Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 11:45

General

  • Target

    632c65444b84bd909efbf8c26d4ee3dc_JaffaCakes118.html

  • Size

    156KB

  • MD5

    632c65444b84bd909efbf8c26d4ee3dc

  • SHA1

    782c4c1218d0d73422c1e9fdbf648d9eae4de39f

  • SHA256

    d208df95265db90614c97b5fbb2ba362ca0dcdcde8c73a4342f38f3d90747b05

  • SHA512

    69206063db1b008a02ad9e9fb811551558810644fde4aaa37016482b62d51889d1b139416cc447808039dddd315fc5ef427002c5d30cfb8e48e6240fc3971c80

  • SSDEEP

    3072:iSwAfZv3LyfkMY+BES09JXAnyrZalI+YQ:i6usMYod+X3oI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\632c65444b84bd909efbf8c26d4ee3dc_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2892
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1612
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:537613 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1392

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      374977a6a7120bddbbcadc87e5d83fb2

      SHA1

      7336ac4f51c9d4dd543cf6f0fe5a9263bce6fd71

      SHA256

      07bd3497c0d4c5a7791ad9f8a65c00c10c7f4778f2cefa9c9a95cbc20bac2bb7

      SHA512

      ea606212c2242b450c5ba591d32bc764f798c9873d0d6f43146a23f5d0c6933f5d4a1ad72c508cfb07d4ed64f41cfc3c3f1199530156e021d6a284c3bef4a699

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d520b3604a59accfebc2815f9ee8f79d

      SHA1

      443c062e0e477ab32bf9414cd23c379c548c754e

      SHA256

      649466700c1cf2b1ca35bbcc6ec5a2e897dc716e57a88fad0d86083f94c80c46

      SHA512

      5573d1d3354f6599e961b853e4d17b9a91281555cc504932e7571bfca870b13cd6e0acd62a71a9305a564144c14643854294763ba15e94741329b2ce8726d6fd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      7cfbb6a8cf2d8bbfe6e6300173441582

      SHA1

      b693f5e31efa578072ceb49180307bb478f49c61

      SHA256

      4101c163937c5c8822a2fa4f6262a66832626a3c70477fd0ad1fdb0bf512e03a

      SHA512

      801f9543dd6e380c0e4fbeae0a1c10ef9fca37762bc0b72388e5fe5ccf1b30cd681eca8ef82a5f24c16e5505428e8b4d3b7cf94aca50dd7c983296785a124545

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      a5d5085add7d07825013235c565067b8

      SHA1

      88b76cc8220c8cd3e899e978fe2a1e0eb963e351

      SHA256

      a329d73abe904da6af9f2e5e3746c057eefc0fa60f20f09d55b2fcd500832df2

      SHA512

      d24a834375f3ea4400812358bbef83c3cdc1633663921e5580116ee23fb6b53e082d7993aa8c8c4dd1db70a8d8ec9a0ce275827d52286d6e04c4000467632d81

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d0604f30ce34dd08334f74c875ac2dff

      SHA1

      34071570e439a42ba30f3ad54d79cac7e6747786

      SHA256

      d628b1a2934adbe59c319573495b04b091e37c5a66af67df87442425b00e6949

      SHA512

      df64e1e0ad2f494d9fc0a46218e47d1a4306911c19d4077315a44e79ac32697c0ca45a6204879c3ebb99694abd43fc5b0552d461ccda524212a8aab2f8a65175

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      34bc33c9efab265c77b0ca0073b2c87d

      SHA1

      35b636303d402200632a8052b9a33522b8955137

      SHA256

      0320e56c5f14670c0d3e3b113e064444e2686eb6405569e1819aa6f5d05b944e

      SHA512

      4dc031928b1bf44d3e37224fd59ff4971d72257eefd728a8e434bffeb10be89dbef1ea540755f454f301841f3505af0c843d8c92763e78e00af7f8b25614a89a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      2b199602e291646732ae10e59be0204e

      SHA1

      21568956c8b20c747f68e96465bd9a324d005cf5

      SHA256

      370ff43e695e90cae4600cecbf2771a92ae81c54d2612059055b9240c9ad2934

      SHA512

      29199a1b08644f178eb80271b39a541d2d8d9f423eeb513cd41f81804cba4746db3ef4e41758ce41f24a050a4dd35d6a3295bb8bbcf1fd03f8a1f0b3697b908b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      49c44e59bc7f96238cabcc24368695d1

      SHA1

      6c204b89bb817384c1b4bc88d8e867e8c7d7dd3f

      SHA256

      3018d5ab952852c1c386d6ce659e7351f4c556c078f03fc85671db50d7cfb3e5

      SHA512

      29f5e6fbaa7b5d09c0a532e84f3b7e4ba20f0f4ea9ce19a69b4e1236427df06d44b48d8370d41bf816142866c49c49134e0d8fd019a23df6edc903624e295342

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5363395390e658146c9e07f51a7b31a7

      SHA1

      feccb65d63f93c9e2032c2bd3c1a662a8f331680

      SHA256

      bae699dc96f5de31df50a3b1b891500a75bc42f734aed09acfe6accb36dde7ef

      SHA512

      41a2d7b63dcae06fbf08dd0025feb8c9af9786b60469d34abef3d3e7e68be4d35f4cb74c000ea52d756cd868950aad68b81fb1e3f8989ba1aa52870b4fc51a12

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      37ce020513b49a478681d386bdd58676

      SHA1

      b565de12bbb8b313d429b7d936774c6f9a2f6fc9

      SHA256

      924a5dfd5966d53b80b3edcaf650cf1381a51805f348a308128b9b86419146e0

      SHA512

      623ceeaa0f8a5aa27599e4ad6abb3ce9f86fbe87ad8326207a2579312fd10a00a6141926d5780052469539e27fe6b123201567211801d8234b90ed1cdd241ead

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      6110f9f10975d0dd82b36705715b6a75

      SHA1

      570ae21f0c4a1b5d317a648e298c567c221241b6

      SHA256

      2712cd4a7100569d05fcd6099bbbc271422e639e33495287cef6712918571d0f

      SHA512

      f541b7cbe2a0bbd569ee702e57fe27f4f7bcdfc4899f37c5fa1ffce9b70afd81560b9f34b19e9ee6c2a3bf290ac6f19e14f256662689537224699342ebe5f1ff

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      24ea141d585174be00b0c928e23828f9

      SHA1

      f93ed499ae6d2aca6230d9f12502990714fc639c

      SHA256

      7f4cb3f8942daec7bd71338d5810ebd886751bc80bd148ef545da87a238c4c0d

      SHA512

      9484a4ec546698215f64e0727d1bdf7d555056a61c3fdb61e15b132375f2c8a33d66ac43ded9c44e0e9ae3c83e4efcc9f3cf96a4d63fb39a0fb5688243efe043

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      723479db2a9bf27e910a1a546161290d

      SHA1

      b62bfb2d9e5e4d6b31963da50f08ecfec35ef346

      SHA256

      25d99f6c82ff2f1666ff24c0f8ea11effe14122b4413d77ac8b84fee2857ab75

      SHA512

      3faea47d6efd1c2a36dfbe38cb6bc13b761094f5b3639a1b2145ff04c1ae71f3cb9cf150a89f6bcb44f7a2f276eab6989db6f17aeefa7459b6253c68eae341a1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      13ca4188c9f687c6465a01053abf6cbd

      SHA1

      651f6577c032d3248455abb19f1e4416cc7bf381

      SHA256

      e019e54a99ce3b8afa3de95ec227b891b0aa3cb2ec83ac7081096f0c9bec1bdb

      SHA512

      7cd4de7f00a984bb15a04d72483eaacc76fd342aae8b317897198ce9ef763131b10a00fed44c4c7fc03a616c4faed84aa7f5f34b10cde06f84c9a6790b35c7c4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3446a89ced274ed8b77ce1c0b270fc7a

      SHA1

      efe66a77f8449b9bc1e089098bb4eb5ac83c4350

      SHA256

      5cee7b5161da398cd7d97b2642c8a6e6b62aefd3955aa4d694e8dea1efe0ed8f

      SHA512

      01f790431ddcf818ef0dfab09d0c4344d0f6866d2eb48da6259e30de45ac7e05e7afb7a2ff83da45ac85eb99c51d4003fad4718830eaa6e000036ab79e1ccf36

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      0e5dc1d9d4f62d1ad4d3af5a5406326d

      SHA1

      d7c7ac27189d2550ea244952f8bf969aab87d23b

      SHA256

      a41822d3282d01f6e2c14f9cc75aa1b846de0d8732fa64c6f6d8f916cab81866

      SHA512

      44680d68c7ba93f3f8c283bf586582a2553b3380a649702a3a1c7fdfbe7b20be2828920eb001baefe258dc40e5eb1a292fcd0a9d894c7c22ce427969d82cc218

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ad3b0e54d6d2ddcb94370741990f2fd7

      SHA1

      49b3f08a99d0b6c5c7aeeaf7b68c6b5f179638c2

      SHA256

      3cf1d813301fc676f8c59a615b4af9f0247cd41868f0b5c1ff5fa6a1e1909a8f

      SHA512

      9d2d9885063b34fb29ca176c8031ab5f97c2988e6663855fb11a18aaa18b57cb49328b74ad21abde0a0e8fec17521f21b4f7a6bd0337cf27d5d7700a12b30f11

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      8cd391afe210e0aac4b36332e751cdf2

      SHA1

      260c21c540c309e2c3095b96acc8f7ffdf671c49

      SHA256

      761f1e9f6ed31d454980a3106f9f5f368b1b579474e5afaae1ecd7223a9e3b98

      SHA512

      c1c9a484e48e07a0751a0f69b852e33dd57361cc94da6bb8cef0a045661f81e9a1f00edb22bb6423c1e427eb6bc59edc356f6602a41da863463c22164bf8b51b

    • C:\Users\Admin\AppData\Local\Temp\Cab7995.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar7B03.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1760-480-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1760-482-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB

    • memory/1760-483-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1760-975-0x00000000003D0000-0x00000000003FE000-memory.dmp

      Filesize

      184KB

    • memory/2892-493-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2892-491-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2892-492-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB