Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 10:46

General

  • Target

    2fbe81e04365ccdd67a673b29fec7942_JaffaCakes118.html

  • Size

    156KB

  • MD5

    2fbe81e04365ccdd67a673b29fec7942

  • SHA1

    46b3cea78ba82743266187e8d45bcfafcb9bc3a2

  • SHA256

    5652f2cc22928b25147d7a2961a34af4be30c9f890a5ad810824c14014ebffbf

  • SHA512

    8de38d4144c2f0b00d42f1d34b65a63ab3ee6787b296c72391c3ee9b34cf70733bd5e07e322c4a492039004eb14dfcfd5bcd62ea4e2797690977b0ec4e9f6dfc

  • SSDEEP

    1536:i7RTiMIubAZssyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:iVTessyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2fbe81e04365ccdd67a673b29fec7942_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:332
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:784
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2072
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275474 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2020

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2cf48bbc522355627b809ad41cd45699

      SHA1

      6db2ff665152afc3179f8bc59bb8e37c7096355b

      SHA256

      31e926d1006263cd35680ba8614bca82c88c5317182cd2760096dd1ff54335e9

      SHA512

      973398ddf091271fcf28cc58e47a67db26230fc52054500de8719689e795defe9e3841279c3da14e27ae9fdaaa28ba889bcf29c785f78df66522c6277746f445

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2ea2a8e1f21de67293469dc3c8ead55c

      SHA1

      71b6524a941e397c1fa9118388afe018a74b90c7

      SHA256

      b32d723018b4bfcc6e61050a16513e2356fc4ecd0802292cd49d961440154ef5

      SHA512

      939a5663d2a87162fb5d85e66eb99d85f0abd4adcc9e37ee9620c15fdf457ffb3a9b8bd3bff76fd12ee172983a42ba2f02a842a3f8859015b1e2da0dd206d98d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a83bf7514802cd8c01d38f2acb96c4d4

      SHA1

      f8a1a3d3515a0708b8b1aa8fe18f1d249478994e

      SHA256

      8763153dbf73afa55cbe32d0a6f922236956a016faa86575b4acff13ea4e6c2b

      SHA512

      eedf0e9199b01d7d9469749faa6d6b697891b48b7255696cfb4d85a9021709dd8826b9930c8e98273cb033fb3f96c605cc76ea4af82b16ef9006676cbb87ffdf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c72f69984177d3c62e2e5e30b04ade4f

      SHA1

      67bf2f8c18d674d9d97e6a8e88e59b8c4f4b0b98

      SHA256

      1baded63ce3bbd8f0e58d72cf51c704c8f7e2cc615dce4f9b8996286e77660bb

      SHA512

      c73f21ddb25456f1af09f1d070b2eed8e385e0e76a862754e3fe270d3817acc8efde8a9d50768619e72f08d63df8eb0877fed00aa4e669d3e3989a0cf24d9a82

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4152476502fa3083a70495789e827a82

      SHA1

      6986d50dbde245f6ff3294451f8f8f500c5f01c7

      SHA256

      0b0982a4f9e7f5c063ebeedebf4f195fb4757a34aa0c7ccbf344e4dcda911c8a

      SHA512

      b4625c4fc6ada10bb328ffb9b8bc1eb4265a01520869baea9cc7235795a18a26d4f7fe9ed69e21b55fd9b4d17a1435be09f4ae5d0b6689b0d594de681bfcce48

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7d86295db86a4034bbdfcf747a37533f

      SHA1

      1e7a2d3a72ccd049240334d0b9e96021df7f083d

      SHA256

      44bb54cf068be054a71ff97aabc6f1e1b94573f40c9480b5031bb78219027a9c

      SHA512

      a36bc15eea5ce04fc2f9c83691fe3515655411daae1c34b030bc434bee035f9b32ec8153d8eb3dba6613e769524510a791dd4f5828cdc8e17609e627b6460db8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      68455cb7de8b37cbb567496a069470e1

      SHA1

      88f0c8e3a5b7dbe4340e2dd8361f34946df27bd8

      SHA256

      74c2c256576449795d4efe54bf7a0c271a22d1887c94fef78461e84aaeb6d579

      SHA512

      60141c8882266426812b4fa468344b50b1316002f17213c004b47f28f2907f0356746d3bfe0a6d9d5e7a569215500e73770ccf39097a6af3f1f8618e01ee3041

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5110a9175634661f1d52a9287cb982be

      SHA1

      e6076099156644d094680a730b70e35d934adbb1

      SHA256

      a52bc069f2be13531bd815c0f3edca89862b854b256df57ceba610d46fd41c62

      SHA512

      e38cfbe15508737479e8d79f91f2db93812cbf28d2c93f66104f49ada7adf718750e6619ae10e17cff1bc7069f20f1ffb50b5571715aa9910cb3a9f7af735f6d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ce07eafb895552130f5379a3e4649d12

      SHA1

      27e052301c5d644ffdc0f3975eb8befd8c44aa97

      SHA256

      fa03f8c9ca64041dccc456fb9b866424aab62b7a766b057f4e1ca2d8c1f3737d

      SHA512

      0a91eb6d48cc9ed8593a906231bbbcf5073748bb2f663ec015f13ec3dffc0c2984c79abce6bf27ba68f995e14f22030b1cd44242b74d8150232fc09a030cc9b6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c157e6878c4847c4c7b54214c6a722a7

