Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 20:47

General

  • Target

    075d970413e751c09bc0b510130eff3c_JaffaCakes118.html

  • Size

    159KB

  • MD5

    075d970413e751c09bc0b510130eff3c

  • SHA1

    0a93b9ddee300b26db5faa1d963c9d1923de28e8

  • SHA256

    f488f975b1b696aa7d0640fbcb15df87b0b1598e4ab543beb218d345850d8df4

  • SHA512

    dd7d9eef60d8efab1a9a88ea879244f08e7dfa33cdc5a7e1fee5b0a8909be7dcc32ecedc40cecf96d78ef693bf9457e5ee0912b650fcadf2e8d5c85e88358a5d

  • SSDEEP

    3072:i8md7ZKhiyfkMY+BES09JXAnyrZalI+YQ:iFKnsMYod+X3oI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\075d970413e751c09bc0b510130eff3c_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1240
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2416
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:636
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:603146 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1860

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d255755873567430decb6f1cc9b83790

      SHA1

      14340061d338ca699a8489d7d5bcf7a0d57fb8a0

      SHA256

      db9d94877ea658fd1c7a5a0052acdba9440722ca7e873865cb1025fdcc080e31

      SHA512

      e2f52dbeeaa6b195b63ee03f64ff72fa12f19cdc6cd9c0a8020167c8a3d1defdb96dc264124b81d116f1e48b8a132005298934eb754493d105c58c89d24d3065

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      0f2e686bda5b276fe4adfefa696c84be

      SHA1

      66bb78bcda19dfe729329dfcc003dd4271d63518

      SHA256

      285085c4a8bd8c1afa6dfc61a02d5823ac937165414bb9aafd3bb6a7e7b3e398

      SHA512

      e3b6aa37229d50ed4cdcc7d52e2360670a722f1c0a64002244947a93e65e35fb9db5393389d238a94e225c1d74cdcbf31c868aa24c25b9e3294d8def08afc465

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      fa9f55c19ed7753d73345d5a06caa0ef

      SHA1

      e1d26f9a7a16d1d8f7e3172416df6a932008c19d

      SHA256

      4f0a9308566f6c26e6cf55dd8855596e1dd1e817ef16a870d1c666e021dfe20d

      SHA512

      e35a923a750e451a2a716b7a51e9df7e0b97bfeb027f3f907bd77914263b930257165d34b077a201affbb5e7cb965f4ccfb619f826dae26f2672c1603b63aeba

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d507504287ab095ce6ce9dce7a086787

      SHA1

      4698cf26a8b3bf8ba4bf49191a8a8d7122d3bb94

      SHA256

      e73215de69ee29fbd63a5cb7064f3a3ef22cf4c1045971a6c66683689df138c7

      SHA512

      5efbe53ba5dd806fe51508393264d35a51b4822ba87ce64c63ff4d804ffa853ae9ad02c94ab6a8b9acffcbc764aacf0428f7c9f560e7ee2d6b0d717a79cc294d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4b2e24c2f7281fcad6966c507c067035

      SHA1

      8f304c92b9d1a1815cffbc27e9cdce28452abb14

      SHA256

      9a754c3f502c3261585bf4bb581be09ddae658efdb049734f79b1b0a53bb48b9

      SHA512

      9f7115e4358101aa579dbe54d765b3c09bab63fb6d01c5a90124180a2e99d16007008d81c3215ff137e74bff14d09faad1c0b5e684d4fce55aaf6a5454730409

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8013c2e8d1665b9703f61afb0f5fa1d8

      SHA1

      f5b0fb0e1f5f490f90cd35aab5e690aaa6d97b88

      SHA256

      eee3e1b0be5a923d43305aa8bc960e20421f7012c3b0886b5fa0c5f529f3bd5f

      SHA512

      f2972aa4ea202b155a082561cfb6272e43c416834e5fc87e8e6a57b5388474a1a3d70f2f22cac93d9aca873aa40050a87172ff78eb12343d6ebdcb62c1439543

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      70991e47485cd73725e2846b4b75aa36

      SHA1

      c124ff79b79dfbf9fdc880156cbe4ff32ac11755

      SHA256

      a30ade9eb984cbbba841b851547ebe4e34cde659c822f51967a2adb56b755f9a

      SHA512

      e04f3256a5b3316c867735b60d1cec660f9f953d7a9a314b0cee90f8f18722d695bed221c2ad271dc54f98fc7f6a4dbe1f66a0a121fdfd5d865cab3b21fa76ae

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9bf1984ef9861d51ede70310f1cdcacc

      SHA1

      8ac8752348d1cb9e26f9bd863cfb9d33d0782d97

      SHA256

      444308c227188bfcd30893bb23fe269a545645ff2d0dfe91d3900a170b1ebdd0

      SHA512

      5157e65af456f76811f07561ebc4949bf6ea80cced4a06e68e9c956282d8eb54b74eb1e83d0208d5b15d8bca886859c0c6cc05bc292028910360370555f3117a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      269b1ddbf2dd90ed9ff99ace9568d0c7

      SHA1

      a3e11fe7ce90db8be36053d372d89f0a1328cd3d

      SHA256

      3a7e2771c51b1ddcd46375749eda323bece91bf042cfe7957905ddcbbd62f7ce

      SHA512

      c62219281bb1595e9317e6cf0dfa267aaedf83bc77ffdcdae99054fa279c65f04d36b742f4060a79247c1f399dccc2c49d070f357628f36c1818ffaf18fd2117

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c23d9a34a5d06443efb13ef81a09f242

      SHA1

      f453f7865fe7c58106de8af0952dfcf25c104e03

      SHA256

      37b34267a66c0e1eb7991ae30e6372ac07d5808d2402126859cdabed9b0236eb

      SHA512

      5979823d71bb6098a801eee779f06d9ea6f61690d91c4504b6ca147ae108f9a4e4590dc4c914c660b4658b414f2fed06ebee6b69f88485bba8d012d66a4ae09e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      cbe712800731091e13bcb0fcc1a05813

      SHA1

      7c4473d27295cbb0092389a47ac1642fcf29cb79

      SHA256

      bfbe5d63a934067302da48d8c56aee72a858598a1f8ac063fe51b84921730a0a

      SHA512

      7a7fb1bedd3832852811d91b60da207d2897fd277ed060d5dba83b59715ba9a429c441b8e704bee1c2b506bd306e7ffebace3639e3cd12ca583d11ee5519b219

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      61f595e7c6cb40378339ad197a54c9d8

      SHA1

      3be71a3eeb1b0758a2da590b963a0c37da573375

      SHA256

      234fa5a1adb32ba578f766855ec81da1b2bf106fdef4c12332275faa7db2d088

      SHA512

      d9394f1536f47c487795fc1b449541587f8ab990bcad579721ab29e50e7dba36739f4f6ce421381979f23cd3405bf72063587f5d9d150b43a9beec95d62b0575

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      dddaca57b163a8044764659b60f60c1c

      SHA1

      78061e13b08bc6aad111247a25c9c28ba256b1a2

      SHA256

      cc8cc46ee01cb7c75c13c3b954178b03899c729155d49d8bc8261a1c034ba2f5

      SHA512

      eeb2dad8d47d031f9ec31a0ef9a9859f23f4e9508da35ab5fbb3d3ac8c0b68e87c493cb8c62cefb140ad60dab3297798b7be6e0a556e86c326934f25e435dc17

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e22b876dbe3a4fe446e46d1d62048816

      SHA1

      c0cb04b5fb4117a6525ed932f1280c74342a5e9f

      SHA256

      d5208caeff2fafc1cac9b1867f8212f004cfbbb4f83340aae8e224ee1917490e

      SHA512

      602369715288577f4c032dca9bedb3570b0eaa5f8ba09e24bd7ced70df4973304bdbd7a9517a029e79c46c74ad0fda9470c15d025fce073b486d925c736856fe

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f8ec563e4e269d70c760660a4f59e5da

      SHA1

      4ceff12d9e420876e43c5f25e5fa4bc1f7bfde03

      SHA256

      ce8096b7bee184370beaa5d89ace072d30f80cf3baceff6f923ec0b3b869cecb

      SHA512

      cc755ce2a9a05c45ae8bcc4743667b248e291544751cbcf0538c6f85facad90931ec34e1e151103da0674929d8b00a8cf7b16432ba1534ae9eefac926ee251f1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ba3f1ff35a5f028d4af22cdcfef128e5

      SHA1

      56c99b62aeb2a6274682bd94bc74d5d3e74857a8

      SHA256

      2571ecafedae69f8ae6d29a7aaf2b1a53528012fab4f03bbd115ffa1bf957e6f

      SHA512

      cfbfe85840100368e4c9214877c37f1fabed6e33c0619327cb64710514e98bc3f322a863a1efe1693c96248681acdcfadd8759f5bfd970e0675ad103971d76bf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b9482b0de078fcc57b5731b6b507c636

      SHA1

      1cd17756fb3e3b4e2c75381368657605c71bb5de

      SHA256

      c9ee6c99d960e313f35fc11d3111a43aa56bce5f4f9fa5c26a803eb24cd66ac2

      SHA512

      9cf7bf6f8b892e1856b73c3b1480ba249dc6a5bc450078c0d7a1b7bde3a4ca3262b000ba8e9f33702d59b7c9526d5e357eeb55f49da64b071ff1e9da07c2e914

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2e9ca927b6b3dcae9442d78ae908fd29

      SHA1

      b1e4044976bdc61f9e0ed48f70845cec01e89571

      SHA256

      d14c2e7c641a5eff4c76134a79e12f5a2f86c2704e6418cb3415c99d18340ff5

      SHA512

      452c34149b368557b04ea04a673fc0df0e471c92d1a29b2bdb9a38b6f3cd5392cc41644fb233495ba47b0263013d01f5a9c0060390a2f6e55bd7827ed2114227

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      50bf65e5f7d7eda1bcf35b0875a94366

      SHA1

      7702e4f2127b792484e21d4390d18190517d557a

      SHA256

      3c65b66e08bd4f0b6401dab636644d252b733541c31e934ab8d853f6a1009841

      SHA512

      67afdfa04b86eb6b5adc5af492e967159b5c82f748cae803a19f85ab35c96e606ddd12f9945265c900a5468e450d5c9b66b1541f206084c314c395a9b29a8f68

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3095960ffe5e66d7ff7289e55a081c53

      SHA1

      b73c7b5f285a8addab4d530f1e0397a5baba0bf3

      SHA256

      b9123a4f33c8e043cf54f5b8dde949dceabba712c83c0efef34174b1e649e44e

      SHA512

      1f0a1d123979be10688273b7fd867770fc3f99ae60955739db714bdd9434e3b11980eb06e4b521cceb78b0ce2d7f43795741412dcaacb0c200e7359f5ae21d78

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6d70eb66322acf7c0b50c85a93f9e899

      SHA1

      52956ae10f4d86d125d17bb8dfc16dcbf88dff65

      SHA256

      92d957bd5870f8289587d29b7657182f09687f872accb417b52bc439879efb7a

      SHA512

      87ab6d25c1e2e13feb2f7c8545f35d39783c4c5687eb409eb453867d546e5e653dfc6b3e7bac1889cd1a823011ae0609ee9b451586a6e888d76363ad30f3c8e6

    • C:\Users\Admin\AppData\Local\Temp\Cab1612.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar1673.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1240-435-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/1240-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1240-444-0x0000000000240000-0x000000000026E000-memory.dmp

      Filesize

      184KB

    • memory/1240-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2416-446-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2416-448-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2416-450-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2416-447-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB