Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    18/12/2024, 12:47

General

  • Target

    fb9835d2aaeeff858a079dff41e04700_JaffaCakes118.html

  • Size

    158KB

  • MD5

    fb9835d2aaeeff858a079dff41e04700

  • SHA1

    6420f5ca39d0101c3a37cadf8aaef205511b1393

  • SHA256

    3501eb6eaa9311727f2c1b71cdcbbe9becb553642f1c9116783f83578c939a86

  • SHA512

    011014d810b1adadd63e57928aa250214124c83588af478ea81ee4c449cd119a2ee2814fce8b957c7c66dcf9e722c0d9c41de9d39d4e7b508820de5d7f42df5a

  • SSDEEP

    1536:iyRTjP+fnVH4LyNyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:iAG94LyNyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fb9835d2aaeeff858a079dff41e04700_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1380
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1960
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:628
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:537613 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:888

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      684e7c81bb1e2ea97caf15c4b3631e08

      SHA1

      bcb8580b7e0caa28107e80cb19360a17f4e5f30a

      SHA256

      356868f7ff359ed1efab7d94e57dc4979c9377ebdca70c2a62ddce0ca8e2a061

      SHA512

      efa23c424eab36095fce4d48aa86c82abe8b5cb5202c75db851b8036cd80dfd3d8838f0430f6770dfe9901600d9ec70362ddbe6fd6e9284fec7dc5c8502d20bd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2c96846fc2b473179b4ac9c5af4cb5c1

      SHA1

      985a85059434e824b8b7082abc03dd8de008c3f9

      SHA256

      353bf18509d4318d39347f8842423752fbd69e676fb851e21d0afbb9813275d0

      SHA512

      a02f83e63701b935cce25b20fecde1a3bc9984e9adbaaf34abf59924553362952664ed917e54d8a7517b4cc076ccfddcac824d9a4682381b1b88560fff1bf40c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b85b9c507d652cb2e7364bca2a158e94

      SHA1

      8b9fb358fffe2281843ab7ba90b0493bd80e4ab2

      SHA256

      78856ab045bb23f48ecc8a81b36ab8688c6964be87b8dc4590dc81fbcf9b4bb9

      SHA512

      3a444dac2fea1728cf3ce08e6479dfc223fcdc81ee0cabbb6eba6c8791096eddd6ea8455101e5e97843e8a186805c4a84fd0810bb232debd367d8889fffdddf9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b030b00494dcb91701fb17dbca8e8a2b

      SHA1

      5699a55a8659b1cd5a1cf24fbdd5ce61816593af

      SHA256

      95c9747f29400f5c8e36361a03bf52673df301fb8636e4cdb04376878899fb80

      SHA512

      40da6e276f4b5cd5ccb4adbadf385f6ad9387bd4066fe00c3f2d4effba15fa7838acb2531843f0cc8a0e75557f4e4585865fc3ae99991d72261b0d7a242aa076

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7bce3b4bded20ef74a6803d820f6558c

      SHA1

      be713707ed698f726713ace1454d31ec93c51a32

      SHA256

      e9244dbd3d1630951e319dc57265652913629427b1f213aa71a111e1cb661eac

      SHA512

      9a577ba79f7e2b2b474a144f0b3be05fd1e4cb39c5a45df57c527d7363e37da8b56f54174197bc5cc5e5b7dae35f987eadc4cfe44fb259fb6cf0dfd750012d55

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      56f891d6d6f6022efb1d38b73bed3152

      SHA1

      e9690437cec76ce4e848dfeadfa4b0b4d788ab8f

      SHA256

      54457978eb0a410f6a72e743c60c4f9a55144c3868cd10d1a8b907b5e8d579eb

      SHA512

      5e025460f2e62d675322e97f75b684d3439c518bcc9db31b476c96d62a6b9e37404488bd2e89fa8f5dbdafcdfb17a913d17331395adf17dca152342e72cfc95b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3b3f2d7f24f2cd0772f5d6e142434cd1

      SHA1

      1301837d37d80b05ecb8354ada9bf491b2c85150

      SHA256

      3dfdd864e1cb9402b5083c387316afcb4ffb0e907012ba34c9e90d60794cb210

      SHA512

      40fd31e692cf7b00c77e008dbc25c11f0435a959a9ac237c827e57bb3c3c19639e4b4ee9ad55b9146b142bb67c45e185974e0f10be18b16553ccb03e5406590e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7338d333bafcbfe8799ad3664bdbfd4a

      SHA1

      5cc6f6ce7990f24569c227270f41d8060865d991

      SHA256

      faafb09e1b1912b0cd13e678dc77716790cb23437a857edbab6a4272f9927e72

      SHA512

      62813c126c6bec83e371906fbe9f212e59cf745e3c798aff672ece5b315d4331de441fc5ea5d42e2d40d568db883319dc53d644f7d52f6b236c3e80e39c334ec

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c45581480da6c1beb8cd6d6ae6233da6

      SHA1

      75856747e18109ee940464b3ddf77906f524d8e6

      SHA256

      6a276a4eef9842e1b64f1706c8ec9ea2ee33664d916bf06e53b15aa59ebca656

      SHA512

      2f0a379a182fd0b949f1fdf44536ab51705cadc9868b60ede02143095ad11fa24c01c75066e4d1767d40f3d32cdae3cd59c2d5ca45fb8745456744eac6c294d1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c6fce8538efee887754126391c4ea25a

      SHA1

      0286afcd354a7a35301a3f72b40dece5c6e7d1e7

      SHA256

      e713abef9626f702b3200280afb6393d3b1e82a8104ff3b151c4270fa18fa282

      SHA512

      d43f034c3bc020f607834ef8861af899f12338f62e51ceb379cda05c162d1cf860eb552ea04f1ada118847b6aa062f3d80bca6d00b19349753472462494c09f1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b3d8459bbfeab0ab4d8d994fbc1d35ec

      SHA1

      35b096432db8542b07d67cfd13394453885671aa

      SHA256

      82307a1903672cdfab8f1c377997d9a64d80c7ec2ad997b2bc496ea04f611357

      SHA512

      a7e7c7bc6b37a43e342e18261eb934f5e5ba64a8f8dee5c11ee13dd5b0063366a7fdcfdfca3e054a3eb78c3e1d0f5e366e27bd68c6d7c2f585f7a841eaf3a48f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d21a4d30096c225da7236144367fb15a

      SHA1

      d1a4bcb87c6dc5c9e105bf9029658377437b0ac6

      SHA256

      db6f684b382d38b6dd1183c45a9947c1e75d9b7d6a829a04326b958733dd52fa

      SHA512

      b31fa7dd74db5db623de2671fc098f6c1723194da7af66b55b921849c167d1f0f790c75f9873ee2ef64c18283249275b2c7ff2bdd212255639d33b8f6176a09d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      090e0ce198dc7fff424e8ea4053f0dc6

      SHA1

      082a5f708c56976b7e41be351de959357ec002de

      SHA256

      cd38136ec13a3c9bbba7855e66473afc5048a92bb46ee491a7bc259c6fa776b8

      SHA512

      65d1542379c3c587ebe588e60a25ac96f067ade18987262d34bccb2bd04e430f1154356be1bde24c403116dc461fbcd1de247583c568e3f1bfb2086f0ce36931

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      964a71f28f798e9d8dec438863889e5f

      SHA1

      41cb4e5033ad59cf4180c08c77b5004e733ca709

      SHA256

      9d9f24440b072a9437a5b54959fb1fec29afd4aee183b025e578e251ea6f695c

      SHA512

      88e53d76d202d3aa638c99645603ec492c05960e15137f71781e9aa5db2ebf09651f6067d8aed332757d72300cdb2d1e46d8121980570d86efd8c961cd7c713d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      15f4e8f8a8c7f3ace0c1c77d85af1871

      SHA1

      d088f21c0875a65408c81ae2ef90f534f764c4d5

      SHA256

      a7879b057bf26aa4450145d166f99f22052c29b3fdc6dd5b6364916e0277c822

      SHA512

      69a5b49965a74350beb428f075a62d3a00faf7e1b7a55c59ed73fe24b57f99111200c412452a325f37852205a42be418455a239f35bbd739ebab9f98b53fea90

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      061ad0694b463557847c36a69dbbc4e1

      SHA1

      cd04c90f438593874226c0f3eed5ed55741d83cf

      SHA256

      80396844952065e74d38b4f22f725a5bda95f27907d4745f02d35db5e717c523

      SHA512

      e1b3cec1d56bb9d74fbd780dd15cc55b3e06d075834ad732a5811073df3cfbc667db78909aa5391ad1c8718c60c99fec6a637451db1e4b1503505161030b4784

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bb57614dae8eaf393cffe24b58d16671

      SHA1

      fc8c4a0d147c0f8a42df565b5013a3dd37652f78

      SHA256

      1e744c3d2a741264ece4e7fb2871d0da3d0a26e5fc638cd558a62bf176d59535

      SHA512

      e74fd5a7b3ed591e2ff8cbc87e2842c6a07cd8d50fb20bce3e2656385e1b0b2865f8bc3f2bd530832afe8c4e4c4d66a60c98a066ddb06710ec8966890747a272

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1194c29005a01d259098d756748dd147

      SHA1

      458e88c77a3a97e1eca85fcd85729891a9984918

      SHA256

      3f72fe222c37bb87eebf9f1318b36d466a2c8bbe20ba0be3727781eb6693ae08

      SHA512

      85b00c60085b50be67c76de8d9c56e94db7ff9d892b2293935993f7cc1074b17455975494fb2509ca0f10c7cab7a01028907a83831da4817c45c6b47b32526da

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      928fadc9b928925c74bd1bc7325e0603

      SHA1

      8a549a146b5b827564fa77d9bb88cb00c90c2c4e

      SHA256

      afd1dc63c3dc4640c75bc3c09638f6ca706c002a74875eba56ac992726d61818

      SHA512

      b32447e5de565ff26a3aab0cbbb396d02ca4e43688f580038c2fffa1af8d3f426324f902d77f4c056c1fc3a3cb0696b30d547657b89f4fa05d99218aa886c5c0

    • C:\Users\Admin\AppData\Local\Temp\CabCA91.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarCB6F.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1380-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1380-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1380-435-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/1960-444-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1960-446-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/1960-448-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB