7a9b9a10edd62d8ebd75a0ba9e0faf4d

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          e974eac6e7cf159b49fac5d53e88a25f

          SHA1

          053068ec34bc7b57d6520043028f90634a0257bf

          SHA256

          14231510203acf925061f22da0f436c723fe968f0f7b2e45249d4c745cf24899

          SHA512

          d5a1e213a573b8a951fc0d6b86e0a2dcc6edfe28c849e0d4ea4e0f96e5a5260c6acfe6d34386fa84f2810c2638002f1fda3ffa58f2fba8adca25707ab99ef865

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          0e75e40c95338f262a2fef7dcd17b7f9

          SHA1

          5418113f136b554302276d0e28b1e26bfad56bd5

          SHA256

          190229d24a8d2654d857589149079d09210b390411820b2b3c0c00defb24ce70

          SHA512

          5addc33b1e789b4d0a4aab58dbef4eaa24f0e2aa477dddc77e6bfac14a0a320c468a75463f80aff4b29f7a6fb6b46239c53398a85ad3980b4dce7cd50e9e1e57

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          59c55ed8d0280f7252a8e2be590c969d

          SHA1

          0fffe5afbd60baa3f0bb0594d5eea977cc0cc809

          SHA256

          68eb4f3ecc5537c0823579e32551efebef82759ca85a86c6fc7ef9fd615d91fc

          SHA512

          4590748da898fe36f393903ef3ee649ad41ba71da55f5b77f97f9050bb804e8a00632a48f85d680da8703c6473c549f20edefcf940494e526b53e32d7991420a

        • C:\Users\Admin\AppData\Local\Temp\CabAE79.tmp

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\CabAF47.tmp

          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\Local\Temp\TarB007.tmp

          Filesize

          177KB

          MD5

          435a9ac180383f9fa094131b173a2f7b

          SHA1

          76944ea657a9db94f9a4bef38f88c46ed4166983

          SHA256

          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

          SHA512

          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

        • memory/1296-41-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2412-32-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2412-33-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2552-27-0x00000000001D0000-0x00000000001D1000-memory.dmp

          Filesize

          4KB

        • memory/2552-28-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2924-9-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2924-6-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2924-8-0x0000000000230000-0x000000000023F000-memory.dmp

          Filesize

          60KB

        • memory/3040-17-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/3040-19-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.