      SHA1

      8cd6863d2b31834067b33df9af32c61c86848661

      SHA256

      b1b5bc627e79b8ce41f96ae925dbad0b9ef9a320c0b0497f2ce3dd3aef33fa59

      SHA512

      822ce43dc08fb4330539fafdcdd6a81a60d8d131e5aa101df8f571f41a7f470db4c88d038ed43691e4fb2a9858281de20824ab271fc41bb045f556d733a61ac7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2aa701b802595ff1ff02d0cc4e2413e3

      SHA1

      9032d613a63a8bb61eb2315404ef91a5631b9852

      SHA256

      06678fe5e4a22a557c9ac02dd19c6071955252a5aef60c5f268bbb8839b9e348

      SHA512

      d44b1ea66a8a5ebc03c54ce3358bd733558d0fe07154e13c06cd1ff6a2f2faeea4692543cfadee69f2d3abdcad7259cd9fc6d59fdd9db3c0b7dc450824c51315

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ee1f61fd600f618bf89714dedc70432c

      SHA1

      f4beff51d6952f81e7721b1e6d44ffc07c1d2ccc

      SHA256

      4d06e3b42961baaedb1abcb656c07f199b5e1f5d18c9b375b54579a100c75804

      SHA512

      64f5723a418c5dc6a1fc88476e0e6d07b48457defdd69e4859e8bf7ba34d801db99a4c929fd6ad521a728d505eb1d4578ac250b76635b42b3bf099d0cb13f962

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      592e374ea5481922e5afce215f15faa0

      SHA1

      eab45f258b373a7d33ae09e8f638a5e5bc0b817c

      SHA256

      4bdcd137be5efa4080f0741f7a3b4dd334877623dc4918ab31b69776c459959f

      SHA512

      6f17b525cb8e8ab9d1cdfc9c376cba803465dd667e2393bf07ee12b0185758c352b2c1d5249350de0283b012f3848aaa958f176ad04d7787e018f1f2e0e5608a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8a3d8da95403788836c2f501db5c3876

      SHA1

      71dfb278344c867ff85726fa876f47c67d854512

      SHA256

      c96bae8b70d6fb68186b06da6edee34b240178072daae04f7c95eaee9237e9a0

      SHA512

      dc3aca263ff2a54b4092cad8ee7c596694dd45135696c88b70f370567d820ffb72711cdae471db2a2c7b5acc532b79a1ec05b29545c5dd8b9d6189c6553017fa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8aa65242eabf3d38498426041e0f053f

      SHA1

      23999c1bc56c81838bd029c3e007b8fda6b73ce7

      SHA256

      f412dda6a1e9aaad44a38340fbe56a5ecf62780af902293b7bc4555bcf754a23

      SHA512

      33e4ba3e7df1ffbba872206ce85d2fad0ad9098dd985a146a40968e230bda1ab9d3d1e9c99c4f14f806ef076a2595c02a166ed7b4e5319a97f69d8bcc82bfcb3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f28b6de7dc9e1cff4f6c9407e4a8fcbc

      SHA1

      4b5d2c4fdbc64300afe9641facf8601d3243f515

      SHA256

      6882729a90d3d611a55a0a0452fad2413ddd225ea8f6935b765d29e004718102

      SHA512

      25fa9fc01d319046157e98c3cde5ea8ed1330b971c3f5409120c610555e1782fb3e2d3bc50fc57a6f9505384c0b4c86a36e7807cfe978fc1472afd540b6f2888

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b680297c6c82be3f03029291ce3b86b0

      SHA1

      a62c278eb0868f5762282d4fb979f3d240ed79e3

      SHA256

      0861647d015358e71f9f93327b6cf228f17ac32696c40f9a91a2e8bb4cd68f3f

      SHA512

      4a4e6aac7237ff31b6db5e4ccf300267180d510f899d02cbb08ceca20cb11e48b962b7657bd185caf540d86e63ff179228999e07e78e636a45f57b28caccaa3a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      69233fa3f32e157273d87c3ddd40eb85

      SHA1

      872c943dad85d9f73b966fcd9d1961f409180623

      SHA256

      10bd577ba389bb7ab17b3e057af7232d6fb4a09693628d694b22a6f31398965b

      SHA512

      5067112198c18fca84298a9d1af7affafbcfe8869df7f3a75f94cabed0eae1cf918bdf490495e10df115f7f2982ac79b11914015c06f26ac5f4e5ee515954cd8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ae7d7831786096a41e8d1c53d1d41cb3

      SHA1

      d6adaf945e5afb0fa663f7877cde21cd5c741f1f

      SHA256

      f26d5785ccd8c10f33fb793ccdb55b9a0122f6f23c9f25e315d520ecf83289b3

      SHA512

      c28cf63f6276003cabd964034a16beebe3c34a46c4a0b0f48946bed72de14b1cec63d4a18f11c888d1a30d8a581ac50e1d228e1e9adeee0d158b21f2047917ca

    • C:\Users\Admin\AppData\Local\Temp\CabB941.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarB9A4.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/332-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/332-441-0x0000000000240000-0x000000000026E000-memory.dmp

      Filesize

      184KB

    • memory/332-438-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/332-435-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/784-449-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/784-451-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/784-448-0x00000000002C0000-0x00000000002C1000-memory.dmp

      Filesize

      4KB

    • memory/784-445-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/784-447-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB