Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 10:59

General

  • Target

    fa4857d28614967143116e68226f7f95_JaffaCakes118.html

  • Size

    470KB

  • MD5

    fa4857d28614967143116e68226f7f95

  • SHA1

    131766b03e1068511d16c8355d9187e00d3500e3

  • SHA256

    a36f9ed3a72e5e4ad7752b49ec5b6a2bcadae56da4402bf2332a2030949bae3a

  • SHA512

    293983af4b1d8db660d8f1edd35391fb72a4e5d58c5cc07d403431eebf1d54fd767bc37ae19700cb66d38c42046969c75c3071e5db27708bfd132cc6e2a7fa8a

  • SSDEEP

    6144:SksMYod+X3oI+Ysa38eaqUquyHQcHC29+F6HT4ACpYU65aDCl:55d+X3dfUquNcZ+IT4ppJdg

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa4857d28614967143116e68226f7f95_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
        C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" https://get3.adobe.com/flashplayer/update/activex
          4⤵
            PID:264
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2908
          • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
            "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2956
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
                PID:2676
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275465 /prefetch:2
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:328
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:734214 /prefetch:2
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2636

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        f5f6b94c6e3c8fc1a609bb08a8084c4a

        SHA1

        7c850da12ce695fb56611af55663fd4b8f3c99b9

        SHA256

        4e8a65b4344478b90a7ba65cc372fb117e033d2586557dcb867156e573ecc7d3

        SHA512

        4db7085003ad91d834995a7f86984c26954b912b43483fce40969ea7695a62d61f2d7fc468f821918811c118e396b31db8476d5bddd9c8a50820b7d35bdfb0f0

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        5d78d7b4d0f51f578be0dd38600889e0

        SHA1

        0266c6e44b195f1a3431607a5a0e67d62f8343e6

        SHA256

        d4293f848c59b6e10963dd8530f8cb9612b03be03d802587447217cbcac56ad3

        SHA512

        347fe0fabd4bdc0fb93354481761ec15368696df1744341a1782a01040b4c23d8c334d174e6ad974837b7c160c64196624d6029dea86b2bf8ac8df57fbcee881

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        05f3f7a504dc6f91c3d64f78ba001252

        SHA1

        23d408e77df1c44bbd0223057909832830e77a72

        SHA256

        6b2415d5cefc947e92f98655aa75e45c0a8eeca209269a6f6f2758876bcb326b

        SHA512

        b087e962f5689d1f9b0aca003e0bfbf893cdb92177dada8cac4418fc6405c14bfa5f95843bd577ec0ffeb48c5b1c0b3265c921984d2c14765e82e4556ddb7ff5

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        2aa3469b21d0c2ec384e0f5ecb332e81

        SHA1

        18130a4eb9e7f4dd57647efe5a6f839d5a2baa5c

        SHA256

        786d5f95d2f5725035299cd9e32a9728d0f8ba510f2c6c99c83516fb27355df7

        SHA512

        003602a6e466f3560a5423b691254e8a7fb7fdb0cac2c1ce22320d7498316490122887a81c634e6c1a13b1f12b75bf98c5cc4174c0109b579ca1c9b87ac4c6aa

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        cd4323c66495da78a3995fd6e3879111

        SHA1

        22410d050d5bbeb0f788e5fa431438db5c415d0a

        SHA256

        e4910def399a44346c378d754ed3db02dbf4d236ea15cd3b5a428329f5d11410

        SHA512

        c737634837e3f1d327ab1e9ec526d7bd5061384c8cafd365ab27a00e36003139da89a11c97c52e3d0ab05d7e062db99372d9389e098e44bf8e91925b25b5880e

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        6aabaab2bc54725ac42d3045d310f955

        SHA1

        4b99365d402c11e7a1aa3b16519aa7126c30b016

        SHA256

        24d982fa820599463dcb77f61a30491c8afb80ddf4d1c6060a36fc9d57553b2e

        SHA512

        e872a5cffb80e9c036e34fbb84bbe22594e697cc5088b7dbac68ebe4e97e81f1ab8a7aa681f8472b500746ba8b1fea077e7b2e3ddc046db255d1602abbb170d7

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        4e95b7a5f7527ab0cc25362fa8dde4ba

        SHA1

        a89f874d265fda5f5f27dedfcdffcdbd579053e6

        SHA256

        2076722348453fb20371278506bb38d4ecf7a5af0dd2b1d2bcf8c925e3f0d297

        SHA512

        086b8165e6cbe2d22ed47276384eafb6fcaaaedc1479a2ff3c2a9e83f2cb10061ec20ed9a300216458605fa634ddac8a91c375db05f29846f8aae023f5121448

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        d12632276f5e73c1da5c1b718b176f52

        SHA1

        17287d158ddfe6d9d2294b729b68db834764e074

        SHA256

        1b77ab5b31b8b601e95bbf32bb591646f1e18ec6e790748c96e31b9658417f3f

        SHA512

        3dec4dec8429ded76178a536e6fd5f8c12b974694bd42a97674e0e55b2a3077c0d2a694d43030999d1555dbfdec88f9cf4b0fde59b942e97c05707ff9e81b93a

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        b14f501abe2ad30a3ab4dacc6ad60ffa

        SHA1

        f93fa38379eb57b22b1979874151218bcdc6eec6

        SHA256

        c0032aa521850fe4ffcb3c8e3ce992bb03104752a32c819091b50aa9924a30bb

        SHA512

        1892c003ff11e254d933d91f986d2c6b6e6aa5fb90383cf19f45b0906e7656526ad90fb98119ed676ad4efdd1b5ebbca988641739752b566cefb3253e230b692

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        f5fb06babac88edafd260282a3f1493c

        SHA1

        6b6c66645a90d0174df0bbcbbe3dccb4ceed5af2

        SHA256

        95e5526e85aaee3acd322cb66f7e95098ecf42ad708e55b68843e50f93207afa

        SHA512

        686d6c11c568fe945a4f074b12a49a44492be3ae6ac459364feafaeccc56c38ab84f7269098db1f5243d146a405a5caa9bf214df601f7f3a2513343a9fc4937b

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        a155d97b3d5a1e543e14d9c9cbf74e61

        SHA1

        8637d00092a83308163fa257d7854d0e0d33fc9c

        SHA256

        e9e6d6a80afdc1dce9cafa3315777260b2e4256ccf19fe4591cc2f1a8a875823

        SHA512

        cfd0b01043d2e395817837c4eaafcb752a07310d9c2af757861e4afc9e906022a4e1428bb04a93e91bfd3e1a5653911855a201da5d02cacd969fefae31af1d48

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        5015a2fec8a31c4a7ee868d1d05c82b7

        SHA1

        ed21be85da1133725a6847e453991f998fbaa73c

        SHA256

        3244711010f527bff691900110cd692ea0b4fb089c36878b5e5e601704d83fde

        SHA512

        bdab819940af0d1ce128e318499c1685fcb0fadea7bb7bee0434e5ea493b8c4e5b81344014a31f84ab0924004a3a9cbb9030b0a58a275b4609f44eb80a6e970e

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        2cf93fd4415cff6db2fa797c41c0e1f8

        SHA1

        2ffae02d060c4a93a7fe4f42191998a360283505

        SHA256

        ec96866c983736638624cdbbdc704a50be8870480d001d6b415c385eb21915f8

        SHA512

        19860b9956aceaaf74d7e97c3c0e927505d090bf6ddd446a223dad325ec9ce2dfaa9fc499ab8416e6da155f020513f7363d89db367b632934d92c857e629672a

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        d44a801b16a8222ce5bde14d0ca85d05

        SHA1

        8cdc89c113f208c5b71c2d251893c6b1649d205f

        SHA256

        4644ec188173d86ebcfbc1d72b60d1a740431cff8600be01f6e95fd5a5e6fec2

        SHA512

        53528e323b75e23d70c729fda9fc38112fdef780f2414f77669f8ba08269b4d8fff4bdb60adc7b2cdc50442adde922777809fae663fcf6074d422b232f560532

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        a05994b60b33bb97d3b0154234f999e8

        SHA1

        f63f0941f46ace68bb7baa354874a2485282e2cb

        SHA256

        ae2779a749ac31e5f5b3b62c935116c30f0056104d3abcb0d82e06990d443ee3

        SHA512

        e9f387389c12efef4cb174321ebb6b7083b0771b6b47ea715aaf0106d735f812f938b41a297fdbc9c2bbe8741673d4f99d5f424c14e3f4f8aa6b134e78aee1cd

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        420b51f2e12ba29ae0633bc605b6279a

        SHA1

        9d04bbf6c96a5d9d486ff48f8f4c7e7aca68504d

        SHA256

        4874b17a7888247d97428d9a18d126a371f7ab3ba0da678aa0ee796eca5fa410

        SHA512

        5970c072f4ec553cd0ff015723c7565be2fac380fb59464800b13e76be062f4869809ffeb32cc38297b2f388b535235daa3dd138c10875365393c059de72d979

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        506ae07408f05740681313aa5d51e168

        SHA1

        59edd3bbb5ff9112fcb2c935a63b2358086deacf

        SHA256

        058a6d082deff1fdd3a48a6dfcc35bea95da81b121473f7ce6d7a5c91194eaf4

        SHA512

        cdf7389fbdfb79bd06891b12fa7b6fedb5073e10c85be3703d41935717bbd7816170f3be17731e089432b2e3c21b3ba3bdd55e07306ff517f4b8e038ae5e5afa

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        a044b54289db832b2f5d3650c6385b8d

        SHA1

        c7884ec6c89cbe8f4b9acca71e18ca910d27daca

        SHA256

        f24d9c9a4b776dc940e145718efcb0b1e11e4adbffe9b158a8cab42bd29a6f5d

        SHA512

        0e455456a6de7fe9896f746e0d30502b0b4f34db4162af793ac9a30d947b30b27f489a09a2ce066f957d9549b8e2053c1384d405554d2cc1d13212494f0d4834

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        30bb51961abda647722dea88a938c060

        SHA1

        c4e07611356a1bc76414257bcf88e131ff9891e0

        SHA256

        3c675a6444f5bf53eba00d4bf922beb8d56a4a36da17d9c14bcf8b8beab7c911

        SHA512

        43f2db9dabf1fd2a38de1d70739db0756b08626c8858582a464ef7cd84082c40406079a3e07176afaf757cc3d9da1e139529fc49b34d44b4b963906d86c639f8

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        6731ae1bae1f08ce929144a7d9d67a26

        SHA1

        b386c7d07a241f5565fc88da988afd57f8f7aea6

        SHA256

        07cd5572a94919de9975ed2cb4b3ccdc120958b374cf20b73d6f08b880459a31

        SHA512

        090d8bd40ebff2b5c56b3c25c7cf5bb2b2e95f6cf33e23cbb0895c1e4199fe7b4237323107b09a8810f0cb15723d0f388253ccfceb88e4acd4b47e1516913055

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        3790cb13768c78b56c0ba10366ec9249

        SHA1

        0faec163b14069160edd6993c6f1874c05e8292a

        SHA256

        3a9a06a45ac9256a99339aa50c77b960cd68a3179325e9f49748d3b51067d988

        SHA512

        9be81ea933d33802f7b12ffec21463357300b039c996d232c5a26ac8d7725c5652f76f002e294f911aa7eb0909d8312d20f3da9b700bd355a5d3ff41a73c15ed

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\swflash[1].cab

        Filesize

        225KB

        MD5

        b3e138191eeca0adcc05cb90bb4c76ff

        SHA1

        2d83b50b5992540e2150dfcaddd10f7c67633d2c

        SHA256

        eea074db3f86fed73a36d9e6c734af8080a4d2364e817eecd5cb37cb9ec9dc0b

        SHA512

        82b4c76201697d7d25f2e4f454aa0dd8d548cdfd3ebfa0dd91845536f74f470e57d66a73750c56409510d787ee2483839f799fef5d5a77972cd4435a157a21a4

      • C:\Users\Admin\AppData\Local\Temp\CabB4A1.tmp

        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      • C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\swflash64.inf

        Filesize

        218B

        MD5

        60c0b6143a14467a24e31e887954763f

        SHA1

        77644b4640740ac85fbb201dbc14e5dccdad33ed

        SHA256

        97ac49c33b06efc45061441a392a55f04548ee47dc48aa8a916de8d13dabec58

        SHA512

        7032669715c068de67d85d5d00f201ee84bb6edac895559b2a248509024d6ce07c0494835c8ee802dbdbe1bc0b1fb7f4a07417ef864c04ebfaa556663dfd7c7f

      • C:\Users\Admin\AppData\Local\Temp\TarB59E.tmp

        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      • \Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe

        Filesize

        757KB

        MD5

        47f240e7f969bc507334f79b42b3b718

        SHA1

        8ec5c3294b3854a32636529d73a5f070d5bcf627

        SHA256

        c8c8cff5dc0a3f205e59f0bbfe30b6ade490c10b9ecc7043f264ec67ef9b6a11

        SHA512

        10999161970b874db326becd51d5917f17fece7021e27b2c2dfbee42cb4e992c4d5dbeac41093a345ad098c884f6937aa941ec76fb0c9587e9470405ecb67161

      • \Users\Admin\AppData\Local\Temp\svchost.exe

        Filesize

        55KB

        MD5

        ff5e1f27193ce51eec318714ef038bef

        SHA1

        b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

        SHA256

        fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

        SHA512

        c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

      • memory/2908-551-0x0000000000400000-0x000000000042E000-memory.dmp

        Filesize

        184KB

      • memory/2908-550-0x0000000000230000-0x000000000023F000-memory.dmp

        Filesize

        60KB

      • memory/2908-548-0x0000000000400000-0x000000000042E000-memory.dmp

        Filesize

        184KB

      • memory/2956-561-0x0000000000400000-0x000000000042E000-memory.dmp

        Filesize

        184KB

      • memory/2956-559-0x0000000000250000-0x0000000000251000-memory.dmp

        Filesize

        4KB