Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 15:00

General

  • Target

    400e9419fbbe5765ab3204e9e4788f59_JaffaCakes118.html

  • Size

    117KB

  • MD5

    400e9419fbbe5765ab3204e9e4788f59

  • SHA1

    68289a9c06727fdd2a3c02d702f7e3021b0d4dcf

  • SHA256

    e7d825ff7a3a8fa7aa15a37b47c069f9a7a2b4500efb856a87000b7af86acdf7

  • SHA512

    1e4fc1648017031a0cbb5cda063114170feefe0a3bb0a368cf72cf1e7f3493386376f2d00533c2023ebaae01858ddc415b7065020b3a91874847677dec0e3bd4

  • SSDEEP

    1536:SsRJyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:SqyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\400e9419fbbe5765ab3204e9e4788f59_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2904
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2924
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:603146 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1996

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      6a96fe866d330e5329cb6cac45f90be0

      SHA1

      d5024abb1d00499ec75e1a906d1aa3a7a7d301a1

      SHA256

      8e3d4de5f925acc592df89cc0f332ed7c676144e7856197902014fa4e2210f52

      SHA512

      3f29ce338ff6bb4ef73a714186689775ac7778bcb069117cae20575cae1e19c21ea59bb27aeba32d12ebedbbf0f1b1914857855f5b1c7142d51ebf8c72ed5f21

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      40659d96f7b94e5ada9a73f610459421

      SHA1

      a8d88d3d75bc9f7c4528bbf16c406b6aa62cf43d

      SHA256

      60363b575763d0efb74b5a40c81b6a2221220ac5749504dbeb4e53a2554b2a0c

      SHA512

      92e60e140e1d123cf27f142ee0f94b14dbb3e7576732997ac0af9f2692433e62d6e6a0f967ae336c8704fe4fad1f7bd1260596dbfd901cfece42afe4e5e5a874

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      92d2cda49e31a379be977d78af0791e6

      SHA1

      5e07f3d54e41fc664bc8b0ec225f78301480f464

      SHA256

      e1a43bdce53ed02914d66f27865321120fcd2bf0c9efe4d10d0a581aff3588e0

      SHA512

      473072e12bc710746345c6efc6e8d93cd35b3dd23be2d3b9978741924d3c0fe43e793556930832765e3cd190ce05d949de12e621e09025d85c28c6b611f57973

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      18058f41c1ca0825025f4c709a8e343f

      SHA1

      9cc1bd588045dadd93cec4f2605969e7cb3ffcba

      SHA256

      fc1c524606ee558033e2d0ea30bf67ddacac29b86d8968f6258f18c24b0c0a03

      SHA512

      571dc1e8fe33b58e750479ab0ee54574933025e25828f56a5075adb5b428cb86dca4f9915dbfc56cc1c66f14face88e2ed7a25fcb560022a57e9373a2b933879

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      43e4ad5a915790840aaae1d7c7d3f8ac

      SHA1

      b76495e9811673ec59612307b4d86fb93da874cd

      SHA256

      48f4fe479e71721459d2ebfd9d78dd6b15c87d99017f624a9492a5d307acf7f2

      SHA512

      bd73e08242be3911fa9ae1a29b4cb01c34c3c8ff2d3fc41af0502c5ce0503544d4895f2e130d27638ee9dfb4431e3eb36524e1f21a36257385749dce7486648d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e6129bdbd9888d4ae19ce686c49a9998

      SHA1

      f45a05eae82f81b6c77ab83d4b309e126c526b39

      SHA256

      8fa7bff646275173317141550b6de078ea1345006886e0d7accc053362d7dd77

      SHA512

      9c816c375135818b06539ee6b31afc684070bd1a1302a6452ad4d3f0317b1225a8d9d4036bdaf86a2980482a680c61ea988c480853a081544b00c8d6ca226e5a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      db587f68db7b22dd9d5f31102a9c7187

      SHA1

      9396a794f3c4ccb5fbe0783725ccd2bcdaa07c86

      SHA256

      01639ab00d9dc43b012a8e4370cb49057151182afc7c19a31b41ce4dad766286

      SHA512

      672e5ffb4e49d921ae329762b3186d5b8a5217a732d04846746fd011f27836b574a669bf5ca04822b406a8f28e2d0b7c33a305e4c9ef5d2a1c99914f8bbc1edf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      83252ded4a8bdd63990ab6038a4cc817

      SHA1

      7475de3243e69dc15804b8f6038c80c4e1b59f59

      SHA256

      fc64b7383f1d5264cd9fd1226d1d2151d4e7bc34cb9c7018366e2f5440fbae8e

      SHA512

      bcc380b17ec7ba501604ade3f457d80051dbe0a830fa39d2fc83d602977a9ecc833bb735aab2a572ec6771473b97e7ce03f0a9db53a963dff5a304079db0f423

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      43be5aae46c986638cbb6463c3b265b1

      SHA1

      7ebc3bc8aec21b14ab4fc4cc8916d33b42bde09e

      SHA256

      d1e964d6f6d1bf70161c8d3fe8a602044e03ba7d31a30279c503cf93e15faa97

      SHA512

      9b412e51b945bb7f3f9b42bffc33e30f1f5b6c195407a157b9b30c05ce7efbd68f6edf5a636965031931a957cca135dcc051386cdd8a257a7f2bb459487ce854

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      0f55e25d9d441f4ffdbbdb6feebd8c96

      SHA1

      8619531e518d1bc32031f3431a4b68d4f03aef57

      SHA256

      4a95486db0b2d816a5ac3736a87fb75537cec2d728253797d0d1f67216acd2ae

      SHA512

      e1abc6221e5b3dfbeb6769c405afdb7a64b691da6dbeb6007d18122ad0124f3826aee913f92ab07355b24ca1be7587300d656cd8a347453d2c5d6bf00325f88e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      947841a2550eccca7022d901e42b8a2a

      SHA1

      dd3478b10b2def315489b2c9c381c03c8ceb6124

      SHA256

      093565312db3a64c9ba5ce7f42cae2ba8c21c861e4d1d65e0cfe846ad1173c17

      SHA512

      062e05789cbe7f52f8653d9c076221e129d7da4e765218c59523e28c15d56b65750b9aa3a1f5f29094dddd92ae6bf10ef5f995ba76508fe46bad22909124aa53

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ed41d2eabb42dedf4fe1ba2983db2ecf

      SHA1

      c9a88123e0a9b1039c922b1d1416c4beb81b9e8a

      SHA256

      1da27d642586117434670772b0e83b5535c3fba0b25b9b1547b9c569ebd02d33

      SHA512

      eb0fc95c01ba8f678df0dcb5faea57636d5bcf9e7e7580f55e13dcc4092ea22aeebb669a1b7d598b48c9287e6d90384a69bf4edb71d6b231d7adc0c9c3eb751a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      92f823ea00e8bf525cf56518b165dab5

      SHA1

      5802b4b69ee04b5dc5edb93fe15b63b16bdd3770

      SHA256

      2575c8ee83bfd28843b7d325c062e28c80d805480d3885b54501429241e6f9f0

      SHA512

      a964005465b008fdb10adf36ea3c10ecfff06566f7a2f848a55c2b92d69d183f14e2be4964dc99a5d181d3b05231dfd0fd62da2105bdd5992c3515d011c0182c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      156351e1625197cc7ac5fcfd6067aa90

      SHA1

      ce447edbd0dde7d667e1b2adc5ca368c997c05b0

      SHA256

      ca84311ca988ed68bb9f9587ff3fa1d3896b23225c9721160a9da2981cabd9e6

      SHA512

      19b5ab34c4bf2974bbddc6dbac62b4f428bf8decd7b7ed67c6f4d72923893aa41c6a4c46cda681cdf550144a12595a701c5a2ffb44910c5e94dd210de8dd8426

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      689d45bb201dd925dc8f811fe8b03b63

      SHA1

      570218d26b9b49d53d77ab168830172363fdfd74

      SHA256

      1d2dd3fe7660134b87432811059f5825502e05eeadd01a861c570d909c83282c

      SHA512

      fd7e0f22031c481c67ed2b9787f05eb3f15526765740fa6b164d28bdb75194f0991780b345d45761b9770c91010ed42fa9fbb88c66cb8bbb1d3ebd92242cb900

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      c0cb8011b52d2343ce39acc9b79af554

      SHA1

      84795a0f3a1159920597898102f22b8b137f4ec6

      SHA256

      531a68733c28c8aecac851c24ce593b3824a5843dd4cf915c493798c56b68889

      SHA512

      23e6133daa1e2971f1ebdc86ebdb1e871a3343da9e2e94679a952b620c780d6b9d207f5fe45c48bec3d922815ab11842ef08985b5334ba110df9987d81c57453

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      4937ac5e26e870ea108701f6520cf74d

      SHA1

      beb831ec7620d4ce93cd691d3209473ca766edc7

      SHA256

      5e9be60b39d9a0bd0b1c0e9e80b77dd92c3e67d374fd45353d49ce11dd3c36e9

      SHA512

      72aa955d87629903d594181008297a2611b95b9aafd467c4b9f812917d562ec6ba50e41af944372308476bc32c6b749485c78906f907a9a264b5818460aef255

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      b5e563e85ddf92196307fb8f2fd5837e

      SHA1

      171674641b4ff98df3fa6255cd4b5c8460831f80

      SHA256

      63a36d845daea706785f44501a58f79abc02526a0430b0373720b6b9e5e9822d

      SHA512

      50206921711da7775b71ed7bee4be3478adfbd7c09bfa0c3ddcf15cee377372903918243f6584b87635a3b41858da57cab22bc087472da11a06b57f483ae4cee

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      87c306d63e0e55d6d71abcb423fc58de

      SHA1

      035fb72ede93221dde5baab0635faebdc5cb8535

      SHA256

      ac1da42c4de6942dcf061f9921586886e4090e95addc7d14ec3228d6f4ece356

      SHA512

      7a9caeff2298347c832e263ba52f66260d19f9201bee30cbf5f3c12c0b25fc1d5b74b55e61b688e203f19c5f0f17299ed9576b667b7a095f04a6335fc8fa34ed

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      eefd133c4a866c0f11f320d00764e2c6

      SHA1

      55a4977ca8ee68648d1576811228454c92300537

      SHA256

      2b7d55838d67027089be9fe95c0897ed62474f3ba5937f1fef55bddf76142d4a

      SHA512

      304cb3f2635c9669f9b599e4f598f91ad452eca804a95d5b63eaaf74a836600fef4babf6a0024f553a72c66dfd7a70a9b54e57fba1fea49a9393736cd181b448

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      85cc92f85486310a01813eb1571bd790

      SHA1

      e7fb94463e8be28f79bf6a55c2e91d0b52e5cf9f

      SHA256

      3bcd808986873a6973c08cc65e1ff3df157d64cb9cfcfe14c10fb9fe615f08d8

      SHA512

      a12d4c4abd797f7936aa85d13f05ef92140eafa3e26bebfd88b43a04e52a82c50f2d55b75727f7caffab9286039903c6ff4d6b58f398ce771b0ed9e0077aba99

    • C:\Users\Admin\AppData\Local\Temp\CabC6BA.tmp

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Local\Temp\TarC71C.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/2540-6-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2540-9-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2540-8-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/2904-17-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2904-18-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2904-20-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB