Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/05/2024, 02:46

General

  • Target

    3d9cb9bf646cbf5f858c8abb89e0351e_JaffaCakes118.html

  • Size

    155KB

  • MD5

    3d9cb9bf646cbf5f858c8abb89e0351e

  • SHA1

    49405d39abca247c1744cdfeefe0a61ecf972ae5

  • SHA256

    34fda090b7639c21fbe9fc4e0201d52222138a96f0d9f2bb508386f35618b037

  • SHA512

    1397ca5fbf44d9732de7b64e9a89e17cb3b08b4031052d17b339311a6644e190810f824ffba80638482fdd0977803fe16ff030920c39d84df65f5ec3693f4110

  • SSDEEP

    1536:i/RTF2F1Pksxao9uFCyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:iR9RFCyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d9cb9bf646cbf5f858c8abb89e0351e_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1512
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:876
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:537614 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1608

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ac2d0be376d78b5ae8e93f5972c9c69c

      SHA1

      14a88391dd5fe6551ce9663c71881e090d170008

      SHA256

      a09d235801c6c32f075d7ad7d8216e95630837e356a3679405541e76e136e1b7

      SHA512

      7e0a13ac612add2ddf24cff1c76701c814d89d3061130a9f5aa6274439634ea651355705239645477de121786493819fad4cbf3b5dcd6d1828dd04975aec46ed

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      4632917b74d003d48093b1ac3e85a7d8

      SHA1

      b7fcda4851e66a7efa1528c5b3ba4f858dbdf2a2

      SHA256

      d9463c7d1acb1bb8e59245f327d8dee6f220b2460bdd7b9c81c5f14a7dfb771c

      SHA512

      2fe488e27867478f2d7879c356832a87fe6b8e01181988876c5888bf15e26b4bcc4136c3c4efe8ce6d6e9dddcd3c00090c594f0ec60a5047a83472654f9ba3a3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      988c77bcc724d69d37a71efd3c6780b6

      SHA1

      11ab089ac3703662723322c3fa905317b0d165fa

      SHA256

      89c8ce6bbc4d8d9742d8a2a3ae523a613cc0e3916e5810664282dfce49bc0503

      SHA512

      268cc775336f6bdbb20f2c9dd5d2d08a76f56959fb2062d70b8d3160646c3ce2cef645a20e1761bfabad42b767999bc3c0e3303302639e15e5d1c39cb8c67196

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      1bca0ae5e063262106cf1f94c7c4d18c

      SHA1

      628b9a8b0222b9545fa7a6334fae48e97ea30ab5

      SHA256

      3a73c0263231af5aae8928a443bc881dce2c886188556108513e3b921860607b

      SHA512

      1b504fbc5eed5e25b2480b76ca60a42cd8ce4254e89f5dec79c4c27b4e0e8e26962fbe43233637b87247e7905765cc88fbfcfe33652404dc273911fdad51637d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      56867ebf04bc598863dd3a95449ea53d

      SHA1

      cefafee26023bf9eea6c6588ec0fa519fd42b4a6

      SHA256

      ba60c9e690a5cca6209426a25e7b06c86c240f15df6cb4cc89b15293828ff904

      SHA512

      2778f2536e53eceb7e694c28181a59a870c43ff7bb4a1c8cf35d98af9ed68059e2f51ab1b96eb11aaf73d150f93f18d69b8c03c83d0fd66c464cabef740db56a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      415131c609a5ccd2843cb06cad11de7e

      SHA1

      56956b7cc32e4bfab0aba446a2a58adfbf8748c7

      SHA256

      c040f42a7e20c11d193167e5ac849cd10cd55991f27cf98e7722408e424f6ec4

      SHA512

      6c7a4d09042dba684bd50bd4c6f551ed681bafd90174f7684045bd184b0d23e56ae44c3af9019c645084a010efee495052e979612c78f7a396e6540c2de07d95

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      b38d577a3395d611f111fe05a9981085

      SHA1

      be981d7db37bf0b66f280fd44d61f06e51281a84

      SHA256

      fb5fd6f184fe8121f43dc6850293c46ed7fb6833ebc19ff58108324c591acff6

      SHA512

      36908120ba7bd784e08831bb8e47c33ace8d981a5cee561d66bf63d0475e169071420da50eecb24c8f6f0d3adf46ce388eabf131090c746ca65cda3d7b7b468b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      fd3da04a3aecf894b889cb9f8d8aab54

      SHA1

      a2ea2dc8593f42b4ce5eaaefe3f3580c514ed96b

      SHA256

      17b5150836dbfe5e6197d093122e469e5f9aea52b9c082ded3ea467b51c7bf41

      SHA512

      937d22677f71243f1659eaa57eebc60c513b7027652237739e6aba36c672b8ef18e359e54a481b8a51ce8ccb6e484132ddaba0a43ae7735f75713de7e8b30a87

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d2ad38d650e7f6e5d4d1021da350c4c6

      SHA1

      2348b98bdc4583d6bdc5b6a71c7994168838a19e

      SHA256

      cf01925a1f81d493e17555b22df3ae9be4fc2903425bc93417a3104a20d4bad6

      SHA512

      fd44646c64041b3305b77c103f959b045a436791b22a93063130008ad065636e26af54a9f3caf6710b7f91d013b1b60117eec354f1dfcd1a65a4df3c9139f24b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      74782d9d4cae00c3138b289fe4f3bd80

      SHA1

      ce838a2988b55cb7ca58bdda0bd0c8b4d521f823

      SHA256

      8d66718be01b867b0833288f49ce3dd9bf2dea6e15f5a843d1f5291f77d03bb4

      SHA512

      43adf956aa74796edc7e980f9dff996e2b0827e3f093a5aeb96d78b94548a128568f828ac0604e23450d58d6e6a99561a7925f9b1eccccc3cc8a730ff3bce974

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      38ed9c56de0ac1cf6c257c590dc20c05

      SHA1

      0b5e32555be602f914c5705e9851b9e7040c3e00

      SHA256

      b092ea09c1992f8ce3365c734847c61eea2f9a4564089457fba5635560c7c4ad

      SHA512

      afc2f3a30f3e3a94d6985c5bb6e143115325ff6753535031ddf7832091676255377a3b4e5d6db10b466296ed324a715b031566e0328462600613c1f4746d7ffe

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      807a2ff1fb071251b4d429c7697de054

      SHA1

      63f2b634e9aa92674b3cfeb6a98aef188da45fdc

      SHA256

      fb704e87a50acbaca4188420dfae8b6c24a55fa5deeb7bf32a81eb9357544452

      SHA512

      677c3ed66dc310f9ee9665476ee444958881f70d9ac2c60469d2951b1f78786c6060d4aa6d840f6eec27f604acb08f2fe1c96e570cf34f610a299613ed6c9841

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f5ee0e1e92911e1c4068106122e1a448

      SHA1

      70e4ca5de43b3f46bd8c8d2e34f25e1caa9c8476

      SHA256

      95f6ff6a094a50d7f6993cf6d8bd7944908b42dfb1e481895def89ca31a16eec

      SHA512

      0e7bc9c651afcec4a319a858691c833b2f49e4e3950fbc706b65e032434b214b90f40b982adddd2de3f7da264a2c625eb326f966794cf60817962d483a8dd45d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      19a496b66355dfc2390e98fa82b3adec

      SHA1

      308eae6d0525a07bc8cc7cf4885f6b19cf57aec0

      SHA256

      f59620e0aa3387a399f0a5dec2fea96d9536b6e7b2d4c5d1d284cedf10a3c72f

      SHA512

      c9993b4099c6799ddf35d4e4c7cdb7f5ca92feffab185efdec41fb35ed712eec0a75b28723b93f9631e66b34b40f3a8d11f1bf81311a01bd24b1c7b4d2766d8f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      94184356b4d3970ceef88dc6d7bfd659

      SHA1

      c493a60baa222b02f3f18cc73f01643a04cb0da3

      SHA256

      f6f206bdff6d3e50a3b281a37137ece9dc7264aa2f5e836c6111daa91a72e49b

      SHA512

      7c9c50f0400a1042c7bea146228f44a6409820b5ff97cd2081b888c693cc2bcca40ba698c99c0c3773d7775335a1af7805a6deb1bc231d1daef8a4e792be7c1f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      9619b241757bb802460877bb551e32da

      SHA1

      d5d29e392fbd78a95ceb3c7fac29f55f5555ee58

      SHA256

      d4e3a75e0aa356a3768a656e237e420b9f5165c33934117bd9621b9c64652719

      SHA512

      3442e8ee50956d9a09f7ff80104e8fddab06707cf9b1f29e7b4b1e677760de354e0bceb70d14eedf2fdd83bd3dfabaab483badb63409895a8cde965807b70308

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ad415a5426f210a1f65f8c735b2ea5c8

      SHA1

      23a1dce7aec3020ba383d5fb52e02b43d7a33b91

      SHA256

      0009873d396e42c77d7dd68c182e69c57b58a7fbfae66f867ebd663f99ba7a26

      SHA512

      bb4999428e3896cf68c8be31b0ab47f8d84b8d7e9da4c3b42caf8ea27b712e7c9a896414dcc507db3413a2a17148a15f1b5e03cfda982d01a64247a38cd9b53a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      1072f4a34fa2cc0c35a880083ad02471

      SHA1

      b6b83e560a584449d6e3f04aba76d0b86e29da45

      SHA256

      f58b082361acfc6042c985003de9c05ed1d296b0a8db7c1a3e63ce32f70bfd25

      SHA512

      cdda963381aafa173a2255654f678203c82b3f08bc70c160add0040319d50c1270202eeb65b45bd87cc314b3b51ceca5f632e1bb3877c2614ef52825b2548270

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      30b3448dac54ebf0ccfb425dfe6f1db7

      SHA1

      be326232305616989e78f35e03a243dcc9a1a99d

      SHA256

      2a2444093d2d849dd8da804dd102cd26cd109f1dfc8bfafccf38306b8e95394e

      SHA512

      e41a030f0a65c5785b74529059e38eae22f8f287a11f06fa317f01c8c8f6fc1c2453d6b9d7853d540c445c20b3f54ba989428b37e362dfad21c65e353e24fbef

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ca1eb9e51ad993bd30ca2fce58a12d91

      SHA1

      f005c2338a3fcf61cf935116e3d4520de761db99

      SHA256

      c14caec61e93dc475facacdff5819453cd31f428b9b39fe8a1579153c6ba2eaf

      SHA512

      73301888e402b8a381adbc031104c36306e4457ef44109f26c77c3b5e3f51876ed2ef95903871af711de7cf3117c4dab6353ed0d0af6373325c0ba649538ef8b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      798b94c477ea42ba907eff362bf8a670

      SHA1

      d3672385d2e4380a59d88c03ed381d7e577e7008

      SHA256

      820da92dcb5c3f06a912887b81dd87efbf96d3f98c646c1143a4a35389c850e2

      SHA512

      c3e5acc9a8d81af004625a98a3670d4202c1934c1ec779451d094c8eabf8ccf195cae6a1216ccc253dc0111ed5372e8ac497138f9d5d58f29d7578557f029895

    • C:\Users\Admin\AppData\Local\Temp\Cab2898.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar2989.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1512-491-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1512-497-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1512-495-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1512-492-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1512-494-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/1760-487-0x00000000001D0000-0x00000000001FE000-memory.dmp

      Filesize

      184KB

    • memory/1760-482-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB

    • memory/1760-483-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1760-480-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB