Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 07:42

General

  • Target

    2d68666b70f761f85e9f1875e2eb2912_JaffaCakes118.html

  • Size

    155KB

  • MD5

    2d68666b70f761f85e9f1875e2eb2912

  • SHA1

    013ffd99143a3cf614b4c1aff22225ff53c730f9

  • SHA256

    bbefa8001086de10252b61dd9572ed7122e5119297fc8bd171fed2ab98a6795b

  • SHA512

    dad669f65c573fa595e992def776f7a31d85df7da51fbdfe4462bc7f2f25b5adadb4ffcd9457c7123dee7ce5f8885e372d18699e44dd7614c22b96cc7f2bbddc

  • SSDEEP

    1536:iSRT8nE/8WyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:ig8RWyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d68666b70f761f85e9f1875e2eb2912_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2248
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2276
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:668679 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2936

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\DesktopLayer.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d32210ca44b6f3be194ec9ad15b4c21d

      SHA1

      6dc6cdf8bcd52a4d2985d9a9064e9be2802a9694

      SHA256

      9de021e903f3c6d07e03000b12f427a69cffc2c9ba678e9c5350ad56f9cf8d64

      SHA512

      408fe9f592724df722eda076afd30eb458731b5ed028b80de04745465b96399c3d890529e83bbdce05a5c18314034dcd02fdf4217bb4efb5b7092fa1f04717a2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a576e39572dfe5d26c83cb6ff75201e2

      SHA1

      b37caf27b5a3aa0122fb17c5eeec7e64cf0e593d

      SHA256

      90f7960c9627cb88d4bd399dd05e62c24cfbb0a1c543fa674630f123a1b5ad2a

      SHA512

      6952399ca11f6a2150b4d1a023356071582848aa3d8e011116eb3592c89de8f144cb01922c7b8c4b75a0be244afd30260e0af106a3e28b800d862007467f1b0a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      16ac24d84c190c043da4df0fbd85aa42

      SHA1

      703374c664422f4f8aef8fdb544a9594b17ae5a8

      SHA256

      f0d1e48b69e291fcb95e17eea67a57defffbd3289708141070253cb5cd5929be

      SHA512

      f62d2b19c4c6e0b697673cd469089c29b348d7b88b4df0dbe0ff9460a09525f66d9482ec97aabf3aeede60cecba6e6f1bda327c91b23768610c072265751fe25

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      29b0837fe56fd051cf97849c93109914

      SHA1

      a2b6b47258b4905c25d0c9b6c90a87ce03e942b8

      SHA256

      2812063cb80865f77d9a1fe9029406169bcbf32fdcde95c2650f36ea01bacd3e

      SHA512

      28fba5e5bb172adda5ac4300a82f70549bf1933c18c0388de4f6c8bc45c35d6e050541e2cc952a78b9a5e2f51d9feffba914871067d3a729f4de6bb21b4c7846

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c3232a72e1bc7013e4933c4be53ef04d

      SHA1

      56d6dfc7a4b56ddf1d4137001d4189c14fe8ed2f

      SHA256

      382da74fefb1516fe505339fde2677fc79ba3df372dc797be4f290e0b89cf2ed

      SHA512

      3d65bdee4098b8b31ea83cd5936c1beb9964adc471d72923dd6546b44310c352a2d6bb59d91de62b3e0a2cc576e974d55b2ad4dda96a4e156846eb451c51ae7b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f4f80f71484d9d7a4f08804ed490bcb5

      SHA1

      8a0db22b9bda6de17455eae111d150f23517f514

      SHA256

      bdf6e8120b3843ad41c3390dc06af80b8bea69a4d97819a4e2625c0e014c4b04

      SHA512

      fec197cf86eab0a43f9d1d4c0c62e60c003458206d65e23de7eb3997b385a25ce0e0e4673bf39806d7e9228bf1155749e7e9f1979ba4617d3ccc520c2bc41fe5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      49107f453c3adbd9ee520cf5b9eff8e2

      SHA1

      72ebe8d026fce58b9a831cded460915f96b07c2e

      SHA256

      7096a20f3ccc16cb59d085a5a1451d6a79ccd42710a4e6c3c819803cf1c42eda

      SHA512

      96ea6fbfce974afe1ad729c6b5d69d3301fd9b07d789ebc3f63609c08de3eed28f87418d3aca647f4f839dfe69fef5f30c1e6dbacfb575625702e1d444824228

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      584b841b0b5f8f5518e3ab8dc5a9c621

      SHA1

      f9a897516ade36cf5787dfc5fc62d1ce2f9d0152

      SHA256

      8d107cb57442e38c7bcc2f2dcda07ca707f3308e8531341af222b1716faae212

      SHA512

      bfeda859a7ee7e489fa30bb909b1cd22464741fabfed1b834baf82ee776ad495eb48c2a645b0d41a0f82a4220f71291d1470143ecd87b4ac714dd495f88acc1a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d1baf4deff1e37d0a9221abbb70cf1af

      SHA1

      c71cde3b4026217561537fef5da793113d741864

      SHA256

      1ed1a5b1505f4581ab1d16b4a9769f9cb6fb1996d31af3258c5ccc492eadad66

      SHA512

      10013606411e2836a338e0208dfbfbe2367e78a3393df97dfc29f50b0c086c8f35f74817d9294015c52911d4b9669b86e7e5e97725f79f20a09932c4de9901c4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      839f78c2706beb2402b3d6edd1d197d3

      SHA1

      dba79f1feeccdf0c8672d92b2bb5de0ef2b6fb48

      SHA256

      86512e82ddc738f112012822ea0855fb300d0b4dd100e70430445b623233e27f

      SHA512

      bbc6108f2209cbec8aedc126cf2dc27a2fba6a3ac9b27af0c64bf5d8489c8e3502f8d2c1dcce761f84b6a0f0b5677a005771a565b5978e5b42f3b47d6663e2e1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      56e7f357397bf89eec4b52a013924e01

      SHA1

      a1dffc7c870a1d5bebc700c22c5053ab1873e8b5

      SHA256

      ab5cf08d31b4319c6d8d30f503f88247a2e1df005a33225177633e4f06bf475e

      SHA512

      711160aa897151520a174e238dcb0130c1d591577d00b04b9d570755a21934f8f3f38b243c8657ce4da94dfd478cf4dc8bd10c7228e6146102330d499b1e28b0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      843e36a73d9ca13ac96d06b8e5b510e5

      SHA1

      558d343a80443b595e9957022b79fe06cd9e2467

      SHA256

      4e0aff7c926d4459538b79f9679a5f17e11e2cde621afe98eb827a86abdb526c

      SHA512

      0eb69b173c7a619b40cf4ee09779ecec40d9dde838eb77d71f01161a8d2d77100b279d6d85478b16fda2458995cf6ec63e36bf6b21b3e6edbe93d804bd2f8884

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      11ad250d801cae7f7f4a29508999ba90

      SHA1

      87e28b0cb8001b18cc252a89976e69b44ec0efc8

      SHA256

      599ceb49ec15ca9daf6d76d1f3d59ddfac5c29f3f54beadae803d70c6c91b1d9

      SHA512

      d44e508e62590b8e9e2a35f93bbb14043d18c47838fab86fdbe8ab8e869f5668c190cd8deb2e31440364a0f73a497d9803c84b4482c38797cd916f90e98044cd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      fe047aa132a5b6a8c9a2a565d82ec8fd

      SHA1

      1b0bfbea6be4bdcbf7db49cc53b3c6f073dc6e40

      SHA256

      df7509a233d283a72899ef8f2ad8aa8e4b945a3d987a856de8d1b3de33953a05

      SHA512

      3ce16cc6df634275971025acfc654ab560fbc283e2ec9f6ed7e18f350b3e30c45bf4c7fb69f90b7615bf283b014e2db8ebbe417a0de36981ed144c7c6ed80d07

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1517c2eab09f7d3309050be023b2126d

      SHA1

      accb405b0e65a3a4011415ddcf7c88af0d1a91f4

      SHA256

      46b5d2b61ad689704ee813bf47a1c179f28ada8455694e74fb037b943ccd97f4

      SHA512

      cd01cf91f6e4f83a003e200ba97218dc064f90bad61d2b547b979d3e08cf444ca323fa980ebe6aeb07302bf919275fa2b32a13f46edd01cde1900a0186c76e0b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ef28750a8a5fef7c9b74ac1b341250c2

      SHA1

      d4d3154c5b29bcbce36c0a23c3a26af6ff049703

      SHA256

      ef62b056fc3a4150348eec8925e6d0d42867969385733f43e617c93c2b4ba55f

      SHA512

      a9fb91d71aaab5d3c12bf8a13e436ecb573e22a0b83cd5dc5d40b9cb43ededce434cf44c684523cf1f426c6c9500e0186ea3ba6dea5061b8f6e18458d42e4fc8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1cb01cd56760a29433eb168263d1565c

      SHA1

      f3c3697fc7655b10462aafb8d8c422a601159ff0

      SHA256

      93eefdd35fbfd67ab5503787a2460c702ecf62a56264263dc671f9452ad2bec0

      SHA512

      8169b3f7cee3a5f8c8c10095b11aa7a8bcd02e705642ceb163d4c9457d8ece896b9df05bd86515f450111491a036e21c24963ebe31c4a3bdfbbeb22071f29115

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      03714eb02f09a5d94b77d508173e11fc

      SHA1

      0a1da7724854c9cfcc311d79605e0aecea96fc65

      SHA256

      96af654cae9f68c75d1ba181a87924fc9e58453c8f3ae0ed16c22dd453176408

      SHA512

      16cde54561acbf4761fcdae3755e730cae55be959b995165841e1cabe2a278361f2a3a20dfcff9a8da11e014651599b999dccd0ad1fba97daa04740636239005

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b4ca6810f62a5ba3d35256c7f13b74c2

      SHA1

      b9315415ab4c46811fe1ad80a8531ce23ced01df

      SHA256

      8ec5c71edef90132ffe0a7363eb98d9da975895c1cfb310d7fec6b28814af0a7

      SHA512

      55d62e8b4226e40f406e1b980dbc4bc246c1633b85ef51b91c66dae970c94d15a33a357b664a7bcae9d54e8fb56499c2d34d9da337025f84e36baa9a9f6bf91d

    • C:\Users\Admin\AppData\Local\Temp\CabBB94.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarBC62.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • memory/2112-448-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2112-450-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2112-446-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2112-447-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2248-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2248-435-0x0000000000240000-0x000000000024F000-memory.dmp

      Filesize

      60KB

    • memory/2248-441-0x0000000000250000-0x000000000027E000-memory.dmp

      Filesize

      184KB

    • memory/2248-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB