Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/12/2024, 20:43

General

  • Target

    f5abba583cc3dcb2adeb599550e4242a_JaffaCakes118.html

  • Size

    155KB

  • MD5

    f5abba583cc3dcb2adeb599550e4242a

  • SHA1

    441f2d978e34567e00590e47c8f8d95cbfd13e16

  • SHA256

    298c46b190620224d90244a107e22bdd73ac563e23edc639ba5b298993ae94ab

  • SHA512

    3e6f9da9f3d88e0be9dfe7bd2de1f5cfd289885407429a9dd299aa5fbf9e5ac7acbd873f351ea7e5177535b369ac94c29e909e5e16a20c9e84841347f57c0a9f

  • SSDEEP

    1536:iIRTweqbQXJo0kkyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:iCwPkyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f5abba583cc3dcb2adeb599550e4242a_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1808
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:344
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:668680 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2264

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7390aa95d5c84944b8d197c70c1bb8be

      SHA1

      05ea04f7bae4865af2055335162393d5ac106d53

      SHA256

      e71e9cb7a0852f794224e1b8270cda84341e92efcba2c456f70dcb18681a6609

      SHA512

      8aa2760df4ee3e6aeeee95b58f0009e349853d411d011cab52782a0ee614cac5f7ba195408ceb4760ca546d68dba65d132a61a08a3aa43cba50585d3943804ef

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ef74b249b7e3e6ceee02c57a913b0266

      SHA1

      61b4efca64b1486c3a80a18ada091440958d72df

      SHA256

      3e97102c1c6db874a6945ff282df0edad9be5422b94cf14012fdfff28bbe761a

      SHA512

      ea2da1c31c8172e12cabd1b650ea85aa78f0b7d0d82c38b065f0c123f74e124f7ef0a58277e83431d4bda2f04a3adf861090149d5222b13357a23954357b364c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ab9e54ded31a870a7a28333ddcab4235

      SHA1

      5d8e6ab4fdd5358ec9e5147521bcda7413cb2b00

      SHA256

      06155cebe88c64a70f6b66cd59a863130ae5954d103c7a57ca576ca1fc0a5cf4

      SHA512

      fb21e662c2012317b9977dbca950ff8fe8b4b77244f5f6d4353feb5309577619f78592aa7e09f7df8ae0a099372b5c752e68b05dae2df248d20de46404ceb2e1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e6f60c73d43469f0a5ccb68f2bb1c058

      SHA1

      8057736d4feedede5c99a4da3cddae38553178d6

      SHA256

      d7fa00c8294d582d3a6b80ec9e541533ab71c7146d1507fb3183c6821e2bd009

      SHA512

      004ca1618a7195496fde1b0e80beab5e344b9d815baa58b7cd65d32f5c8b15ac9f87d59a7e083266114abfdee9bb7d09ae841eaac7728d0ca66090866985aef1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      330d5a2b70b188e7fe37586ca98315e6

      SHA1

      ff7122d06bc29490d046b238d79af510df4e9fdd

      SHA256

      b7445887d0e276c305b38f1a0c5aaa72dfffb99c53648426c1c30e8a996a7fcf

      SHA512

      c1eedf866578969dc3c989b18b3c8de48d8da5e60f1f1ef6c7727d23e21f61e31433327d567e343a01156f5103f3b2328460528f61faf11c54d25a5c8a546570

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      35a4d5b29773150a45d55e7374665a53

      SHA1

      c431e33d315f6979c7b42d0abd7c4d098beeedd4

      SHA256

      f2046b221ab1148df5ff9c5058a26edc2495e527d813116b35883d97b29b1603

      SHA512

      571fb6f3454581ac0ace7bff776ea2f06b38c5ca9d0129c02f207ecb030bce05aa8b07117af5ecf0396c55aa0673d6351c744679c65198f020d8ce84990fc60f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      834830e457ed17f8954f4e34e7b8a429

      SHA1

      1a370b7053eb8239477544ca512c3441eab991d3

      SHA256

      f5652ace9908144f053b78ca02dc21970a7cc52a6ebe702d8e5829aec2410a54

      SHA512

      d7c5884ea4d443cbd117f02cf1010be4e9b37106008c0e649d58f8e6eaca6acdbf15ebc614866c1227c5dd8abd71f0ea52f5d424bc8fca083a20f44fc3dab2d6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2c6b3f5a1305b3d97abd9fc6a4fa3446

      SHA1

      d884c54a3a8dcc5368b9c478122d3f4a0ac70283

      SHA256

      0f03be45d4f4287ee60806df7bf21e2fc1e14f11f4d221be8a81826270be8599

      SHA512

      dfc3833665ecace14e0beb525c07e416563e7cf199852252cccb0f930b3eeb85f1577ecfbcf7e90f2f2e11fd2e1fbdcc8d315d788ecb5eec1a48a9898b4da861

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e82d4afea58b29e869fff916a0147375

      SHA1

      f949269633429507ecb25c4798f7c55a7d3d018f

      SHA256

      76ce843581e00147e521122169a641a720e593af64f944bb2a169adfa94624b2

      SHA512

      54f53e99dfda5cc5b72496eb43955448ac3e23f054763a28a5b98b1471b1e8ac2451016f866f9b258ad2fad62f1e0086f61ee99877f32d60ad889cbef85313fe

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      20d91944e712d1bddc0e2939417c8d6b

      SHA1

      86d593916fcebc4d43f96f5f7b7f64b81e9933fc

      SHA256

      16a90e7ba9f8cf0428778707532893a2dafadd7fba5c29377179298e190f8ceb

      SHA512

      afe9e75de6529f41a3a6b15925963a7870c9b699b6f23b454b35bf0622ac04c8435ed87b0bf78538787a6c13cc6f4adc46297ea8e2834753aed40d64b51903d4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d3629198fe4fbc73861e09758e4973c3

      SHA1

      ace8f9cf3ff2c043e66c6e60098ccffbaf833b89

      SHA256

      9aed0484c72f36533e6d1bd971586004122c07b1fb1577a71e30e7ddf114fadb

      SHA512

      97b3e6d94bc0c1d4d114ce65c63a42f230aa26eaae9ded214614569148a38f6daafd87b253ed95b408513469b98e16df747376b07a6525be07fa565823202448

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      30aa839f13a3aa0e585f9d7962c8797c

      SHA1

      1bb52a3f5ef63179ba202d396c60cb5c7c71e344

      SHA256

      4334f9c130c286f11c881a9b48750a6f7fe319c7ceb9d295b5bfe087aaa29b51

      SHA512

      9a535f817635b2652cd726d1b3210ae339453ad8d14eee16c4190849884efbc36ae484a106a0b99d96ddb4f41db0b255296bbb26fd63510a3ec065dbb7b9a8d7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f9c0d83b2ec622995ceb1c0ba4abae7b

      SHA1

      1542d1209fcc69378261eb224495740c0269fe78

      SHA256

      0799477d5b8ca51816f88a60ba9148704a62c2661fea325f6295de2b8f8e1a70

      SHA512

      b80eaa41aaff618cbc15762d38387886755c421f8bc628c6a921582eb687f70603e1b64e9641f4b4eb951ca6fe974994472ea16c0c2c79de60f81fd5f6c1916d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      15558de1afc6e141da5f61c89632c148

      SHA1

      0bce6cf499ee479d7cf924840b655ddaa70d78a0

      SHA256

      07218d263c624d9f19cab7aec31bbfc239eeeb9fb78f49f8d9f7bac4f4a000ba

      SHA512

      6c49aa8be0c2ac8b2452c44db48dbf92c9014e4c6f428a937b2aa0047fcd4a1f681720d6031284a19e15648e690d2852c558139268af9c7caf6b2cfc274dbd8f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2ec59c89cc52b34fc989b5f0a136ab03

      SHA1

      c92f23b313472e5fcb4dfa1f5915b70b8a9864da

      SHA256

      a1b4cececed21d23741c72d56a1f715ae65b7205ce5793ee8c4e317745071aed

      SHA512

      a6cf49af756243100f977514b242c72146af2f6377626297a0a3c2b834fd9cb0859bb703b89b0dae942356fc666f926c18bd1529001eedc633ca737c01facad3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ec85cce99e308a4a7599e36f6b4479d2

      SHA1

      85ca09a810c2badc05c7554cd0f73f7993cb4db9

      SHA256

      826f9496524f9dfce2aa129ef856e37d5f4c1ba2fc71d515ff6df88841ef5bd3

      SHA512

      9e10147084f6967bc8f63bd8accb5a1ab4794b05527ceb1dcf7ff6bd4e8f3d77a57f6b72c0ca59d9fbfce33d6ac806918ce6aa33c51c7fe9fef42a1232571b1b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c3a4bf9fa7f5b1d066e486106d400870

      SHA1

      bc6582f333e2ade375d2dbee306f49638ef49025

      SHA256

      97803cf45ae4642ab96f90e4c46de34daa32c2d80cbaf8ea1be42dc54d943d06

      SHA512

      9baf2e523e05c20ed99e7443e89a92d5f4eda08d4f274a07648561a644e99410d3af4580ca99ac6a605e407cafe96bd55bb6fb42482a2bb6577410a5fccea3e9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c38c1fb8761b1e61e7a2a25923dce2b9

      SHA1

      272e3c680c0ba5dcec5d1a8e0f6c63fcf974d65c

      SHA256

      6c797b3abe50c625601098433a0e0c44a546e8ac1b2203075f7efe228e38596e

      SHA512

      2c8ae3b33d543b0d2fb8ca2482fcc9b88504c0950c5ac09a09dcac43efd327758378953b75e33848ed7ae90ca960bc4ca11b7edf4be9b48b8807a6a38e6f5e0b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      93d568bf4c9b8e7ce67054c4a79a8e63

      SHA1

      b822c355289ba4dbaa32711772f9c7bb57f7e8bd

      SHA256

      6ec31de20e43005112998d5e0010e5c32291a3bd8e68449692a96b01832d94fd

      SHA512

      7b4ad5f21b0a715d491629dc17848e50ebd328ac907146ce1d5157a5b7a49ca301b530f1d88718c2b73a04c62934770b611330c169635f92bb442c563d13c15a

    • C:\Users\Admin\AppData\Local\Temp\Cab12B.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar1AB.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1808-445-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1808-447-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/1808-446-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1808-448-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2024-436-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/2024-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2024-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB