Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2024, 03:46

General

  • Target

    dfc4fd8d48748d42e37966bc6df8e178_JaffaCakes118.html

  • Size

    116KB

  • MD5

    dfc4fd8d48748d42e37966bc6df8e178

  • SHA1

    8ebc7f11c77bf05e979c0b185bea3d6907340bdd

  • SHA256

    3d8e81ef10d2846c9a74e8211c383029de9fc637854946c02bf399c1c2fda568

  • SHA512

    3685d486df00c27b5966b25fbe3fe5d156858e98e7a68a05ee126de162b8784b16480e6523ac654b819b34d3faf7aacfa567a7b987d51e1f33a7f02e403305ee

  • SSDEEP

    1536:SbLZHyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:SbLlyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dfc4fd8d48748d42e37966bc6df8e178_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2596
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2732
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2600
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275472 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2968

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6530542b35418c3778aac92fff09074e

      SHA1

      ac28e7d97e0a9516232e43f7259c94815201e4fb

      SHA256

      d2b32aa52819f09408c22dc24a15fd1bf5bd8f4a4091d0c3e9fa849732baea55

      SHA512

      831d196be8d8cfa28d960a3e1eecb4bbd1819dbeb48a7ca0c7ae593fe40dc9b3f6e476d32f8ae1eddc253c284e5abba06ee77744f649475b03f39d1c23cdde29

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      25f1f8adffe81441bf697e9986705200

      SHA1

      53df76060a834062da82bd0716f8ad104efe93f9

      SHA256

      07b9865aaa6edcacc23168b43d330efa2836feb648039ec36c3acfb9759371c8

      SHA512

      406c19ef429e1995ee9232380eb77d6145b5f0f926b3352f499a3689d74de1f584a08f95c8a5bdf317dcfe013d8ed22830cd133db3447549af80b546b76f65ea

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      eb4db82515d8d7f552a7d85bd884ab09

      SHA1

      34aa34ee89aa340e6a3fe863a37aab72cba898c1

      SHA256

      b615578f2c9ca74c20a232823f79ce682feec06bffb1a8bb635321ffdc32d97b

      SHA512

      1c31a63beadf8c150181cc3c7b6c4ad80180dc71de0e8ded30108337240ea40a492fd4de0ef637609dec7e2ee0501dc263b973c83e8ac787ffb26101ba47fb7f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9dd326ae3f6ebb69928cabbc117a3a1c

      SHA1

      9c047c5343ca678c6b831f435342e5bbc2036e24

      SHA256

      2032be60bdb867e2571d538fc28d069cbdbb3a08963ddb6c2900f91c342daf43

      SHA512

      bace4025947f4937c0532fff23534a4c5b90f04ac436d229ecbdb8131be2089a5178173401de2547302a84fe1dafd49cf517cde2e34276b744cd37a31f6c13eb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2beee481bdeed2923cf02e5275d9a67c

      SHA1

      7f08fc2ff8e9e8dd61b3997a8f78b7f75e6eec55

      SHA256

      1de54e78c54e16623a3f65c4d271c667295f2b5c94d5cdb2c4dd19d9cf20781b

      SHA512

      581824ceaa20c13930525a2449013a3f8200d456f47126dd5b8f22a336981c6178efae74e93713dda46d964656895de548f548c05194d312ee77acf9ef3f7280

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ffae224d8cdc5f1b3b573d1922002054

      SHA1

      174da362d20185faccf3fbe9742357a62f91a782

      SHA256

      b1df7aa9646035a20c3af181a3ef417f22a1c796ad8ad17808e86c938222d26a

      SHA512

      9a56017e28f75998ab63cff926a9ea12350c054fee6d668ff773a7dd14173400bcb93a204eda251fcfc681fb360a46ddab35b9fd35ee464a94ece561993271e7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8967af99bcf2df98d272b352bbf97885

      SHA1

      0bfd9e9281566eae9a67332270504ddb72fe12c7

      SHA256

      66d2ebea1b80825c011420669627a2ba807e0d0a663cb9417207e088250ecfd1

      SHA512

      132ecf45e15fdc23df49e0706f36cd47747f58c96d51c9866371914d1de60669db5ce9bfb8bf09c388d9958b255e3bbeb80847b449cceb238cf9853ad985a5ec

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      741d2ec1dd7a9a59dbe3d76f4fcc273b

      SHA1

      7defae30ae644fbd8bb5c4ec70b81b1bbe5d6043

      SHA256

      263449e4edab11bc42f411008ebc60b2bdc28cd7f981ffa36a1233997a247424

      SHA512

      9edc69174f849afdbf198a053e3679bdbcec38875e28da094a3219eaa943a6058b9641ed4d9b6079e00ff8b85c77c341914699e325db95651f8fd6744630e7d3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b65e2fba5e22ead5164954423cdcb3eb

      SHA1

      ee1a98d7effb58af94f757f2796e928ad7cff909

      SHA256

      ed69f08b260f8d151d3c704baaf6e8b3dced6d21e460ca616b00907e4c33f511

      SHA512

      41d712c312e2cd2c5a0ba19756b94d540b9113c74bd515997dca1cb97cb4da5129455a2771288cc5d45194475b55e2cdc6260b08dc7c728001fdf37f3f9d677c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      da70c0a009c18240b3a1b65da94f0ab7

      SHA1

      dddc6b3794fe6191f8c6b01da4be8735a8c760ec

      SHA256

      4a834fd5a287b9bc2fb301d68203f0d292c6847fdff8782c94ccb8cd69c983cd

      SHA512

      f9dd18a2af5127d2c94b8bd37a287697155409cdb8d375608df7d0135c06ea36cfc2ccb7ac432ede806957ebce8fe536a9d8d42cb62dd05b983f2a7095c03ec3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9e77a1e932428c493781944e26a867eb

      SHA1

      674cca825720f8f8f68b2ac021bfebe36410a595

      SHA256

      31b391a919ef5f75127df319b607af4598b3a7c1dc631fdcc5ecda8b2ffa6e65

      SHA512

      30e112ce3f147766223251839b7d9bc731bf9bcc8f330eebcbfd51bffe6a6f80fe391c74e57d9d43df27fd0b4acb5a31fd843d4bd1fa64341c7d4235e18e48d6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bd8e5a5aecc8ce2005cad4ce4758a7d5

      SHA1

      ca0de3256845053a7afc56560dcc242dc1f532d5

      SHA256

      da31e64a7939c9cd391e5ef79b00d53dfbc7a13b9e8e7cf18232f16d4053ef40

      SHA512

      301540cf68eddd110b499e0794b7e7caccb1f9880cfba54c29a19d20b5e79e67f160cd56ed7c65752cdd3ea946a806f8aaa5b489eba177a98a04529c89c48ef2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a72fb3eb198f14ebbee88177a896ac40

      SHA1

      b04be4f7ae3bde6d727a00ff224741139016170b

      SHA256

      669f4fd54cca23cf8bdfa4b92dea5f880505389f98db074af1016b017606156d

      SHA512

      8701e5751819fd78d4b8d73f7367c1a764fb3543a25787c8cda0bc57fe93b5b71b0ca9f37d022927070b6ab4f18f26f1af618274528d7d9fe1b60914822d5e7c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      95090c006f1ab2620ea931dc977a2189

      SHA1

      3a32eb58fc700a9d94f4b0964885ce7eec10e226

      SHA256

      bc3b591c19888eca1dbfd6fe69799862daf0401d611e5bb4bbe56ad15648cd8e

      SHA512

      24b95d1e2ff3ed7d0b32cdb3e83e432dfd4d91edc6fa51e97bff39a1f4a93919ba52d96de4f7dda472ec9afffec24053ccaf5ad9176ff0fb9e678bd93635cd36

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8fa151880f8234e00451d5cf5d642c48

      SHA1

      180290bb6ab2ae3205e955e2c291cdb42f61773d

      SHA256

      454590d1a746beb4b6b2acce3cf361347c7e40fc6deb659952395083851eaca1

      SHA512

      7f1dac5d6f663ff14d2a87d1d20f3a410d4cf1814ec0a89e96330bb86197d3af22847219968596d1575312425402a9f30146476d63fa1d2dec87e25fb3233434

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5f07b569f38dcc3ebf1d7df93c46a202

      SHA1

      e5fac94c56dda91b0c4e6a8be300036ed58d512d

      SHA256

      bb0ac6cc0bcc1a1afe95342592abc019570ad41cd077cb23675ecb08137882b5

      SHA512

      3c4e91324a814dcffd3ef3661cf390f5403feacd564e228f9352f2232cbfa3851ad1bc5acc6a382d78bf404a81edf881212929eece27a85678e91e47ae8692c6

    • C:\Users\Admin\AppData\Local\Temp\Cab4F88.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar5038.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/2596-9-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2596-10-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/2732-16-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2732-19-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2732-21-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2732-20-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2732-18-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB