Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2024, 12:27

General

  • Target

    e1747741b968d2df13c4f76dbff4a576_JaffaCakes118.html

  • Size

    159KB

  • MD5

    e1747741b968d2df13c4f76dbff4a576

  • SHA1

    6c563897af381ba3d2a29821653fe3b9e9ba5d19

  • SHA256

    7751e107ea70356e694944d77dd4ecc334ffe2ef5ba76c471a2469632c151040

  • SHA512

    5ec1052a1c67bee745c75a818708268900d5dbf56b98b84384db388138813e0e01c99bc2018a10609d30b892ac118061ae8f9ec77fda74e61f2149e28ab5ea4b

  • SSDEEP

    1536:iIRT2T6xXGSyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:iCeSyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e1747741b968d2df13c4f76dbff4a576_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2396
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2380
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2456
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:472074 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2028

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      53368ca729dc6b0b4edf446ba084dd35

      SHA1

      f8596ecb816a8963a5311da4e7fb9a6c3efb8c44

      SHA256

      0ff5a15bac90a1deb373602efb2e797bbaf0551a9810b7d793a53ef9fd0ea388

      SHA512

      32f25b591ebb33e957eeaca61a8df8adac263ae04596a1f95062135d0df4b41a4cd573e199f6e05ab6e94ecb88f1c10db8a651a010a59a9ae35199833d989474

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3605ad2c6f5c19644738267738f4b5c1

      SHA1

      ece1e384fb1defe67bb8246e4b4fd275f529bb91

      SHA256

      060c92b3a9a2bc5fb184d140c39fb470b12b4f02793d4c8c6810a95281b82aa3

      SHA512

      a51936d227f1b4666d5c13ce57d45a8aab212df1a7d739c24b1aeae2545b8ca07fb8efcc3d1623add1952531939c954e53494a15ab1c28856879b4e9ad80dfd8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      595a4c49f01b1efdfb614e1903474a26

      SHA1

      7cbfa7102a25dbef357538a9b798cfb58d77b204

      SHA256

      887de54992b16be9acf1380a176becf742395d0889a6af4c4d769ecf95b78952

      SHA512

      15781c9d19b15fef5f7bd1263c95c377a2a13e0cf99e85be766e9ef168225e17183a72d2062d73015b6fa757f2b567b5eb6916a1130a0cab3c0e5d995d68b3b8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      cf1d3a9b2230a2249f4f03db990b079d

      SHA1

      730306ebda5a1ae9bc2c27073cd1ef0b9aa192ef

      SHA256

      d146b48707a71deac005099c4e2816c8fd1baeb6d15ddd35f80f483d6e44dbd2

      SHA512

      92ca7114967d24e9f23c1b900b76da724ff767fc99b069156302b241b2b4e47a12bba163983ebe6f0a9a65632acfad70e55dc24cdc1feefb053e8b4997c7a4cb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b74f377f25ebe5493f9c38f71789b1c6

      SHA1

      7ba5fc82c6849e4e88b321b91580cd000e284f8b

      SHA256

      6b4125a20437ff4df77cf02db2b3b53f9757e7ad768088ff2b2704a7555da127

      SHA512

      15111b9c810cbfc38be4243157857d59486876eb288968d014b2f2138d3ea4e947351d8e07e11e136bcdf6c5ee6ab7f2b5044d8de3ff34ba098c809c0db0e4ad

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f61861d8a98c022cf7736010ecdd4a9a

      SHA1

      9309469594b9928573175d88e5b603dcd5f38ce6

      SHA256

      9129e86885ac5ddc45125f42874cf1988e6f7c2896bd06edab4b01733e44cef2

      SHA512

      70195e1f209cb4751cf5f24af5617abaddf32d9734962d591df6ad56b531f7e140d0a8ca5f5d24e0a1b062fae0434f3f9f0d8a8d7564216a9abe34eafbabac37

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e14a943187b8ca685cfa09558942e1dd

      SHA1

      f462ec1a1662a0acdd43f13dd749c0eb2a74c5f8

      SHA256

      a6eebfa0a7fc16492bc2329b6351d277580f016a4fa7992f053014f8bdbcc6aa

      SHA512

      d329c934c7f9a43ec888acf30a207d1eeb85711d89d3a2319837f13ced5a2c69da6d375ef91244330c401a18b01eaa9ec38c9e37dcc9f8627ccdc148216acfe7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c348a76d1d95b17906a1cee14dd75d66

      SHA1

      1880a43b06c16cf181d3ef3e9ae03f8969b95894

      SHA256

      c6adc9a11945e6d65255b9709b780e478dba52fa97013805358aeb2dde34fd17

      SHA512

      7757f465df13814591723131cabad27e0750dd42c9bb356896b353efc93de780c50d44a7644567d1fc03d50322c1af686bb1457140b40101925ac43dd745d60c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e10ed033a6b3a3f8a99fc83cfde61a30

      SHA1

      ed3b41c1b2516fcb0cc2c7211e40a02dcd853873

      SHA256

      e57c3a98b65e7eb22f7b3f286e7c0f7f658ba0b2d9a9e78f729b504453dfaff1

      SHA512

      5121d3506339525682748348bb992cea176720ca381fc4797c9aaaf03e0d4faa412176ec1e742443133677d491a6704ea389c01705256b4baa11e5e3593cd635

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7ececad19091161bedb84713385f5b74

      SHA1

      74da6e1622900a55512e2504ffa586570765c983

      SHA256

      a8ec1790aa5f77f41b0e9dc74948fef70bafe56121b45e918f63362d45a8dee3

      SHA512

      15741c6f95b4e3fe6d5d974f38b682b3dc8a81639758f7dba3feb95514cd9971b7232e62a25234c6e6fe5c69ea47dd4fcd0f03e62aa63aeb152229395e74a131

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      491a8975e6a039efcd7a231c7b80a221

      SHA1

      7da5abab4cf2df48bfc61285372de4e81cf9f530

      SHA256

      a3b77449cfeb30c52ad7a06157437a8817769244751a9d9555f86b6e3cd62315

      SHA512

      82b78404fc6d95458f63f73bf33629269b74998542ade28aa172fa12628c982d489ed117d587729f84bbeff71400422398f55e47696982b4e59a349a05b3acd0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a33ac0e23ebfc92f0976171a6f66a357

      SHA1

      85518fe763f4c621902f9a9b64801cf5c7effa1f

      SHA256

      c3ab209b216f55a8577b76a1b2cd95f27071fd1f2c1d78ad81b285450c622dda

      SHA512

      4a1a601fff867cce7a8173e56fcdc7ed390ce713f2e05472f27971088bfb9aafc899bfd41fd9990865893497b5db0ef63ef5b7595e6162b7f21e5f56cf9f4ddb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bc854edd63d7a671f5e8c15d980992bb

      SHA1

      fe7cd4603166c0861b9ab02276e578af8cda449f

      SHA256

      7ca479ad1bf74869d94d37125a1b6e401f25aad6fe21dba56f8fbf68f0b7c24d

      SHA512

      a9f5644df796fa06d2db897ed7a0ccba4efd185e25847024a0b60c7954f4cfc4491d1bc5ac1372b0be3b4079672d6d223fb863d6fd55426f54fa11fcd851c16a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f537e28eb599d9ce02626709bb1198bf

      SHA1

      18373bf5deca1df6d8c173e7444e6c5078f676bd

      SHA256

      ffd870932b4f83e978a4b95f4a9ec3c424d02a08a9e8941740c502d5c6df6c3f

      SHA512

      1e2eea3a3921b0422e4630aa13ba8ac362763eea197616fd2f4cc857bc0fd8de2cb40db1cdc2932a82d03b8704011a6c29cfbed8daf3a8b4760973772ac45a73

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      caa3cb515e66a40415503a53149ffe8d

      SHA1

      43c8d998b6008400abda296f791883ef79c45d6f

      SHA256

      fd37f38a7171e3ddd36b054dc645433e03c8e6fe3c8ef3383f2e8c6319181abc

      SHA512

      783f9dae9fad817d7759d0411a9fb80347eae823478bf5ab9d7ed920b37619ef971121f4684aa53bd0a0aecfb4954264e1c8993b63dfdfbcf7a39f238007b9b4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b14c4311566628d72c7ea7d6f5107c94

      SHA1

      2ed93006feebf7a935e09f28ebb42bdfadb69b3a

      SHA256

      7aecd662f6f01141d99e575756660a6b3042ba13bb310aa2370189ab7ee27aa3

      SHA512

      3f352624a0cf85a2d7e4f4f399ec4e7919f2c2a4950ac5ecc46f7adc62b65485bf2df230f881ffc422b45eca6b0002b9d6f20253595677f39dadde84ce585c35

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e613087714d795026a2fdc6f707a9b8c

      SHA1

      570e6d8abd9ade82ae0cd9b34af0975dfa2c201c

      SHA256

      591a1267cae8db69a8a32032e971e6e2854246517d21992dfbc62771d932ee6c

      SHA512

      6f4dffc3fa0d9d216ba352695c04460366e3c59a659c7e63f5e2cae2ef502df8d0683d29a16269e32156148ecf6c130725c1931e34b537b7e9b6b0a1c8195b53

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      daca0e1ab1cbe826b1db6fbdcbf81d22

      SHA1

      32b1dcaab883f4e783d94b4b44ee787079e3306e

      SHA256

      a2c0e94f4e74f672675df9f6d532bcd8bf2de06395c3b3043d7a20ed68846c3a

      SHA512

      718aaaa0f6989841246552cdd2c69699977e93630ecf7edb4f742e4ad42eb327256be365ebf90918daa6896bc5e777d5bcde0d14dde4671df9af3ec3acb77e9d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      902301a505ac38452348e2f7dd11105c

      SHA1

      1f89778de89c4a7a2d47cc2f11ee92adea2c9069

      SHA256

      289187baea810f3d84cf56ccd6448b71e3b356af2824d3ae60a6b9239e3db034

      SHA512

      54411bd669953f2eabd260bc832d5b0645e0b05016202205535bd819ee734b645a04f0ea0a82867333f88b72468a1ceb26f5ae59ce8ce2a44353c878c7cdffd1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      eb3f92eafda1b46820ba182c4d8f5a3c

      SHA1

      8e17615b959f3e096b413a1e86e1366820f3e6e9

      SHA256

      4065bb9d2e0cffb445fadd590ff5e16f918cf6208014ed2818f32f3f2efe492b

      SHA512

      e5de0c4963fdd1c2bfda043c56b76dbadbaaa533f426456649850c08c0e7746ab5a30490868838bc63e2fb207ce02a3fc2a47e76387428feb68a61af86253761

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c3fd4753423cbb8151f8b252085efacd

      SHA1

      1ea67eadee5dbe1f760c0276889c8915fc986145

      SHA256

      ecf516320fa2ad8e16cad30932ce72ede90a6472d35e06fd6e741264980508aa

      SHA512

      f4dc62711fac5a8d41020b484b4007672e501f58148f4f9759dfc5b8eca4fef2484df639cd1dfae8d0e4b1f34826cb3cab082155c429e40369fcddbbf929d3cd

    • C:\Users\Admin\AppData\Local\Temp\Cab3B2C.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar3BED.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/2380-451-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2380-447-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2380-448-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2380-449-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2380-445-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2396-442-0x0000000000430000-0x000000000045E000-memory.dmp

      Filesize

      184KB

    • memory/2396-436-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB

    • memory/2396-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2396-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB