Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    13/12/2024, 06:24 UTC

General

  • Target

    ea4f8edd19760da2d7f8af2fd5a5cd7f_JaffaCakes118.html

  • Size

    157KB

  • MD5

    ea4f8edd19760da2d7f8af2fd5a5cd7f

  • SHA1

    cef38e05ea8b1a916f243d0429bb4dfbf80af81a

  • SHA256

    6922f8845af9fecf6bffe091e54ef5fff9aab40252e8806abb1de90e6d9dbc7d

  • SHA512

    4e6cc3cbdef316253ec5aedbea600c14d68d2cf11f85e00ff6c322ab3212b768843bf48e64fbd4bf824a5747eb46b940abd51303eff96cd6ea0ac71140e32a6d

  • SSDEEP

    1536:ipRTkupAsLH8pTd6cAyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:iP5H8J9AyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea4f8edd19760da2d7f8af2fd5a5cd7f_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:600
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2400
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2900
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:472074 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2444

    Network

    • flag-us
      DNS
      www.xuvm9w.top
      IEXPLORE.EXE
      Remote address:
      8.8.8.8:53
      Request
      www.xuvm9w.top
      IN A
      Response
    • flag-us
      DNS
      news.share.baidu.com
      IEXPLORE.EXE
      Remote address:
      8.8.8.8:53
      Request
      news.share.baidu.com
      IN A
      Response
      news.share.baidu.com
      IN CNAME
      news.share.n.shifen.com
      news.share.n.shifen.com
      IN A
      39.156.68.163
      news.share.n.shifen.com
      IN A
      112.34.113.148
      news.share.n.shifen.com
      IN A
      180.101.212.103
      news.share.n.shifen.com
      IN A
      182.61.244.229
      news.share.n.shifen.com
      IN A
      182.61.201.94
      news.share.n.shifen.com
      IN A
      182.61.201.93
    • flag-us
      DNS
      api.bing.com
      iexplore.exe
      Remote address:
      8.8.8.8:53
      Request
      api.bing.com
      IN A
      Response
      api.bing.com
      IN CNAME
      api-bing-com.e-0001.e-msedge.net
      api-bing-com.e-0001.e-msedge.net
      IN CNAME
      e-0001.e-msedge.net
      e-0001.e-msedge.net
      IN A
      13.107.5.80
    • 39.156.68.163:80
      news.share.baidu.com
      IEXPLORE.EXE
      152 B
      3
    • 39.156.68.163:80
      news.share.baidu.com
      IEXPLORE.EXE
      152 B
      3
    • 112.34.113.148:80
      news.share.baidu.com
      IEXPLORE.EXE
      152 B
      3
    • 112.34.113.148:80
      news.share.baidu.com
      IEXPLORE.EXE
      152 B
      3
    • 180.101.212.103:80
      news.share.baidu.com
      IEXPLORE.EXE
      152 B
      3
    • 180.101.212.103:80
      news.share.baidu.com
      IEXPLORE.EXE
      152 B
      3
    • 204.79.197.200:443
      ieonline.microsoft.com
      tls
      iexplore.exe
      747 B
      7.8kB
      9
      12
    • 204.79.197.200:443
      ieonline.microsoft.com
      tls
      iexplore.exe
      747 B
      7.8kB
      9
      12
    • 204.79.197.200:443
      ieonline.microsoft.com
      tls
      iexplore.exe
      831 B
      7.9kB
      10
      13
    • 182.61.244.229:80
      news.share.baidu.com
      IEXPLORE.EXE
      152 B
      3
    • 182.61.244.229:80
      news.share.baidu.com
      IEXPLORE.EXE
      152 B
      3
    • 182.61.201.94:80
      news.share.baidu.com
      IEXPLORE.EXE
      152 B
      3
    • 182.61.201.94:80
      news.share.baidu.com
      IEXPLORE.EXE
      152 B
      3
    • 8.8.8.8:53
      www.xuvm9w.top
      dns
      IEXPLORE.EXE
      60 B
      130 B
      1
      1

      DNS Request

      www.xuvm9w.top

    • 8.8.8.8:53
      news.share.baidu.com
      dns
      IEXPLORE.EXE
      66 B
      196 B
      1
      1

      DNS Request

      news.share.baidu.com

      DNS Response

      39.156.68.163
      112.34.113.148
      180.101.212.103
      182.61.244.229
      182.61.201.94
      182.61.201.93

    • 8.8.8.8:53
      api.bing.com
      dns
      iexplore.exe
      58 B
      134 B
      1
      1

      DNS Request

      api.bing.com

      DNS Response

      13.107.5.80

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1c1bd78c956f5fb50b7af7ff9683ec0d

      SHA1

      634b13f59151fa69cc90e997c87432fd90d7f132

      SHA256

      1bc62363e0406442ec0f604dcb338743dc7a679f67bc51d89012c10d64e35c91

      SHA512

      7d565b28c816748281a59027be11d0a0ff6305efc5f19f7872d04af89223b6bea7bdb386f47beaab67e54f7ad7906379545cf4cfbb5f362792e8ac83e25c63c0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      09f5edd8a73a2a3c72fc2441c79499cb

      SHA1

      811457a9fd33c60348e0b8ced57ee9a805845984

      SHA256

      548d09f86729e06b47e0ad830fbc753753fc0325caeafa00631b00a95390f24b

      SHA512

      33dbca5236b6c14801171c0c849646f8cf93ead5105bbd51ac0c882833f57265928c26981213bcff11bacd5e3316b94d879ee70793f9fdcded3cbdd614e9842f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      488faad0a74987781ccbc7b79a1d5eb0

      SHA1

      6ed31063f39306ff9954563f616573265edc6133

      SHA256

      332b3345957ea663bbc30e99101d77f3ccbb3416ed394ad67a9dcba14b5269ff

      SHA512

      6bedca1679741d135794f7903b02144336f25f92373135dcca4d4ddbdecc5837f442dc959c52230bdfb8c34e08db6cca33430bcb2d34ed4967bedeb9e6d7439e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      efcdd177c6f4dd93db4cddcfdadf2505

      SHA1

      4e9e8c78bb33e0ecbb7cbb1410964d3d13048c4f

      SHA256

      4859484e3e8a600b2cdc875993a16f5ba32b5cd30b705d755c724928fdd19f26

      SHA512

      b37cc95d927901b86d4621d509c385a495a8fa810c5bceb82cf8aab305e4c9b893d05e7fc9150ab98bf735f468be1377967adf9030913b0847a03395b39777a0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1180aaa50d7ea9adfc430a66ef2b46e5

      SHA1

      49b5f59c243848d54571b4f9e486c607922e98e0

      SHA256

      36200123cd960eba8d71942709087827e7c2cf96ccee40b53dbc72319e6ce7bc

      SHA512

      61bd46e6ae702a5e0a43f9be90a07d01211428f27a5864f775d418828db7ea2d6299210331707a84f6d771e72df2a8204e7c23e26ae1e73ce8a689e63dbbdf72

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c6d29adebd017e2958e3b7d6cb9f2b98

      SHA1

      b57aeeab3b7953162e4a77764bf4f17f6c9fce31

      SHA256

      5574f93fb2085563683cee4085d8333be63d602d16556965c7832e4a8d2f41f1

      SHA512

      a1a6c33d26b7ff4e764aec3eb244904a4d58784616ab9870e0f22b2d43b17f990788ea58c155985ceb0d7a4c946e2f126b986d6145c201ef5f6d722e1fa70dd3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b59e316c8d8bd5000f398d1905ae393b

      SHA1

      bf89a34db8b37d3baad99280b602103902f2324f

      SHA256

      759bf9be30932408a66beaff1c5e10358e2bac65eb8d61d2e7036c017ecde7ad

      SHA512

      d01b5d171d0f9b0b2852df10ca940a7a406737851fc8c3e0846825ee8610d174fc95040900e30fa1142727fc0e2c409cf58ecba49d741bfee886b049386a2d02

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2a2b411196facc91449b051ae8dbd6e9

      SHA1

      4c004314e44c59c5f6cc40922339defa33388a42

      SHA256

      58194ed1222e3cf45d9e1b6d0202252b58a81b07e6e7f9482aad60dc9759e2b8

      SHA512

      c9366ced8e6eeafad19dd22715daa26f4447b70482c96c3946729693e48b951c491db82566b60ad43e8df19af6e4e2a0b52909380ce232d3af70ddc52c7b1fd9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b007f5aa3232302b55099ca4fafc5915

      SHA1

      7cd9e08394f86095417fe18353ea28aa38575ecf

      SHA256

      75b66e3d1bc87e015e621b8acb568ea40db3e9154b59cf97ae3c0aa445d03d9c

      SHA512

      f083f9d7e5dd19161297052729b4d48e6274f53cf3c6b03ed547b42e429df6ec7bbf11da4a0e6cc9d926cebfb36cd26290037b6440c6b8a7a0e6f96f43cf0713

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e33f7103824a2fc210142b887aef7502

      SHA1

      cf4d2193ec26536cf169a29fae0651ff387d60a6

      SHA256

      5755696a187a6d577964d228f22e950963b2aa545ce006410a894b310a0f1fd3

      SHA512

      3f755e3fdb15fbfda33e6169be6ef587b6d804c544079700791564447e7e80512ee6c2570d62e2ca9e6f43c8a6393d2f41ab3225a486f9ad42c66370ec3b97b5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      343a2c296cb386ab64a36a5f9df849f7

      SHA1

      a8782f59eeff5e8865365fa34606105fe21d0310

      SHA256

      f0842acee6bf528376cfcc6abb59596cf3c0c3e0e6c0fbd77658d727befc14de

      SHA512

      20215a94ea8094f46fe92402312ac7d35d377cdc5ec24cb37a76713a6c37964a414b7ae5dd220e27fc935c85ac1c08459495f10b7c67f2db639da5311f287c16

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      95fd7498b38ed8100bc8901a57f14e12

      SHA1

      85224647c7c8518b00bef01f72b3cedf9c001933

      SHA256

      d1ebf8b4689bb6a11940bf00cdf1f2cdb676c5ef4efb81c0a234f74ee9174122

      SHA512

      c7dc1a7b8d56c717e13811dee0a4cbe38cd3e5e8c2f3a96f388984b61f521fb10b143db57883e688569126d912a3c220981ef22201218e784c0652fdc08c3fbf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6fd5cdb94d1affd8e9352cef2fce7991

      SHA1

      0cc396cf55a09b928f6ffd33ca439628ac595e85

      SHA256

      43c182e565ccda0f74ba7fed56953868e570f934a1e8e7b14afec3f86ada2851

      SHA512

      155c82028b6355295d5176494031a65b519d176e2661dfcbc27dfe9994b980a942695d9edd8f1b5eca6ffd48312f581588cc8e14eb1419cda55ac96d61167f20

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f6388baf664ec93b720b6262f26091dc

      SHA1

      faadbde41658aa046c958c0a348075c8e52d030f

      SHA256

      0d7062d7e023c95e3281f60e8f98bbe484db60796c4abc51c1fc27b603f64402

      SHA512

      7fe70fcf1f82fdb6827345df019351479f2e27b90b0e6a08f1ce95562e1e41507837158f65cc687747fe368ea502bd8412f1cbcb051cdfc3111f3faa4fbaeb2a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a2c449574c447a46ecde57911bfaade9

      SHA1

      860ecd58832a77c723b13bc4307cccea9804cb59

      SHA256

      155a292105958d623864e130ab1e0225d2324b0b97470a29901127f7f135774a

      SHA512

      85a3f9bb174407085c59317f384011bbe758b01d7afabcbfa6c7f05903786946fa51e88cb647e6b5b03a409e2ccb2f819b48cc434d80775b6a6a1ad2197f80f0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1023ab82af4a10d18e49f98d93225d04

      SHA1

      56411476f01f9160d9530c7ce8fc56536b7b91fc

      SHA256

      9b41687b49b49872f1c5d55719c3b240302b2d7265524ec1b69c0704dbb9a5c7

      SHA512

      c208cb61ae724fe77f1cb7870f52af62c4c34ccb4b677affe5b91e321f68187177488366752f8a051c4c0e6dca0109e698d11fc70e56c4e2aa541084600a4135

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1ca65b97c08befe80fd2bca5548dad02

      SHA1

      48720c6eb487f156a0d5415208fe35aaaed66fb3

      SHA256

      d0f4bc0794408b666e5d80bd22dfce709973a50679607bed3194d23f8899cf64

      SHA512

      06a0a7d5e55bd229463c447a965757120446e49759ec3054e1fd908c030b008a5be3f9c65f68beea28f0e1dac1b0bd77c66e82bfd66c58f6d6dd0e598b0eb720

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c8e5fd971b873fe2699c951a37c89fe0

      SHA1

      e3f54e1153ee04e70fad8ba116c2e24c5d093df9

      SHA256

      e4eb22486f1cf61653d5233ce39c2a3b17e3bd1504d3d8957ab5b3ef26cc276e

      SHA512

      d8b6e5a6ec649d0a25597fd8e0fb356520231933458b9a8bf888bc259d2276606f2c5a4cbe973625e07d81a58be681840a267a04060a07d7dff3a123b6d0aee8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b5c0e47cdcde612560f6be91199fe5e3

      SHA1

      339952fb432fdf33547b7da3a7e4133ba5edf701

      SHA256

      ff668c08745c65f3db1aab12ac4e782626df15f4aeb73569a0298fa46a8bb06d

      SHA512

      a9c3feb027ca05a39a45db6537e3a1cd75d5eb31c20bb64998da9b2dfc322c157ed7f67a9ff382f42e9c5e3c6e85c992a82be43b1bdf86d3b25883a60080e649

    • C:\Users\Admin\AppData\Local\Temp\Cab4C2F.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar4CCE.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/600-444-0x0000000000270000-0x000000000029E000-memory.dmp

      Filesize

      184KB

    • memory/600-437-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/600-438-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/600-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2400-447-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2400-448-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2400-449-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2400-446-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.