Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/12/2024, 04:05

General

  • Target

    dcedcaa16c03806c95b6297b3aacae9a_JaffaCakes118.html

  • Size

    158KB

  • MD5

    dcedcaa16c03806c95b6297b3aacae9a

  • SHA1

    8f9c9f171d5f2d93318e4c1f7bf367233ee2c6a2

  • SHA256

    52f22db7e1b444d0c1023323650c120c5c0d0e8cd87cd836a8fb2577db2968e9

  • SHA512

    b8a960028ef1fe8da3fcffd61caba185bf4e3b0fcc8b7c41a998fe15aae255bdeb47d8b6ea145707ceb5c851542ae486e0b206570c34dab490e27908fcf7b525

  • SSDEEP

    1536:iYRTNclA6Wy//yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:iS4h/yfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dcedcaa16c03806c95b6297b3aacae9a_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1016 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2408
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1408
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:704
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1016 CREDAT:472071 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2264

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      fb5dd79dc46f9e5e5d386e423f304b75

      SHA1

      7defd2613ef968a2d1c26c280be930e511dfa7ac

      SHA256

      391d273af0e22a37bad76daa6ccb72b0b22d7460391fa267f0af6bfb392479a5

      SHA512

      8bbf4d1edc156353388e2c5e9a8df55c1cc89e632a41817736aaa45b0ad370e32493d66fbc4a41af68288d608351c6868e0a1eaf954326892ea1307227630149

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4a018f680721549befe3a593068dee08

      SHA1

      ac827530456f78baa7f21a1f1772b5db13100a2a

      SHA256

      a469ffaf2dce84b8b10a4287c19dbaaf49bad1dc11479d5bd98a0ad3ea326f2a

      SHA512

      89fe5468d84a3a9a0576018e0d6422042a57a7ecf9052d74f2aad831bc9f549dd556758ee7f9ea524b605edcf7cb8483b9cb3081b9998fafb696a3a66c95a0dc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b9bed56eb8993ccc686f21cc0c6e7797

      SHA1

      227ae063430e9087bbe214bbc5b29ca6f75099bd

      SHA256

      a46f31f1e3f748bdb6f686d5dd06eef845542dd2bff32d66ca545bb321da9107

      SHA512

      133b3c5155ab3299c4713674fcdca8a4eef9f00767ff57d86138cb5fe9c5023fa854fac555718c5bcbde8cc044ba306cd0a33efba06b049acdc791fe79607868

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      0b2b2c3e0598969bc99a07edd7ee6559

      SHA1

      93fa7210746c63f121bb1abf3a688adc9ac8d5a2

      SHA256

      388fc18ce3eb7c731a2d28f10274ad7d91e768c2776113c738d676e13b076705

      SHA512

      18ecfd6250ec776a22241e40969795bd4835bb8614e1a4679472261824b62e5b710735d9570d949f2cbeecf799e9456f7c4f8a3dca2f75e06e602536fe1022c5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bb8f2404118fa2edb834404ed90ab96f

      SHA1

      0448c5ef7c78a16c69a92d7090cd3b836f4dcddf

      SHA256

      1ed1718151810e02500752c6219bdc64a5693ac62dd9f9d7a96d4084d9d893bf

      SHA512

      15fbb22e8ce51f2d2f50d763057ea398a15f450006764d1af4618e5089162423d4278edb4215d21e1dba7bb62846d618b13b03ab27b4eee739842d2f3e5e6dbe

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      44102417926054c036fdf4209e36ad4f

      SHA1

      1f79f05ab579bf36e38e168aa8f8de4f39182b03

      SHA256

      b2ee7f468b7c1a809ba003ed601fca61d0e3bd8a7a394114f2676f43edb01433

      SHA512

      8dffb1b5f5ad4a2b56696ae6f55c81d64d44256c0f33d5d25cf9809c0116c49be94bc878cf11d6dbb02f70853b49f40b283d015706891246c3c7a3210b177830

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3ea5498cfb7cde9f0f319156c9cd37d1

      SHA1

      c4c2f59f2fb39362c4fb2607769ae00c04874362

      SHA256

      6dcade540be5c9851b3fccbe1d41ee42602c23b00118f473c7b60ac069c89f69

      SHA512

      5746a517169b1a880a318ba976ecc9c0a8219d8389a9048778c5616664662e6936babcd6f3e5e7003578c3119c88e9069a2a6c08b0c5587e487e456eb101a67f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e375e3ee513c2c9670a7aee05a443535

      SHA1

      0ebb75e1f8dffafee316c43e2c996210c0635256

      SHA256

      eb040cfcf4c2aa21b4dcc3d2421add2b9db48accea6427e3974e3b015923464d

      SHA512

      6ad428914a0bfbd4fa2969e6c5976e0baee46ed40161a7b696a7ed06dbe292b0decb85321dba48ed1b2bb24a987618e7d648aa93dd2276d2a87209a6aff0867f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      196d0aa487087d82f403ec8c2e6bd232

      SHA1

      ecbe73aa1581b3415666f27eecdf1bd3a3fadd16

      SHA256

      abb9b7b3d58f80a180d18827a6c8b6edef02e4e86a883369b66e3cdb6bffa195

      SHA512

      041d184bc72eee12485f00a4a33081b31bcaef146f16f53949c3c3e59b4023b68e0161b0616d250a4297b7e8a87e8aa4502f82d620034e1a14b0a94de32af1a8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6e9615ad1b210c627d7c40e523f197e0

      SHA1

      301cc85b9bfc20cbe1345b0e6d1f082c197d0ddf

      SHA256

      670781432b684a2d86c4f72fe40941151d95220a5170376855aaac5da43f0c14

      SHA512

      1f55c3b48b34856eae53244ba96a500419a760750219d5c45b51c5c7cf2d77da52d62b06527561040ac438ddb713b4990c090cae3ff660b149d6c0ed4a259d4e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4b9a98434e82b3aa95d54e726e892003

      SHA1

      be3bebca68a20456276293e3d8e0998eebfc57a9

      SHA256

      bdfcf49a8c268aafdc1322934dd01b7d579378e3ccf19bfba3034b34e17d90c9

      SHA512

      c3e085244f4d3e06d96fb229767e9e767edcbf05838cc1c9bc3921c1ff279e3ad67624efe08f64243f9e4f7cdccf077eeba37bdc7f501e9ec4ff2c655021f0ca

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c74d15d0946e79f9ffbb9c9675115324

      SHA1

      be0b228518d3c966e0a0a2476243449008485df0

      SHA256

      37271b609e52ac1a5ed5cd4c3cf755c9db866bf978c2526cdaab40418f07dd0e

      SHA512

      5fbc98ae6a6dacee6dde8030225fe5e4658a07301322fb3d05a496e07e137a570c884d73f225299fdcbc7db39ea2fbe3458cfe0a98fc70408a4f2c3fc0286adc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      761fef6dc70a2984945e4f5af18f6c73

      SHA1

      0ccbf04870c2605d977dbc67027620808794bebf

      SHA256

      da5dc67552bb6a71718117377b7865c98b42b6006df47889a920dae73861844a

      SHA512

      cc6bf4c67e1fe99decfb40d01517522bde08421d622d5eb1ec000aadba99bcc54fd59cda6c20539538394972a13c75e9b633d1c5a3b0d4bfbd82e6b77b4e85f3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bb6145a3052e7934533cfc634d5a2841

      SHA1

      49991e5e3b9dc38493ca43bca37100f772623a65

      SHA256

      cab706302200bbb09d9db2465f9902df558de50b2ab6918b47a2293cad6295bf

      SHA512

      593ac5e51fcd35e7bc989efe5879c14d847b1f5bb4ba0cb1376dff72ead83e3a7696a2e141613ed2c7b69617ce391f3a7b74248df28b6a33602cbc64af9f30d3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      dbf216a56cbc8fe3a9c4adb48f72e3c3

      SHA1

      43aef8eae9ccc094d686366933d2e37e5ee1ad8b

      SHA256

      b1f0b199dd5ce3aaaef9016e872e47006ae77c72df5312142cfeae5cd9a56e46

      SHA512

      b918164105c593b8c4d855ad07e31ff1ac1cd172a2caaf866cf9c55043ffe9bd86dc11443bbfba7f2a0fc845e2a9466d46dfa350af8c8e3a022d52a35b495d46

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      df76d043511686a8dba3ae02ff01afaa

      SHA1

      c59b1819f12099bff87ffdeef1488b8b58e105ae

      SHA256

      1c3f60c7aef44f95b56f0c132a8940d579bb05acaef54306961cbdd42911fb4c

      SHA512

      c4a6bb0fc19c34b8f219b1ea3c055c1a58a0f33d569facb2e7b34f1f06f5df7abdfc7a5fd1e92c59b70ace7fbae72e9d1e1e3dcac04dc085397475b5564a2bc6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d2b46b99914bfc863b2b47bfa9039f41

      SHA1

      94fdc59919f9e32b445bb92e78f09c830b01d538

      SHA256

      8a7cf13b2527fe538d6f09888338f5e846dd795ae453e24bd5b209afffa6d8a6

      SHA512

      7d976289288cb7df5365059cc1373ed7ae101181e028c3fa624672e2110a7176cb859fc37e45fe33d866a3220bb5a8180597ad815a0bee1c41a3104a51ab0191

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9156a7b26dfc8e4078f9d7524eaa0956

      SHA1

      dfce5e796cb3faeeb730e1c623dd63581b873cfd

      SHA256

      59251d8baa67fe1643ba3d705e9680f2306a9b0864ebd837c57f0faf3f3c1bd7

      SHA512

      12bbc01014786ff5a3d6a5a65a9d47396a5912e20a6054a82248840837cde70285d989a5d6c6941ed3fc31130ff55cade309ce363aeb056d4dad9770c6ecf24a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d8dfe81fcf60446b162598f80061bbac

      SHA1

      c06d35cb1823d8cdb5c5dd9ea2df18d7fe332743

      SHA256

      22b8b6d9acdbab63d69c09aaf48603d46190229ce97dcd5e67f6c492353c7129

      SHA512

      65bf36326290d45fbba2a53aa1c758d4691e6c38c4e2452d134caddce3722e51d435a9a214d5f616d9100b5f719d101c3f94a1c66c5484d099d8138fe69aa546

    • C:\Users\Admin\AppData\Local\Temp\CabAEC8.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarAF76.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1408-449-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1408-447-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1408-445-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1408-446-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2408-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2408-436-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB

    • memory/2408-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB