Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/10/2024, 13:48

General

  • Target

    185795dfaf626cf17e56fbeed812f954_JaffaCakes118.html

  • Size

    158KB

  • MD5

    185795dfaf626cf17e56fbeed812f954

  • SHA1

    dbbca62c8063f10bf1eb62e5bf742914e3df7ecf

  • SHA256

    6bd3c8334856aa09ec0c266127553331fe8c468d35ace679ee3bc73d1694abc4

  • SHA512

    4db64f928405884c48bf406fd9bbc773f117c5fc0c37d08baae7de5a5fab544eb088067bfd024a25b8fad6eeff063725a9762e02e3d86b49790e1de242b93899

  • SSDEEP

    3072:iBmo3EvcWyfkMY+BES09JXAnyrZalI+YQ:iMo3EUTsMYod+X3oI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\185795dfaf626cf17e56fbeed812f954_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1048
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:820
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1744
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:603144 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1576

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      588d7079b3225510a2061d14727795e3

      SHA1

      4098677dfbadfb86ad511f24b57b2d50b121d6dc

      SHA256

      0fc84e7c621474ff7a9ab9c33f9fbeb2301c7481121211920c533406ae989b2b

      SHA512

      0d173b78a872c53c53ee35f5ec777eb99f2e202d6b5e1c42dbeed8ab71aaafd6e8ab35abf5aa4275ba4d51b89b324a6c6a20740a6de6b2124bd07cea896d2071

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      efcb74c19148546eb0b8d095e8606f90

      SHA1

      4adc2743fe221e51969da8bf6d39cf0f313c30df

      SHA256

      e57316b9954db7d68856713a3565ae5989df707f5c4a9f78c109f3951b83b7fd

      SHA512

      0b01cc9f8f5558bcd6616cc12fb5e968fa567a9ad4c31b166bcd726b97dca1bebf0972fc9f950559d167751110ad7b90d38e4c70bbad0aa256fa8abb0e4669cf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6eb01c7175f99e0965a78f381342fd07

      SHA1

      a35aa4f59d37278c494813c5a0602408ce7d2844

      SHA256

      c166c7e07db8b48baa52bd398183e6664feed227afbb21878d74f621e227e84c

      SHA512

      e09ce9749fb1c4501f8b9e83d86a9e73623bf25ec228f74be1091839b3815d18ffe4c475121a71bf6e9d3aa90a8bb949bdac7ce850ef26850420f4f3a057812d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b9f1e0637f3b9f28724e34d1b109c736

      SHA1

      3576ac08246a45e0a10a34a7c9192beae50d0937

      SHA256

      2af3c572d8c85e97fafdccdaa90860a8a80c1529365e13a42fe6d9eba474ea91

      SHA512

      8753ee4f6f46dc04fd8b661a83749467d02c178512427d75869d480cfdd840372225de1a93cb57c570a6c829958b2c3b157e42d9a2406a1f2021c5024e867b00

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e43a4be4503390288d1e79fe6f4131b1

      SHA1

      ef34838802a88f3425f0d7bfd2baa91b1ae9a744

      SHA256

      7dcb07bfb889a1d8a441c7be5227a1637af4c011473cf2d322681684dc633670

      SHA512

      d2dc3827d3933d55b4da23f74ae06f2b3ed3862a83ca50ae2d4fa6f9bee61a8200352f0b4268ccefce4c1facfc4e34ada7b8f3329120836853b1205efaddaad8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      911972c82f01d50dd115252b4c16d0bc

      SHA1

      8a52549a160269e423d772417b63b4e56305be17

      SHA256

      a5df668b1fa2e1231c82d57264a22ada85c95705344a1d163c435897324ea77e

      SHA512

      b8f8222773531ecdaee2d9522ad655097685a8554e59671613ec4aece66f6b2695c594e540edc56ad0e24cc1d9a7cf5a57dfba9b292ae3535ac8ba951e59f7c4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d3592c6ac52f2d73eeb0ef18e0516a22

      SHA1

      83072667f3fd4db09e1602a4a359954868575f00

      SHA256

      536cbf786b7445b8e9e8d6dce7f05f1efebeff66d7f3eb99016087247e6cd882

      SHA512

      fe51fe5e968d4ca58515fc01a4339d0061fc828046cad911526e3305ae7732956fdfca852691dd0bdaf21072f661e615580b597170654154db99a58744e369a4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      edd5df0d88bf7a7a112e8706e27223d4

      SHA1

      e1ff2d6b608ef4b98e4692ca2fce177a8a639147

      SHA256

      e22068a6baf281d15775560388e2ef1976b1918df1611e1ec2544d27ed29793a

      SHA512

      ff35dbd988a3e358abe8cd63c3067d20aa037657e885faab0bb521de71bd57f4d6432ba8bfe6ba9410dc057ad234319e9028fbe416bdb00c3078161a2e1c357a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1bda3e84c4f130e270cfa1550e2b2ca7

      SHA1

      b68c7c90af51e2bb9b92e10f2c57b80797bb0652

      SHA256

      40e82904a84917b7f20e5f641573a8a75d150876e9c71d8cbf6ad1b316c3ff7e

      SHA512

      0197445c9fb91154a943eab5cb2cd8ac455d5a97f0d4c7987b8aa0ae29203f6d42b9d86ca428b5dcd2d9cc7d11e656aafdce1a28a000c7014ac8b1061ae7e070

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      344609b9e113f1769f95611e1f851b44

      SHA1

      6996d7a23e7c91370a936e9132aa851912c5e885

      SHA256

      936a267bdad4a45731808325465eea4b48a87b1516f3547b164c1bd5a681d82a

      SHA512

      21f71e2c0437108826d511cb94dd91c5b4e8076314e0d2b751e21b8434a193858650eb5d63968ddfd38e8753cde89beca21c39803f37454e1e6f4edecef3732f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      56cdf42a5e71a1cc3f098d7ccd7f9dd1

      SHA1

      5a79021da31ad578c87433b2fdafea772fd347c3

      SHA256

      f4beafcdcf25c57d586de9c67b4b033876f77fa999c707419096e223927d711f

      SHA512

      c0cc179a1dbe3922e4da586b833b1916a52520801f586b4e048c1065d7c60bd5e2e90d00b7d8f05416b51d4de4bf3c1c80151a1360d8e2000cec50d318f10cf9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4fb5c9a001e345da2791b53bed2ae2c7

      SHA1

      e62127edd8e35598e62fab1c4bbdefd1fd8d1284

      SHA256

      768fbe6f4666c7ebebb5dd9ed228cc63f81cdf6f605f5b7b9ecda25be58225fa

      SHA512

      b444f1cd065d322ce5de09e75dbc229416e129446445d1db8da073818910172037fd4438ea6953aacfb3e32278e5c8d31e8ad72b2a43ac6f3b08c516bc67584d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b80d1fd434169ff972bc86e8562e7e4a

      SHA1

      16501f3046915aef8e76941cad23823b1a796e9b

      SHA256

      ce6ba65b39a5d8a4adc4dda9915d83096b325f4812204581c689673594f3a9e1

      SHA512

      9dd1616533dc85b0d6d4dfa5e11f9f1d7b1008f38a30da09230880693279f8b012dbbd697ece92adcc43262a7310396bb3f5d38de45077a280c1b333a02378cb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b9a18cdf21d01dd2e94a3139f5805cec

      SHA1

      be7eb9578d6ed2b4366ad4eafbc83afabc05bf00

      SHA256

      c42a5603d6d776ab9f8f9e8205154e9c0174a717c4da80c6a8d0fdd24b75c44d

      SHA512

      0ecd4e60258c3f8a686b51cef1a14c65eea2a8fd1673275c48b1379c846eca18aaacb35ef832582e9ee474b76f07759826f2e4fe5b10dc510c3ebb299a31e915

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      fb914b592455e06b096c4315ebda9bb4

      SHA1

      d279a8214891ade986fcc4d7ec1714b92167d2c8

      SHA256

      7135f9b3752a0134b221215619a2052bf9cef7887f4a6f698b7ee7678896bc68

      SHA512

      3ee76830ef59a54aefde0112da32c88b5821c02abf737d8a72eadd893320179b9c9451ef7472c553f44edbc7eb93717f6ac41ea5fbbdeb757947420c5e7a182b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      97a4b4577941313c00cc40893096b67b

      SHA1

      f8f3fb6c8a4852d356e4f081a82bdf9911a95b7c

      SHA256

      ea0710571e4e90165f165f61adfd5645c3518eea79c887e91e2532d90c8b74cd

      SHA512

      e7ac85e2522aef0f61e852ca6066808a71fe8d152197cdeb35d740f8aa094f22388478314367cc5920b90700ec220e2665c559734501da0ad7979970c0592e4a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      223118e712c3f49d51fe09887a76b805

      SHA1

      b659d6650a9cdfcf9dc271e56ec168a793e1ad55

      SHA256

      e1d8046fb9a7d929aacc91749f0836e6c8ab0bc42cf3726a5f9b37e7460d14db

      SHA512

      7efd35e6109400ac4c02270ac5c918c90a84e93fd4193a6ce728aa9741c27e94d18548b72c94f58d0ddb4e23147b93b9f11e62ff24fa5b9eb61cdfb7a1858809

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1023450e88766d468edd6b89108e2e96

      SHA1

      3ade1720b09d41f207ebb04499f4a6ac790df74d

      SHA256

      bdc9a15f6cf58ac2d529debebbc5a849f087a65e6150d61919033f6401dfd6a1

      SHA512

      e8560b9439a2d53dd9f4ad22529868710c1ecdb6313217c2bd18dae56ccf5551844488576bf4adb679f240b22f992688da2438a7fcfe631e8f96eb156aa2f026

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      defd5df3788d3f6fdcc89b9a48dbd442

      SHA1

      fe1a6bfa9d5ae26db249417513d545cd2cf712d8

      SHA256

      ec2004dcbd820037516fefe30354c52c854096cc7062af3dd46cbd767b6da1c1

      SHA512

      8e246a79ec577e7f81eeb55b9926746aa9ce23d25bf20ece80f0eba33644b7d69a35731785897297d4815cbc379490180820a6062029ab8140a6a6c6f55dac98

    • C:\Users\Admin\AppData\Local\Temp\CabC93A.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarC9D9.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/820-447-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/820-449-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/820-446-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/820-444-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1048-442-0x00000000005C0000-0x00000000005EE000-memory.dmp

      Filesize

      184KB

    • memory/1048-437-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB

    • memory/1048-436-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB