Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01/06/2024, 05:03

General

  • Target

    896f5482fe7c06ed423f48d6c09102d0_JaffaCakes118.html

  • Size

    184KB

  • MD5

    896f5482fe7c06ed423f48d6c09102d0

  • SHA1

    b7ea6c6ab2d48ea6c3475df66af711607ee16133

  • SHA256

    6e95f5be2b11b24aad8308e86103d3c72cef75e45ec7316481573500083663fb

  • SHA512

    f7997130d897176ad0a0723b50ce86337f72b9cde1928594797d504760c75cd63b7395f4b7f526cac9917dda30d5a0ec49edfda532f8e4f17ce57b0f0817abe0

  • SSDEEP

    3072:SV2nyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFis:SV2ysMYod+X3oI+Yn86/U9jFis

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\896f5482fe7c06ed423f48d6c09102d0_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2444
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2548
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:209937 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5ef4ff334164fd61a927c32bbb27b68e

      SHA1

      50ad18c7aa472808ee130c8ae1bde24c11861bf1

      SHA256

      6aaf80980a5be031e49cded6e383214e30c775dc910cc8996ece968124e5e527

      SHA512

      6791564677d4b0feebdc18bca183e15b56e206d6da8dfcbda59753e7c4353d6f3ae86f1f64c914d2ea16d7cf08251bfa78a270470aad7c23f505674b2723a50e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4168edd77ae53a1c5acc8ecb183e13e0

      SHA1

      5721643e71e8a42c80dbafe0153a023a6df22573

      SHA256

      bf7979155bcf1aa8d71871ed0a9663d3b0fa90024e6128deca4aca93c4967912

      SHA512

      35c2ecd05bc18fc2783991068863fafd76924c17cdc8597c25543ac51429257d683957f0e5217498f5d5c7c1dd29bac8c9463ab1b3e1d8e9d3dfad20d826c728

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d2893a598f9971a4d1a0d224e2289899

      SHA1

      6a2c4c857f2561a1efae95675fcf5ca8a1553139

      SHA256

      144ee448948b011542e316ccea6818d74b69b8bbd0a6a7841554f5f128ebe9a1

      SHA512

      bacab6b3357d841925bb51cedc4d3e8a4fc34244f19bf1a90dd804f80462998a005fce4fe31a254095212c64a3680b195a5a9ac8c0bd6e1a730dbfc7269a78de

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5ccbe0d5c9f3cdfa44a6d93197d668a4

      SHA1

      481f42612df371f65653c9cf51842c9e46e1f5d2

      SHA256

      cdce5c79ea3713ebc84de0aa9cbfb29d3ce96053aedea55598c8c1dd78a54f53

      SHA512

      dbec1443b62a23d088f769f66291fcb1ea8d152e5cf333a25ef096b2d26969319e8f0af98965f73542388456b88f7afc55a70060cdb41b4908a6f776108cbf13

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      728073ca9e7f85bc52ae04eb755e0e05

      SHA1

      704b65bd167fcc7845252af2163bee751d134a0d

      SHA256

      acdea5ecb609abbab0976e9d92a0d0acdf10f56ecdcc11d306f0858ef7b67f7f

      SHA512

      06bd2118e47acf3f49bb21f357653e9020efe98074b5684b9ba22b2ba97d1bd649b92f3ca410b05f72ae9d3d34121f17af15df197533eb03013479eee661e5d0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1bfb18ff0ec7797a17a1d07794eaf3a0

      SHA1

      04e258296486e000bc9f0d36c75592677a320b0e

      SHA256

      40a5729e6d84016aa22cce5c017579cffb69082a55c0d2e8bbee5bed2768c82f

      SHA512

      353378e0bc836ed38f0ad8a205e78a6c7aa8790c3b136d3e65c2c981a38d3c71394384d7d705d6df9518b3a0660882676b52f8cdc81bbe0f25018627f2f46141

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f740721139160ede8b605824dcb0bca5

      SHA1

      06d18c5e78efcaa7e772fa8c312e7ec735d16d79

      SHA256

      3c8f0519b01646cc76827a52a7c1090b3ef2a5298492c651e83e6ae4073512c2

      SHA512

      a45fc41c6436814673acdbe7db5b028e1aff375015527c620234c9ef08254614c2953167b411bbfd69d6b195596ee67bd2f4c5791adf35b994d380496cf0778a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b5a1dedb8728c100f11aec3877e46088

      SHA1

      65105deabd4cf9f5c1b8338e2c230992c1faadd3

      SHA256

      ef6652ba5c19464e352e984d7837df8f0c7b2a36c451cb73df02b7925a27b2e2

      SHA512

      6f0979602acbc8e8bef1956225cc174e896bd31755db6f4dbd3ee37ce51c92e49639ddf125a7c0f44f7d0822331788344ce57dabd4be523124a2e5bbd9378b89

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b12a434498a7d1eda97bb1b44eb6d577

      SHA1

      d37079a3c7f89179fa257ad2c248945a67910736

      SHA256

      6409dbf7a3d09ffb79dcc6a9ab4d21edb29e4ab7633b1708f56dbcb7ba20f1b0

      SHA512

      f05d4efc68861c8b7da447197393b1fc7f739c69a5109ae0dc4dba4d19498b135969ef16aacf8bd1136d113fd7b4c25b0e82b8c267ae2e00e1a0185b13249cea

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7f068ffd9f72b9c54928a08cc2b8c857

      SHA1

      a884c1f4619e6b939896dfb462e9aa10b1ed35ba

      SHA256

      db70c6600efbfa9e0e8f32b676d32e7ed5ff8bd5cd1ffa07a7413553a42b8f81

      SHA512

      d5221048e4a68f1dd24aed8133bc76de9b30f09e112cc7dffb7e826d620d0ffde16e773db5ef7de9a168127063df65651136d1d376232f7532723d3aacc0aa81

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c43d7d8fe7232f11aa7cc5795eab047e

      SHA1

      6a83119cc8eb6865155de9510dbf4115f57df615

      SHA256

      4507daabd77aaeff230b64dce315dcf3263c4aab168eccc9cf61f64815d6e28b

      SHA512

      ea06458e708438a5b4b5320162be9b4d38c85e3221d7dfea1458e967897e3d543fcca50ec81a5312cc0c85c474473baa74022caabc5454f6e6e09d29654f9f54

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      be403459328b09c691ccf3de36ca0b07

      SHA1

      ec9d9f77ef92156bb1def6f1384281eb62ce6ae4

      SHA256

      f7bcfe9e52e0da7264c22853996e5c08264529f82b13f068216bb856a2ae83b8

      SHA512

      6043a48fc4078cbe12a65603694b315e4b8ae00f9a43c59c8f75d011011b30f40cf03030fc9b335275eb27f0f8673ccf4e89671a24b1912a9ac8bf7813be4039

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b2b345cf245d58d52ce9aa941858f0c6

      SHA1

      d17214049de0ebf1b36dcb8906a433dbd73222f3

      SHA256

      59889029ac56d31b7defbb9269fb8565d934a4b75bee399a724e4d75b27b0a19

      SHA512

      0f5d198538a622927ba105dc43d58b2a9893a141a5087561587591ed6e79ab80e9b03cfe1453e2db112b3d1a5711be16f3c39adb2e6aa22ada6de4924e660af5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      46bea1dfda1107ebaf64309fe9521e2e

      SHA1

      83e727ca42ab5dbe041c16dc122c2c138c24e4bf

      SHA256

      3ecb3e1cbf6a48f8edbd9ab381d9ae8b342cb8c598c8c09b531bc8a06f7f85a4

      SHA512

      2fbd2c0e65f3f3b43cdd9a4736fcf0e74dfb8e63da0a4275ca9ff9ddba29ac1cf8646a74e69d7183d03adca286cdce4f1cb6595728eea1bc247dac3fd2a34e89

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      520d9585a33cab798c86baedae20928e

      SHA1

      ae8838c2f2ef6d7111048ffc11f428cf909d5d55

      SHA256

      0a19510f8d43b9b34b34d7f6e80d3482eb6dcb3847d2f112e4e08686b6df820f

      SHA512

      304ce54854beac6b70119f9d83364586c439bee13d69ffc8d63b95d6a2bb9785b37e00f871b7cdfd68cf43d7ffc99c8937577ebf943573750c5457376a09de86

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      cba47f18718720502d7296daad1c0907

      SHA1

      a6229b1b64326c7547eafadfbf77dc93c4e4aa3b

      SHA256

      a2fd1d9c3841b6e3db7f30e226d8ebd87b7ed9d8287d008e5bb902ee237f1d35

      SHA512

      312bfbfe4c91c974269d35e05739af6f8fd841880b0553f48c581605df48c7789ce3b342d7b1074379c6a343448a13856e35b3adc4cf9645c6cfe091e6862b87

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      95376acaaaec4316ed9062e98b784b0b

      SHA1

      4feadb4c5362f21f619af3171a7d90cb7c323afb

      SHA256

      a1ec47855baed5917044785f2a487ac2b7b87e92f2a0ae19ac7d9331ed4a2743

      SHA512

      08d67cab6ba34da0231d8add135ac2f0090180044f27521552b0f7db9985f7b297bd0da5c9e289bc3eb3d9afd4e3a34624f411a0e4bcce67163dc439927ce97c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a2e6552e089179e1b89315be9963bfd7

      SHA1

      3b87fa6ebe969e29c93537433433147d9806d338

      SHA256

      1cc7980a91b95ddbd3a0cecfea07750bdb8a7f19b3fe3b8cc969e39a49e6b5d6

      SHA512

      2a61f22f4136b4989372681bde2c96d85d6905ff3a67d83caccae52e1a52e01adb3431fd69561971503342f4c187c1b6026b962d7709728a217bca9bee47a032

    • C:\Users\Admin\AppData\Local\Temp\Cab3239.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar335A.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      83KB

      MD5

      c5c99988728c550282ae76270b649ea1

      SHA1

      113e8ff0910f393a41d5e63d43ec3653984c63d6

      SHA256

      d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3

      SHA512

      66e45f6fabff097a7997c5d4217408405f17bad11748e835403559b526d2d031490b2b74a5ffcb218fa9621a1c3a3caa197f2e5738ebea00f2cf6161d8d0af0d

    • memory/2112-7-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/2112-8-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB

    • memory/2444-21-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/2444-19-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2444-18-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/2444-17-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/2444-15-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB