Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 15:51

General

  • Target

    f6588af1a99179b88f041d26215d7ff1_JaffaCakes118.html

  • Size

    157KB

  • MD5

    f6588af1a99179b88f041d26215d7ff1

  • SHA1

    d952c90a0662c76b57a741850d4cca3eb16c8146

  • SHA256

    491efb81613d04eaeb0e9699b521d8c4183f2ba0a5db019beff051f1aba6bb1b

  • SHA512

    6d1cf5d2f3ff113583de1df2f91b1b256f4af95f82e296261b2d4b01c2152ca9a17857c52088b36363639dc0bf6c87cfb03e18342519ae41b5a591b5929ecc59

  • SSDEEP

    1536:iLRTVtrrmSyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:ilmSyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f6588af1a99179b88f041d26215d7ff1_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1724
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:603146 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:880

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      cf235270a81c2aec20cc7521b9900eed

      SHA1

      0a7d587287218b68cc19b559036dc88f9577780a

      SHA256

      9e0a655ae749cde497b8225f0b3537e907850a02872c7fb34cd4b4908dd58470

      SHA512

      c36e814965d812906662337303b56d0c847e6c1e56c876a032cffe001e229b0407b1c068c1b76a3f191407661372b06741b9678c81be92710d9611ec30637810

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      10e15d35c9dd56e1fa9c788476ecf8af

      SHA1

      238174915958e1983644dcf1aa62f04f9f0c93cc

      SHA256

      68187e14b4bc082783ace602460773ed7452d5affd83b7d5db7fc4bdf5bedfb7

      SHA512

      f3d402d563b2c6efd5402dd70f3d8196258ea525b944183d12c73c7ee57d40ea707187631c4c2904147513d5c059719d8217f40b87a730b3ab28119d087c419c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      54fba94e2906f03f42c1aca8f690eca1

      SHA1

      04eab97be86648ef65a93cb0d80c781023463702

      SHA256

      7bba92294ba91b2d374223458cc3052ff84f8e1ea529dc4e4d7ed32d346131c6

      SHA512

      63eeb3a68b2c37586b325da46ab4bc4390b556434f9f1412e0c3340b8e0c71362a64b505ad7c22cde6c248d8c51cf8330fd90ebcc321bded24f311de538b9b20

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b8eeedbf11cdfc924e0d712946c15b18

      SHA1

      75f7013bc8b58ff24ce8763c81dd75e08692152c

      SHA256

      675a3726c4d872ce8cdfa20fc05784152dce106248a7bf2f3332350735c82719

      SHA512

      df9e7b0c2f3efd9212b262723b956ba9e97c6e23ccdd7dc93f60b4493a05ab2f8181c1df0bf4c9ad549326fb302059be8a057552a67532f797e00976d22d6684

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f6dab5bd9790112840b928f717e12357

      SHA1

      123bfcdeeeed95365a5ed414cdde326eb4efb099

      SHA256

      09ebb1465075609bfb808cb7805555b9c8efa6ee27d1cc3821d93ad1d08c1b5c

      SHA512

      8311c48bf3fd2bdc3d2ade5037bc6ea1d2b5e33e0a10f1ab17e8a8809a22559d2dbbfb81f65bd30e4e3857615c75e7eb65c2e1436c89996055cfcc5657350e64

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c233e94392bd98df17aeff6153d6a01b

      SHA1

      2ffa1ad6ac38dabf6553c47ee0a01ff1ccc16921

      SHA256

      a6cd86c9419ceef18fad2d14608084c688b99290e9b9ffb855d3a36cbbd73551

      SHA512

      f5768c8df304ea9e42f670015df55c5deaa7e689db4932234277865fb7e7df7bd9326b7f3412f529dbee8bace846a621526df624bfe9c38dffe5fa5abec9c085

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      13b573263ea31b0e830cdc59e4df57ff

      SHA1

      bf4863dc89990ff7bd77f86b09f9e6afa5773a8d

      SHA256

      5a5790fac29764b14f07ca137306801cd3f2ed0d9a8ef200bdeba7f2feb3346a

      SHA512

      809688a0f10bb6052dabd2cefc275370c277be6dccbc5905ac10ae36737934864df5ccaedb2f3582ad811cf366f2f307c8ea3f47ded8cde04c2cb6e839752452

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      42139f0ee1c0c933aa3613fca973257f

      SHA1

      ea5ff061d15ab70884eea4fac258d5b92bc73627

      SHA256

      138c60af21c5e53ed155f05a90bfd464b18b387bb70434b2b4872cd3b32dafd0

      SHA512

      70b77d272e3885ece9ec015adcb5082266cd58ca326b9d3cb5415e5ff0d96317d5e46ea4681ba195731f12a23fddab5deb0bc7af057a40b413db6ab7c9ebbf93

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      55ea06ff3c874c8ccb87dc435852f3ec

      SHA1

      b74f91e7b1585791f556df045b9c0eba6215260c

      SHA256

      3752882a22075fe914d32d32b5cf11cbd7be138b5842288af28cbb898c8a35b1

      SHA512

      e93b6c2694a6c56ef10a433ea971ab86f7255965f1f0ddf909262fb1b686a31f72abffcfe5f25af48fbebf4ed7a7ba8a80413dc90ed64b89368e8f0d115bf7eb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1a57269d6011333178f871415805fb31

      SHA1

      4cbd24548bf1b2963d9fc21da9df93706aa24704

      SHA256

      7a3ebec5cbadc44bf5d86deb5f00e048d7fd39265d46da243480d9db8a9e303c

      SHA512

      598d86fd15b37245e254433654ee2a305a6221ba0596066fb8cc3166b7f5329535964a3232d48a52d66fc41b2de662882ccde5381093ef979bedfd6e38fe2971

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      118dfac97bed0f4e7980152ca7ec5038

      SHA1

      9d506d5040d2b899cdb14aa63e4ab84798f17f3a

      SHA256

      96a4b87c247850e9959bde3bb71ee402027fa282cc6b2f0d0f7d29707b137202

      SHA512

      dda24f21f0f32184a281413fc4faa1bf82ce093fe3a4c85e03dea1498f7eee5f6a88f3487d6c9d2eff31729669ab14108ffd456ecfcdf0014c37909baf666d04

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e4d0e32826a60a0668c1d55c9d0be949

      SHA1

      4cf770aed7f2bd5dc6ee70c14489f2d9694baa2c

      SHA256

      cae43730541172258e6ef923a387fbc98211c79a68fc1535aab239c5ca888302

      SHA512

      86d377eca7588f15ca72a37fde0fa804984c9ec468f699c6d3b80fc4622099a784d24989085afe0f3930a2d4c96bde0f24c2faf42e9227c4650574dbf3c15673

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      77818380f2d62ac081f980b056d711e9

      SHA1

      584a5f8cf4c7da660b2deb26da889b800e553465

      SHA256

      8545c4c447ca2008ee406079c6264e6205cfbe8809af277278528bf53483f7a8

      SHA512

      5fcdecb9262a5b3b3ff8039c358f1b0cb367723e3c79425c886a60ce85c56f0863fc87d836b9330db2d0d87cb59f12c7a04eb107008b853e90c3d173e91c830a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a7b744d1aa3bb0b7af3d7dc5bcab7896

      SHA1

      34f6d091ba2e360cf2a5d8f890a7a8a22c40dba5

      SHA256

      dc0491c7c0031ce91ed8e8e3b7a648791f388c6c3ffd49c607e043781660c501

      SHA512

      8c797ff491f7f888678c57f615b1daa759240f1190a65dbdf1724b7dd0f8533ae8cd93b55ec805b1cff9610b65441744fe8669b251d0eb187531c5d7a42e9305

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      fea57b7cbb965e29c20c0b150cc9d1ef

      SHA1

      8ab72cd5898ed1f6539bd844116a6e9cac9d6238

      SHA256

      857c79b1cf95005e60986623c8e33f0e071b252a0f19bfe67148301fb70ddf8f

      SHA512

      a003da170458b50df54e2f8fe888d01fe384f4f1dce31077db3616312c873f4c9128c5cc5e1fb16fb3ec86076a0d4147b2509c586d90ea2f155e8287328b2a18

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      0d70711a03d26556b5a87d2506ca8034

      SHA1

      5166950ca87c93add6bc01add15126d1c214a389

      SHA256

      6f19f94751e0ace1b47f8b6464cccea6dfb63c01a9de15f8132ea3b20cce66de

      SHA512

      f25018880023dfbb6f680596d492cce480c4246e63e7c6ecee3bcbd9436924e626a58be921ecd34aa78885ab39744a31b5ce069c1ed18636dee8f7786cf1d996

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a98ecdfdba87a304d67e3860410b4713

      SHA1

      1385757c36d246b4effcbe2d0a4405e726ac3a3f

      SHA256

      bbe1b77b3a29e89c31109e117b50b2cae32442f4bc140f9be5e46f812e794528

      SHA512

      9e0b27e24ca02920ea5dbad389ab065ccce70558b555ee89797336ff36908fefd8a4e39e01553c806b42c9d900cf75b051f12b44d893ca43327eb82ed46c0319

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      67413e281b3cbe9689b5cac1b0ac0376

      SHA1

      84f3c825b1e87a48c9c07fbe01ddd359e0a70245

      SHA256

      4c2d78bb2aac34cd829435dc18271bdd64909ed40c63f797a212e0040177fc84

      SHA512

      c26eab085000ca7111e32d910fa6bdbb2b6732cf1fadd07f3ae3640a1bcce3521f0887dec4528248d77e972f09507a1ab3236c8b6296b1b46f6d2ceba1fc3231

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      22ef910d971b026f938f8da2f02da880

      SHA1

      470a6031a2401f4b1af6d866792158c4252d8c8b

      SHA256

      633c946139332436045c93b4c28e730f4bfcb5efda2bf6ed766aace90364e2dd

      SHA512

      2ec25cdb0ca07a825830bcd488b987a068213fd32c9fae8f355c0e6a4cfeadd94a76d824c8bc19def9ad97e3f850a0f96d5ced20907e4599d97b6f7bf4924e6f

    • C:\Users\Admin\AppData\Local\Temp\CabB839.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarB8D9.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1624-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1624-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1624-435-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/1624-444-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2112-447-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2112-448-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2112-446-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB