Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/12/2024, 00:58

General

  • Target

    dc493cd66f2f298ecc60a212d44f3a06_JaffaCakes118.html

  • Size

    155KB

  • MD5

    dc493cd66f2f298ecc60a212d44f3a06

  • SHA1

    301b914fa2e99494ea965580369fcc7f411fd34e

  • SHA256

    34f0d737a6f5eb6d12e4d1301cbb879236e397541efa0c65f6c781df37c80962

  • SHA512

    09fd380fc387211aabf6df1f70f8e76ee6d2e5544b3c2d182bbb536898b7980f52155a9edf59729845630e23f5a41d95f1a40679d2cf8aa5b3371668a911bd87

  • SSDEEP

    1536:iKRTwmUwq/O+lkA2yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:iIruvl/2yfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc493cd66f2f298ecc60a212d44f3a06_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2924
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2060
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:472074 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2932

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      454184587152b60137a5fab2c02d952f

      SHA1

      e09aab6784c2d6f654969d9acb3976bdeb0b2cbe

      SHA256

      879539c4a85ad832f875f214a6eec11f95c5c9b61acc0add9da1cf1f8ad738c4

      SHA512

      08c59c7515fb2e26819e64484b10788161721ff9395a6f6f7c266974a5daa1ce466e10b1f702b1526b8436b309348d086b021f0c0d1f6190d240d7fb0103db5b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6ad57a5a784c586f5df7e60c639a3844

      SHA1

      4f1953264ff38bca2b0da09a3acbf660cb3a5b4b

      SHA256

      9176257037d44f5ffcafc6dbffca7e3963a9e1c24c2cee8bc78b224217e8a100

      SHA512

      81c90049c977a46b2bd1f9783a9eac20a536e4030bae64778f7ce2dc350e9523024a70e3b5f23fced1b4364337f6793d7939724695a5ed72653f38c7fb498e2f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c4a4028edbcbdbdaa0d5d6fa86471b4e

      SHA1

      adb01a8da41648e3e49c0f2662407d1b6f13f3cf

      SHA256

      f31a2c707eebb55617b818da7aaede69f6fe50c6b719b1b261fc1f3125b2883e

      SHA512

      4ac053cc5661253c95a8e61c2af139cc2af29267cd53d5e5476b8ebb56cba963fd6caefc6ec184541c0e4d5fe39feaf5310517fed948543c948a265a37cdfc3a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      571909667495b24bc6df8c5187ae2df6

      SHA1

      7dfe757a916757f8d32f230ccc1475380b26ba5c

      SHA256

      0210a44fdd5e7afe4c7e04cf67a13ece067d0bf8e92ee2a9168dcbc349a80b7c

      SHA512

      37f14eb675a45e253ab93fe00024a266ab4f39c0392fc0447fa5a113a86ebbbfd85f38ca0b291600334b13b99fe08bbe1cce953d2bfea56e443be13dd5880464

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d9bea14da7aa340b53185404531623d3

      SHA1

      20e804b565929dc2fb435d42b04bc2776fea0b0f

      SHA256

      c7e7e89ed8ad6b8bd53e9dab9290e444cd1d8da3613b9587d49700ec6d98ed9f

      SHA512

      2bf0fb0b25022bbe488267ade2935c1dc0a9b2537b0068cf7ad5050d651a6128c7f635a08aaeb6a93a296c97fea3072aa4193ae32e45ca71133d6b4c5097133c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5e9aea9ccafcc8a4d59396a51d52a6d0

      SHA1

      cc4920afddc68e22a1ab6a6476c25f9d0fbd2095

      SHA256

      e33ed4c2de502d322e56f644a3dc7fd29c7b7ec0373ce065c71aac7ee1c7f882

      SHA512

      843b3300dbdcd86f63637bbf68257cb642a029497dfd654b1113dfd8a2b3c3f668b6268873cb04f890e62cdd7630170ee40ccf218b5658c1a22b7702c5bfae28

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      497fc4486e9f7b04622bd9f63753909e

      SHA1

      15224fee6e9d6c9f48670666060dba9e20fd1c0c

      SHA256

      0ef5ea524d790e8c72bb333e4527daa4f3cc348da9a9fe21700a3e9f97e4f437

      SHA512

      774cebe21af9a752054d0b55f22214a885f13e3b9f33a2b7349d84614ea1f9da9533df13f7d92b3f3c23d72e29d5e6e1eb5be481436fbbb23c4e30d39e95962e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9e426619ac63bad016720e300bc54e1e

      SHA1

      4b3325e8d9d1a08eb1bbfb9e80fdd89cac006303

      SHA256

      4ba55d44e765d2f4e1f342ddb6581c0db598907e875bb1056e15d6fa90579a1c

      SHA512

      edf6244f83bf99ea603071f7fb4b210f49ef23f14a8d497cd546bb55441c66221360ecdfd84c1198df25ed7a22ffd7741165078f721e5c78c13679c4311ad25f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a96c94a9dc0ef9f480ac0b8b572b51e9

      SHA1

      fc445793d905c532c5fc00e7fbf87da6dc8d246d

      SHA256

      7bad8652c264ca2f266020cfb77169a9c11944e73a3187a5d792f756769d4bbc

      SHA512

      e4dbc2bc0ccf7dcbb2c17998c633aeb46d8b2404ae6e8d1ca4a4c4ae1654ac7cf85325d6a4997fa3eadf4410922e0951be2892dfc7011860543ca3bd231e87f4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3003bb708d9f603a843652beeba2a6ba

      SHA1

      2f54b93f90b429c18863900603a83194ab306a62

      SHA256

      4bed1d4b24880f4b60f975336f3d9a81f7a6c7a74456f157d9736ef70a167d07

      SHA512

      7035b09226cf53f3a83bca32e01b527839585708282e9bf325b5d341bdee30991a0d7bb821f76ec9d00ff2c26be5be9928ed1a3559b29b44d00695c61a00bb92

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7879dec88c14fd9316cec5aa79775896

      SHA1

      631895530c5684710b89a3b843ce961c4a1cacbb

      SHA256

      967cbd6b920c5a560e91ec4c662ae68ecc8f1c29d7f9092d215740e01ad69f05

      SHA512

      fe6e1cc57585304b7a30b7654fe7863d2017844c46962f959db3f0f9e6c0bd3d7b34f58c7bf637af265e758e5d9a3d79e1da5b7f469c2e614b4be9b63a244c03

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bc07565bbf36a4b4c60e65565a8733ce

      SHA1

      7849e60618ad4f2a26156262d568db660bf437b4

      SHA256

      888e8fde2e8f416576c8e53231dfc9a89eede422c7afd5325be1eb25a8f22cf4

      SHA512

      f2b2fef799413b48c1a88b8b8dca70a90592c56b669907919cffd4e006bd043f25ed85dfd00fb9166f0c59463305d845c6c09ee2fd09dc36c0c811a7c5866a61

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      605e17bf1a0024222b5dddfbbecf3a7e

      SHA1

      14a2221c0e6a8a2fed71909292a2dc63f6b7e8f5

      SHA256

      5bb582d7e5f4a2c565a77f49e3ade70c03beff26c00368a32cb9f1141bf6637d

      SHA512

      acc8980e1f73d3f6db76ba044728579b8b332015a006a11d19f66158d62d5d7a2719e12fa3f83078422822155dfbf47463490651fe72d9f522fe4f630bb38d48

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      74a1033793c2f6661d4eacedafe49971

      SHA1

      f340d1fcbab89b3881ce64f5a1b7ec41d7fc58a9

      SHA256

      74877b1283f16729879fcff0d2c669c5e4198890f337530121c32921609931ef

      SHA512

      542b2306f556b588e3461273cb4bd28d1f2f31d7ea13d12f2c3b8a5b6cdc1e48421546d3fd8d786082f94203e6a6fb58379296558efe8d1a628a4bbbb27130b2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d720ed74e3f86e8525edaa3f749be294

      SHA1

      a503c7519011b9ad50c9e7db00f01145414f81b2

      SHA256

      4a88620cc94b5bfcbacada17165a7bffab126b373020514ebede1f26b05898ef

      SHA512

      81576975f698484bbf39777d54a76e4905c31622812a3a2ae1a4c79d5734ff89b147709f82b59d5e79681a2e87cc88fb535664abfabf56645193d8f49cfa0128

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      99f32a57f33e43b82704ef698b940c74

      SHA1

      25c680409ac95c26b7d50b144d425aa4bdaed06f

      SHA256

      b098c8f200b00f42c4528170943fdd02fec152c6622fec7f7245ff54e6ca4894

      SHA512

      228303f7d27d39709fcd0687cbf93f84a217ae3d2bc8c8e6c8d7895ed18a2acfe1177424f0df3b3f903caa8bbae7921f9b1e6833ec863a2dedad6dc4a3df73d8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      aabbb39a35cf62df5e9602aaa3cbd097

      SHA1

      e725ee284609acda282deef40c40c8a376af490b

      SHA256

      09de0c67f13dab503d11610a08b8b9287d2056706104f4f288cc53ff1540f383

      SHA512

      42185b5609edd57e0185b57cdd02e3d34264b778733403b7049531d09ae4d5715472d5661b712c64ae550914b444bcbfd69413c23281a68ad3f3424426268a7b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      104c1d14165194eac82822441f0f6877

      SHA1

      3d65b03a88f73f8396e00901e906463bd43cfe8e

      SHA256

      866e26a0a34702d80fc33afb2def70c98f91397fab88fef9f65ee717142bd010

      SHA512

      40a41837e2734c381f38c1da6aefb2cda0540a2fcbbef50522708ad2240b22ef31524d3388b66696c580ce82ba0f3a8d0573b8367f5d75f03270b9bb47ad5ba8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9e26f9bc79c52513b4a9e2b149f0a47a

      SHA1

      5ecbeae28158d3f8719b796d178605995055130f

      SHA256

      b939fa4b15f5d25db2da6569724c2bae8c5f77b62819f1c969650a417eab48fd

      SHA512

      d7ef12839a87c79cddf8bdb1ebaff18a60a52dc71bb0a893cbe56f34c507f92481df0dd206ad2a3c394d45954632c57523f6df9442ec4a432f72b6ba587af289

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1afd6fa5c7669f4e562ca49760df607e

      SHA1

      10beabec8141e870757809eeb4dd8c73e514a487

      SHA256

      bbda4d86193d2f137739d05b0229238977df77f56fbd38ee8e09f21ca7e78caf

      SHA512

      b6cea15c990de50ac6dec1b71db2ee0183a352e5680e320ea1f9a6d4610548f430cac31c7ffc16e1d18dddcb20ff9c1d54664acd1f74f3882a7a3bfd1d1fd6a7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ae4e9d3c04716904af1aba9c2aa5e375

      SHA1

      97d81cf5f1d008690c84dbb21966a8e9fbebe170

      SHA256

      63c02bae3a5c97fc5f8c5d4dcd09bc1827147e6fb58e66a0d0ba69b9a6258f31

      SHA512

      6915822939b7d512d6136a7e4027d98d9e24d86937857df9e6df69707f967494e167b6dbc333a0251a42a782f890e806d7b2169411cea1dc857ebeaebfcdb117

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8e450830eb18061d10eca495892b8474

      SHA1

      c3efec3f0e3a253a0a470b0e27088a8b1bf71ed1

      SHA256

      c7cb47d9ef932237c5ec655b879c46c140a62b57f3adff8d55b4b1d50426f5cf

      SHA512

      e54c36ce0a8122807b35a0f056baf9ce4935f0a0d96b20c4956484522847c6f46f139a946f88a28966d238160a67b63cf184ecf5a1a990b37185f0fbb3067dc3

    • C:\Users\Admin\AppData\Local\Temp\Cab58FB.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar596B.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1728-437-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB

    • memory/1728-436-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2924-445-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2924-447-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2924-443-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2924-446-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2924-449-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB