Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    10/12/2024, 02:26

General

  • Target

    dc97ba20bec488358646113153dc42f4_JaffaCakes118.html

  • Size

    155KB

  • MD5

    dc97ba20bec488358646113153dc42f4

  • SHA1

    d7eda04faddc1ad9a662da7473e2343713a4f370

  • SHA256

    851c729a8a40df40bbfb133236e11da2dd36608f72d896dcc41c9f46f410559d

  • SHA512

    166eefd996dcc0183b44db613f4f72009bf747651262dfe40390c3d922b508095c825797f61a67b99b1ade0e4454b2918da13b7ef8025de185e5b00c6c2592b5

  • SSDEEP

    1536:ipRTxwioPHFxcFyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:iPGHFGFyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc97ba20bec488358646113153dc42f4_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2204
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1004
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1436
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:734218 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2780

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8d146382734cd1ebfa639e96476cb5a2

      SHA1

      1fe2c35171822e21ee25029e10a65b753aeb1104

      SHA256

      9273e52ea41f4d023cce9a06e765ed42059baf96415073370185eba7c7396827

      SHA512

      13370b8c1ab4be44a8dcc42454f3e76b154ea2d4aec4e003962bcfc7d9a89aab5130b069e17e45cfb891d7b948a83e82132d73f994fb80abdcc422bffcc74c0a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      59a1f9c6e9191cec1e937b9479c6569e

      SHA1

      e60a2a51a15f330b72ca0501c301a83d5f815857

      SHA256

      e15f59b009b88e54b2b48952d0d3e099b4bd3a1c10611ff80c1b2d7c9f8b21de

      SHA512

      d20c201ac1292c7cef14ad16c58998f0f81112d05a2949a01bc32a5e6325b03137f24a7d6ab0c82eafd150d15a84f2c673ff06943e570b51f7e029bc9dbd6317

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8ceec6aa045140d442343485da8d5dbe

      SHA1

      cca79275bbd58e98aacc52ac81e6e1979655297e

      SHA256

      ecd8c29c68fb9398512e75905eb2480fbbeb90470de6e3378a77a32f1b4904a5

      SHA512

      f21082b0dbd0087fca1987aa2bd578db5c5329118a9a9a544aa191b6e795f82fb4251b6eb0a804d62d6485519ce024b0886981abb851fafdce1d1f5006d63474

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      768c88df4d8a4795f5d113e9d270ea2c

      SHA1

      a2657a55c017d26ffdf267d79da340d6e691dcfd

      SHA256

      7ff41aeb00a77dcfc7b7d34759a9aef610daec69f2123703171d04adca6c9d47

      SHA512

      4cf71d563eba42c06b424e018f74fda32e78f5387dc1a9f37638f390aac0f514c4338d6f9c50b5e5b7089a8196e7301555357ef70924ac29cd833cd6798b781b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2ff61b6721e053f37fc9c3a05446bc3e

      SHA1

      e40cbe57bf331b6df143abc6e4681ae404f976ce

      SHA256

      85e6ba84d28dba509fe6c6a38d023d81a98add783d06e4f94a5999826f3cfbb7

      SHA512

      7147a763f9af1c3d74a937ac33f797c242c93a2788201f427387955b7acd493d16f54ea2e62303ae7d383a4a74b2afa454806be145fb0031033f1708f30c45b3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      34e14724736016b5782aeec1edd34f7c

      SHA1

      7fc7eeecd0d031dc9d082ebd10815b9c7a486eb1

      SHA256

      17be826b5476b523f7dc2d40e2cbb697e0987eb75016520d2d66d885821f5a30

      SHA512

      e85b65e0a69feb9d2094bd6cd952a847cb48cd06fc5d3f9fe68c10992ae8e5b40add295a9b11e815c3120a5e1572a4325fe2df0ebcf35da77f26c5a80d2d9e02

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      397c610353e866e4c5d7a0155fad2e80

      SHA1

      ca2c521d74693c11ac1aec4f0f48fa5a9c962cff

      SHA256

      95beb6d0fdc9f7e908cc1cbfec011b393c029f7d71a7205caf0f9056d0b88634

      SHA512

      b0a84e3bf75b965e28e21c8db5a7bb3c8d9a369f551932ff1202c3e08ea2001d9110c2e01b41bcbc237da7e6cb5ee7bbd4930c5f20615b90e65a58077b41cdb0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      24082892cd6d994c12c0490554ccd490

      SHA1

      add144eb739f4e9038771462d0f2a83efdde0150

      SHA256

      b017a526bd1617919febecbc395a0b4345dee7e81dfc60c67c58ec4db2d21026

      SHA512

      b4070d62591063a8dd91b6a54d3680be366c1a24d14e41015af535b9c1d38dda65875f8c44a11ae7d40e724c53e00c1cfb35becd7460d17953ee3d024b84c0eb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d5a2c803af213098ad2f9619e2f6d752

      SHA1

      454059633b063e8bd295e7e1b4593582cfb7a783

      SHA256

      6415476f95b3b757acd4c242507ef07e16d2ae5570ca10a2d8e607b06309ed7b

      SHA512

      d454b6b847ad18dfb56edc576609c441cd2d25bce383665b480911128bc8bfcf9827425aac6006f54fc47b69b439c0d026b87dc7b08a2adb90e1299520fa767c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      13b2270a8252666c0ebe600eae2fe6f7

      SHA1

      b6fa4b237e8d1ee651ea7474d4c06f925822ab46

      SHA256

      0d40034a8b58b7f7975a4b09c998b0e6a68967b82932289be975c2d0a9494706

      SHA512

      5dce0f960d24fc5276eb7dae674cbc167e2b851e9d9c8ec23cefabe30b8b48ec8e6b0fe3d34b5f96e69856fccdd3d521a64e6015718733708e6a97e7f1b859af

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      662a3f5e098afe0026682ff169f58f9b

      SHA1

      358314ed1c1a20a6e341d2fa3a9f07f3f9b8787a

      SHA256

      59a7476d3dc9f664375fed2eb58048e98c0ecb0d4f1094fcd1d4350527e0a18f

      SHA512

      c0432236dbf07803e8b2b09c9e99dafb82d19b3971b10d5e7710c82ed7f85f20426d92242ed40f9b76d83fef7a6037dafaddc7971c447129d769a1101c89b9c6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      36a854e4da5f5248f228cc1b4fbf88ec

      SHA1

      80a42b45bb86ecc8a8e9c233f9b7be8d5580b07e

      SHA256

      389515472bc0e8dbba12a091ea6db856f0a026927a0b0d94c08631495cd3b8be

      SHA512

      a2ab5d12c1cbda2d9e6d598c5d366bb9d6474852ce73eb53cfd577ff0aa2b3617b9e42eb4d890b6e5860910a790ae4cae130be359abc91d2cff4a8e4b9e47dd9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      23692c8f81787b7fb19c1bc00bb4e9fb

      SHA1

      925933f6b5ded9f11b102cdac30bfff13f913fd4

      SHA256

      92078abe02244cf9c0193ab2395d3ff6f05d3bf49840e9bf27c7a4ca0070cb3f

      SHA512

      b6b46fbd0d5b32394e6f6515a1bb931c41f4d258a826e0fbf5635e3edb717e7f5903c57964f7953a4c0759c02f04ea0af614d1cdac586d70842c5de0c6d6a9cd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      59e463dd451d722f04609cd37706682f

      SHA1

      cafd3c8f170f70a9b46d018dee54fd6640fd9a5f

      SHA256

      f27b2207df85333fb5f0da38fbc3f77cef6c856192f8795dabc9c78e9a86bef7

      SHA512

      387eadeca3b5245f5f1229b3d6a81291d1471739e8e029acb22abcc9f029ec2501efee07f9c2f17be3bf419e280307e8afc4d9a294152f55b36e5bd2e5ec900b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      39703d71bdb43933339ab1ecab8fca2b

      SHA1

      c8e81cdbbbeff5031a9da61edf736dd1ff12dc57

      SHA256

      a800ac99efaeca1ca140b5142c9eba10028952819a285d5e0ae4491d20cca70e

      SHA512

      4632de76b1c008ea271d38ce4a8fae0989b7d8b0a9e321a0f5ef0b987c29b31b5c63d68b6e1c46caf4f14fca604170da60d983809d6e153b368a36405e0e703e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      67695be6e5ceb8e1fd6456ce45ec8402

      SHA1

      5eb56306c10b1bde89f920388009dbf1bbfc74c4

      SHA256

      1d278dbfdf781c0e9c7f10b3587d95a6e37a88f81ca659341f0afa02c8bf1330

      SHA512

      91e8fc3b83291ea9c29d614eeb4610c786143123e48f468303d4a449164d3e3bc36809f3600c7e1a04c805dfc7c873c342024b70eda2004ad3000ec690311b91

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c9b8e8355db45bf3a762cb25b57efbc8

      SHA1

      9902a40d6929aed09e2d1a223b6d222bab10c61a

      SHA256

      1845884ae8852223425283ac676f4f554269ff77a496e6896a2ff9f4abee7594

      SHA512

      2c5beefde37376df0e7863bfc99baeff0beb35588656936b0a7baf15f7c950c416664dee744d944d28a7a5937311f9e783e9494ec474b517e5bd1e9a3e0521e3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      05caf00dd6ad7751a13a1fcab7ab1d14

      SHA1

      c53f4e068ea2ed7976b008881c55573bfa2e61e7

      SHA256

      79985d91f5ce6236e3292d7926c64359576baea90ee8ca1cf0a1c5f7fc9b157c

      SHA512

      56d3562e97a13c5b2453424786b3c83a6f5301c28664304ae13462d35966871a2a5ba97cae4bbd3a15653d81da12455c5eccb87c8ec4aa86728aacce791ff096

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8b37b2cabbb710e328e1962ba1195872

      SHA1

      5bf18dedc9a5a84f2fc6a98b54f3684f9c8b6f3e

      SHA256

      4a4a676d9e79ec9580e9ceff21ad74221486b057e7badcce4184d8e86a522648

      SHA512

      e04d0ee1101111228669629832d0f5e319736315464f1a06f890f6ceaa881d4eb2ffadc912b67845b2c5c7d5a9cbc86a05eb0f1e4b111b8cfa97b0f03f68657b

    • C:\Users\Admin\AppData\Local\Temp\CabB838.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarB8E8.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1004-448-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1004-452-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1004-450-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1004-445-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1004-447-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1004-449-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2204-441-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2204-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2204-443-0x0000000000240000-0x000000000026E000-memory.dmp

      Filesize

      184KB

    • memory/2204-436-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB