Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    130s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    15/12/2024, 09:06

General

  • Target

    f347da2ebb506a79097f29b8440271d9_JaffaCakes118.html

  • Size

    155KB

  • MD5

    f347da2ebb506a79097f29b8440271d9

  • SHA1

    dcff826661c46030239baad9c30062089b27aa51

  • SHA256

    5db7662952e8261079292f44129573ed2e74ce687bf3a5db51a1d4d80fb11e6f

  • SHA512

    4ec8986667cd00824827b39bad2a05cddac238e2733a56b0b3747da32937001e6e4c7a47337b892f40efe706d616a187cda3c81735d8816513744e92fb7fcba5

  • SSDEEP

    1536:i4RTE812x2VDoyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:iyBVDoyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f347da2ebb506a79097f29b8440271d9_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1420 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2472
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1040
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1420 CREDAT:472081 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2080

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e4d341668946813ec005938d6a328915

      SHA1

      8570c46b72f71105bb8420d0ed41ea95cf90471f

      SHA256

      d1f6d15fcb7bf75c1109c686b10906547ec530d6d82dfc3634645944f183f194

      SHA512

      6f8823908c90563aab23cbc8d4c56904ee37b499aeaf471fb28c3cb206cacfc7e08bc738cf156cba29b3fcb584058cfec41e0746740e4cb78b3132446cdea026

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      00a9815872c58a6df31ba475f42448fe

      SHA1

      67b0020a7641ea754412e43eb1307a3bf1fe2856

      SHA256

      52c406843be07c780cf492d687940ba4aa4ffc47bbbcd8c4c56b7d2afe99fceb

      SHA512

      07a65567b6b6214896ed735c8b2eb2a2d43397aa698c71bfeddff48554bd9048080c6687a049d6cbe5f90e24c3742abc497b7040717d7e5f299048c8754ad663

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      033302568c4e6c4ce05b5e3f0b935488

      SHA1

      68daceb873b6dd7004cfeba304f49c6ee7af491e

      SHA256

      ffa3bad82020d8f91273a88d167bd75a04a6b4752d55f43adb513c935aadfe83

      SHA512

      f40b717482831cac0efe202287a1e78213566e3dcc27b0a3deb394020c024a7ad8b1a04f6e5c5fce8f5846b9d458064c6f93295e236b3a5781aaeb059a808fae

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      56c10fd864c7c9f7c23f1ca8a90f7c86

      SHA1

      d527d7cd5121567e11b0dd91558d3071e377cc21

      SHA256

      8349407cde3ebe0536880377dfdfeadb75c6f176ee44ad7ac511e607c9c90931

      SHA512

      78321aec9eda63d45b017ba246aed5ee968f9cea5d670817149a580ef1cf3e53dde9f018601e85c0fc876f3aee3f9dc59da103a9bee612344a1077ee2234fd4f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      871e474b1f3bb3dd690e92b07b5633f1

      SHA1

      fde98555e3e26cd27b85dfe7baf3a3d876e57009

      SHA256

      e03e50a9d680434f8962331d1f35fcc193e7241af8c852335198fcca8b7bf090

      SHA512

      ba60e78f68f320bdcdaa9e7fdd637ead82def1c0945b37d8d2e376eaa46654bb7f9d21f45ee68f6f0cae5fe16a4e165b12d21974f2f455f9bd10fe0e9eef1107

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      42c6daf550bc8f755f116d37e2745b81

      SHA1

      e66dd3693901706e6abbafdfd82ca2d8d09a4dbb

      SHA256

      ede649b536fc294c1fd080c1339ccac34224fac96fe91f5adf200577fad4b8b1

      SHA512

      405369385367d1028076370ee9dcfe952fe5813444bb1bad2685e36c3268ca2f94a9d0047d4c56846858f75ae403530ab1f215a0853598d81cae3a9cf394a5e5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      218bb20bcd82e736d92daaf60376cc10

      SHA1

      47a85fc0681fe8a7cf9fac9c555d698244412cf7

      SHA256

      5beb50399fbafcad38552770bd721bf7fac17e005ae22dc8c5c1bedec0101d86

      SHA512

      a916e3e9a1592da85237012c5af65b69dc2b9c6fd7f6a84b8ea2889d9c465d35e868d8266874e8690e7d0805119b231a31cc47eafa08e10299335df85f044b45

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      983dbc29d62638758a1b56e0a7f841b6

      SHA1

      46459a68c80e27b3b391a2eec4374d1689f24943

      SHA256

      6b71c9771cc441d25328269b8169b390aca0e5d98ea0c1109d86668157f338d3

      SHA512

      d1e66bf5b71afd082f52c7e690f81d48803f622ef12ec520998b49ea5adef3125e98ad181f81958246b2443c124ddf7619d51617014ba3bd44d7f97fe8934e1d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b5155ea35b30811a7ee41b2209a96afd

      SHA1

      fb427ef6a89e5011b566c4f8f82332d0afe25450

      SHA256

      ee1862c88c48d758ae47b9852337760cc7729190f79c505f20ef83a727a73f1d

      SHA512

      1c51707a22e38fe6283e5b28c427a67523d1b8a43717e83649c6f6eb0d7b944ffa8a48aae2514af04a9a3494e8bc5ff6328b2dd9abb4c548095b9368cc20bdfe

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5e926a7155b374012516ee174d5e6197

      SHA1

      5877c0b0b6ec6566e7857457c1cc043a8b516ef1

      SHA256

      7c92f3bb80a74db7fa5d3304d98ed5528407f1fe99ca61f232efb9d2406bc9ea

      SHA512

      6372b7b6603b41ab5143cbd2b150723131c32aeaab960bd059d0e8c9c16814dcdc6344401bed04456b9a52d9e3a6bdf50b1e28f3dac27eca111e3f1f672de6f6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      994569dda1cd6d43ce8adfe9c106ba79

      SHA1

      68c12cf191cad7c83884a7504b55a89d21e5c7f7

      SHA256

      cce7ecc3c1b55534ab0fde586f42b6fdfb4afbc6d6147052d7d950212bcfb3c3

      SHA512

      81debb507a94493b680c13d023deed750b99bfe9b35539cf61f8432fe46e02cc0e96c0dd825a918146fa5b04ac957c04b68cd317d2011d17f1153545dbd39e0c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      cabb7d1577e810504340225b6e417332

      SHA1

      d35966f8f4b3527909a0750ba08f0895ea3b90c5

      SHA256

      281237181ae971e3f7cbc0b21515d3b212d13e0d6ff01f58b306df1d2a47a908

      SHA512

      9a12c999abebfb2ed40d9aa9d20456b446642f7db47e2475bf69084e26c246c0c21b4167ce1de19853703880daefd8619b9a2b1a055e3525d1058d82eb623782

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e0db9714140ae976876d197b6f478187

      SHA1

      387b8abb6a6c9cc4f10b4c7af87143bbf9bd1fcb

      SHA256

      6482fdc76fe7e206bba88c0e64dbf3a83c4abd9a5fc8ff8e3736e8207ce78eff

      SHA512

      09900cb488fdb5b2772a76eb0a06c06000781579b048d23d5176c1919ea3b4d2fa072ad5383780bf9f5819083a18728052fd2ea1e6807c7d24abb3724576304e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      810b90372de288550504e2e4c5c9f1c8

      SHA1

      a6241cce680cde278b4426e34a41dcf9f9b59941

      SHA256

      50dddc6fcf331b3804a48c3fbc02da45deb4445150f783925acc221db6d30b2d

      SHA512

      7e41f92862a0eaaf9abf38785f4ddb0470eba47ad646d8628bff3e331c8687e96770d06f0648e784401ab8cf010060a477c31915d2d511051b12c734242555a6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      73826392dc30fae675513c9d6f33669c

      SHA1

      062c47b0a6857f0eae3758394ee268bfc320dc5f

      SHA256

      f030e663bcdc87390a3c49197f47662740b301b0232b1e5630f9c393721033ad

      SHA512

      0e1c741d8ccee2bbb331e56d3d48e1a62e748fd23c73663970971558cc258d50e29d03b53db29ee842a46f6a5b43543e7a3504f08f6ca9b3a99e14bc1ddb4189

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d4ebe81d16bcb24f2bef2a2ef460e672

      SHA1

      78837438a37eda074f9136120efa92456674a924

      SHA256

      51d900954ebe032d40074daaadbac4c7b7706fa2faa7236a0c2a2da972a91c5d

      SHA512

      28a40029109cf4a769e16a86b84c9bc98db1c90985153162b70c2d1aed6fc9b93704e47aa8963840e093fc0d48c33e892302299de527e072bea650ef28dfe62b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      271abba47776ede804d7f47fc81bafaf

      SHA1

      ab0cb4ece447bd26a5d1e76893ee8e64ef0e34ef

      SHA256

      2d5b37b7748588b9eeb4fdc65c791e4c978cac3b2540c8cb44251ce0bd42c8d9

      SHA512

      5ce4eca91d5b16e65879e3bce1eb379148f57fc33fe2bd31bb4e0e58c14a7ec790108380bec9707f37aad56dd5132f338dd1b34b2396d3228c8353cfe43046e6

    • C:\Users\Admin\AppData\Local\Temp\Cab714B.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar71FA.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1680-436-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1680-437-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB

    • memory/2472-448-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2472-446-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2472-445-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2472-443-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB