Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    18/12/2024, 08:27

General

  • Target

    face20561e6fcebd916916521f096334_JaffaCakes118.html

  • Size

    158KB

  • MD5

    face20561e6fcebd916916521f096334

  • SHA1

    cfdfb5f62568d1ffae63a6741f16e9d5fd713deb

  • SHA256

    c533268b25bef01100b6a8fc00c1315d429b67722cec8c5f41bd8e23ad840c93

  • SHA512

    dd42c6b02040c703336b40b49beb398c0cc9fb6660fc9c04abb542c4fa89eb52367c71de9aaaf336911f28c366e25ae170594907701d053ce0b1232fb202f6be

  • SSDEEP

    1536:i9RTORGKTPh1TH6N9UVyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:ibm7aNuVyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\face20561e6fcebd916916521f096334_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2236
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1832
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2056
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:668677 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:872

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b22eaa9e6809001b4d0afabd7d83ff81

      SHA1

      cb07736fbdc26a0168d4c4bc743990bb4f60c24e

      SHA256

      f075e5582bec0cdaca1f315f4453cb797e33dc96950e41600e646bfc577a61ec

      SHA512

      abe64de8b28294836629fac0e9851aac1bbb40fafe47c3747fd1f2c581c86196b0b87aad8a264e50cd7eee0c5a41229483b34f0e0a53ab5bf5c8b56b98fe6074

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b7c129a5b36332ce81e00b0600d4eb77

      SHA1

      cbd98969c828b232b1530b93c8c2f7727a30ec00

      SHA256

      fedf38e481e3160c6c4995dd245ab27cd567366d7d1c8b4acb9a632c096ef1ee

      SHA512

      ebec0860d963d2eec6f8bded2faeb241a44e8c43ea107826e3373f2d0640c64e9482bfde4334b712a79603be78e2c60f25a1f20248b28cfce09ba8278c7c06a7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7c35078823b1e18b5d48567cadc53ce6

      SHA1

      2008492c9b3d24ea9e61d7981892565ac835ead6

      SHA256

      1ced9dd0aa987dce3ece9237921bce625ebf200aeb1dc1ba712e7d378bb8217d

      SHA512

      283ab4d37eff9d7604265ab8c8208284a791f43943bf475efb59fb5b11b4fb3a61af7f5ff44160882e861cd35a1c7f42d818222335ea85c2521fc23a6235f985

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6f82a562d26f767de9168f1cbf2ff0fb

      SHA1

      9553c98ecf4cc2333765a7cafd4535c8406aaa52

      SHA256

      b3f9e4ecfe09bedb1e992bc20af6ab9aeb964c942912d19e159bc2e0e23f140f

      SHA512

      be0adc9281aa0f64954e086955816507f377e522730b67250d434fdfe811df5e840a7f316e374b3928330fc3aeec91bc39564b1ad95a490858a9e2c21777a44f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      60363569baede1157fb5d32a60f4ed9e

      SHA1

      3175135756205db63a00e88777d3c1583f73a0cc

      SHA256

      81baad42ab59cc24f9d7ce9121082a4bb032dfd0b4001f9a9c97be4726ca0c2c

      SHA512

      52a95bcccbfd7c53cb2bd197f7f1bf86dbe52de32b5855e3005d56415acb6bf9fb08062ad005f6b1faf30d9a36a9449dc0f828d57e7098c48c3b63635238eb5f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      42b62825ac8b793f9e7e5e143edf9f07

      SHA1

      1c80d3f1bbc84af4f162812edb159925f7d9bede

      SHA256

      73d1584efe44d612d7bbff38838cd6677688c52a29caaddeb657e98525b2ecc9

      SHA512

      c8f0189953fa85bfe9b5531169194bef18c281ee05d90a29e27ce0bca4fc9becdfc07976c383b703f5d225eec8622878b897f2bd7a05f191689ed69e17dbad74

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3a0bc9036a9a6e963d6fb466e18d960e

      SHA1

      5a6bfece778e2350551d66f60f5ca30d87898d2f

      SHA256

      807548985d41107dfe66e6a28f082cd330bc952b87f035f812092afa4f42f7d3

      SHA512

      6f2504af0185e1b8d2acfd3b67ab84cf747f439e5e8d0fb939962ad2e3fb266933128b4eb6f90dd71e3c4b21666d6d5a8fdbf83396a30fdda5afdbe963438542

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9b60a5dc415bbe009494caedc53ec994

      SHA1

      d1866981216b222ec63bbac867a02c78fb52b841

      SHA256

      28859fb9789fe0fe8034aed030b5eed1b0db57b988a6bb1d946251cb18497032

      SHA512

      d557bbf395be01b6cea3e8eda25173bf44c97c2b1374f0efd0565e9f32be5040b1c65219bd4a14282a00fbd963d18608a3aa6394f52f091d6b2c79bc4c23bc9a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ba2b3e332c24d3cff7ebdc828777ebf5

      SHA1

      a9cc0b262a8018f7c5112decb092120f3b252375

      SHA256

      7dae1cd894fd1f423e8f7ec4f177ae483370426c1fc3829903eade15abd0a972

      SHA512

      eec02c7f8cbb70ce076011b651f8c2f5f2f9ffdb2fa7a76c2fa376adb8ac27efb70546b0e4d80291dac34e635c3d29876ee1bcb18794f60d7dd161a3fe237864

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      191dafd1ce5334ca648254e2b9b87d99

      SHA1

      2c02021ff360d4ed7c9ad733661139463b7d6302

      SHA256

      758635c27170eedc8880e7958600b8b63eebfb5bee19e62a66722ef7aa1767b1

      SHA512

      f4b63b451192385dd5ea443e9d91609bc9376e24932d9aa9ea5c8aaaac50af0991515b963c56b9d44e44a4fab4f2a8f161812617aae981990df0d933fe44abdc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a952d92b36d781ad606db4fdce7b2b11

      SHA1

      0289c9b5c529d55d34f491e6210bdc603fb8a335

      SHA256

      9627d69e050be2e89421f5ceca0737c74c05df7af3aace7ff01f557a15a16d02

      SHA512

      fff84f60c4247115ff9b83e81ddc6d3a004fa70242cdd46ae97200efaed9332016630a0bb242fbbcbc8879e5bfcd7bb8a531931fe0646f901e84f620005211fe

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      588db32e2945592e564f1b9143bcadee

      SHA1

      33ec7d5adf5ba09591fc069ac7b63e961f4c2648

      SHA256

      eb5eeb1737e54e2630beb5c62081af70c725f6929c366b01f6bca03040346b6a

      SHA512

      862515c99587217a5a67085d4ea24d51331fc8ad6a467eafcfeadb305ce249c483e80f85dfcf77bcbf458706dc334b99f64491d12c4f77d3d78c02e970b6e595

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1775f4977fd402900f5e7296935e5b29

      SHA1

      a1b2aa0bb0c3ef32cf1ffa8ac4a24e0f026b8ba3

      SHA256

      8ed485f14d27d2ebec05ad210ff2ac73c1b40662665c01f82990614add458df5

      SHA512

      d1ed81f0d3f94ea80ce18ea4b7dcf5817c50c440c39551501effd64b7cc7dfe083b8b355ae5d5a33bd48d91815ce22798c1824c3308549e14b9ea38f05e8781b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bb4d2dba88e871af3a677d51e2ab6310

      SHA1

      7d9d72513c037e0da4e7d787d28c4e6992511876

      SHA256

      703777c06278e241e7f077f35f98f9eb32ac045eedb292d1d5c201dc6b68494b

      SHA512

      a1df01d6c07e7df535b4dd93a689a999133295927ec27eb6125d832012375087daa7457b08a81d2afc12d2fa6d987ec3efac6b4c6cffce4d1a0926706be20906

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3a4026079513b1caf3c479d294e6c54b

      SHA1

      b8d34f8ad15a895f50ab034248ec1617a5cd1938

      SHA256

      cb61aae880d0c7a75b7a0d9252dab3396cdc91d72338037b11becbedff2a182b

      SHA512

      f61756280ce50584e4fd9202f79af24b8ac7b1afe8744b10fbbaf9eb222b7ae832d6033c8994a8895ec120d64e3ba87a32ee1656a22d304074783b346831fdb8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b692a861e2796c70fc3c586074ac3b5d

      SHA1

      7f039e5287511fe509d8ca5d431ce0ad6b1c0f38

      SHA256

      3ec1a7ab1d4e1edff7e80678d1246037ce7152435718b0000295d2e427985e4b

      SHA512

      f92f1a33e9fc9c56625fc289b70cad8c9b37fca85d917b10786bbc4be03c1bd7ee68894b69084c72369419ad74b1b89960d11e7edcf0fe9f7d70570fdc26b6ea

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      71c6dceafd5c1b5ca4d176a79a844690

      SHA1

      7968c70b377c65d4120ef64315b2b34a6e58d26c

      SHA256

      f4aa3ead21f005d53e68fed28d4bf0242a857d951866816fd36d443e626df233

      SHA512

      d5c8620a27799b26c1e3b148290004975ee93dcc7cd00c8227febaf6080946baa4739d87bc3ba5a679d3723050f0653502a05e9f0b93869db8aa1c662460e6b9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ca508b5cb13e69c60866af882c7699a2

      SHA1

      617f8aa1090979fa4417659169be0e9f9de87cb9

      SHA256

      778a306d1817a4aa25ad4ba362cc032d93598ec1f235c207891cf9fbd2fc0035

      SHA512

      9c537d89c4e55856980c038c2de36de714b6e96dc954250444a6d9733f4222223ace1f2463af8eb796294d1caa26b95dab70605644cf3432f8e720e77c1d72b9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9ae6f67abfe261acac27b4eb01b33c92

      SHA1

      05251f24989fa6f4dc2e2fd441e6287900df681a

      SHA256

      8368270c8e42cb69dc234f7b3467aac88ae8a5910450180a79b3ac99734d59f1

      SHA512

      9f16d96042a3e3291ee236e623774b40815b6a2f28122c7d2857e2108b4ad3cff20cc5d7244dd7e50f21cbdfed320a26ddbbd21c45d66bf85f51efb4064c60eb

    • C:\Users\Admin\AppData\Local\Temp\CabAED5.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarAF96.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1832-447-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1832-445-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1832-446-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2236-435-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2236-436-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB

    • memory/2236-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB