Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18/12/2024, 16:23

General

  • Target

    fc450ec8b6e9d0193b94681e05329807_JaffaCakes118.html

  • Size

    158KB

  • MD5

    fc450ec8b6e9d0193b94681e05329807

  • SHA1

    4dcf076a371df25cf08a2bb695c5faf1e510e7f5

  • SHA256

    9d70c9a12971f5af30445b3b59ee34693ae4c8a8a3e2a6de04ac0ec4a31ec4f7

  • SHA512

    f66d02eb0a70660092e2ebe05e380a4ee70bc1902d5a7661ee064a91da3cba7476f7c8c692c24a95c11a73256817ea9325aeac940cec78e1098b4fee33e1f239

  • SSDEEP

    1536:iURTVK/EIDKvqbHedXMEpDyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09M:iGKsBDyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc450ec8b6e9d0193b94681e05329807_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2252
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2444
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:668677 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1520

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      49cea0ada2a4f5eb82e02f0f6865fd9d

      SHA1

      ce4104d9cd78a0db2d0c6987590c1d7ad7194933

      SHA256

      d02548b845033173ae6c74a9ccbf8d8e73ea2925868500c7eb1008c2ddab9b93

      SHA512

      b4886d1e223d89e04e220bc1844bc9371e08dc6ae29d494df47364e551bd6677fae9f7212c2b333a9724b571c03658f202425e14e0c4e77d9c27add33c742eed

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a8704e5e1d08309dd855907312cec37f

      SHA1

      cbb2f66f2469d2c8ff912daa8fe8176ccb50b988

      SHA256

      c422dba2ddd70077266d29d98010af83e9db023eaa19e0e419004886afa1fa55

      SHA512

      9b6bbc5de428eceaaf97059fe1f5c99676510bbdffebaacfdd5de739035ef9cad1cede62ce6131f6288b7dc8c57dad3030b36c05936f5708da244215e8fbe9b8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ea9d72bfc8577850a3bb66735e21494d

      SHA1

      892226317d955ccce52027f8ab9c9c92066aff6d

      SHA256

      56c8b790a3c6e07b7b62b22585ca8139d9b3d0aa5db9fa3ad1c1b432b011e0c1

      SHA512

      4a13937e53a65672c98894bcf65db52297736af290a0c178eb3fca90f39da3b5c696dcce4d32d2e90806309c845daa45e620ce21ca268598f6b3e64a2cadcf3f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bcad87a8b99bc6d8043980e395449967

      SHA1

      9dcdbbeabdb58d0b0eca96e06b32e9ca46f5a18a

      SHA256

      8d3a8dae02bc2c407c06e358580f889777a10bf6e32c2a7857b80d20d8b5507d

      SHA512

      35b07db3b1a30e622b4183083c45ecea367613070de9bf233322e014299630a48d3112685add6867e2fee88bc86d93b42f1ca7e81cbe6c6a6a3b67527e4d5b87

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e36d64d282ec4166f934b6b1c1a1ea22

      SHA1

      b8d8a077c558a639260fe6f44f1ef48d087b42a9

      SHA256

      a3a42c2ece40ad356351f73a31be0a9b2c826eb04c206c225579505f48ccbe94

      SHA512

      4e099e65e617ba928be15d4b983acb8614a834b9acebed45a2421f7131d71a27414144828bfd69239df1524fd7890054626e9c157f7e813b7d6bd1812d4487c7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      eb7ff343354b3766623a2878d986b80f

      SHA1

      2dcd3bf7452b4a9956789f7ff868ae28d1e8e949

      SHA256

      05cb7f53f0eff906a147ec99aeead25d8d7973d9d4f712d311be09438a0925c3

      SHA512

      dafe020483a7372b3fb8743efc41aeacd4d8277153ecde6516e2c1a63fbc0e5c7b167066e50fe5318494ac3cfa535a1119b4e64fdb107c0dde5a1454ce0fa7bb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      25748759d36f55edc9dc056d514fdafc

      SHA1

      a5bfb54e17ca4cf6909c2b98cc80e27c1e142f6b

      SHA256

      060a5d459ad7967182dda66da2632691fffe9cf1ba06cec76468ffafcc86cd52

      SHA512

      a08494baed21fa50bf21ce8b95b307fd7d0986f8edc9250247acd87e918364cd2606fecb23c57517831f96286af9b85c3a3434032cc0a1b61836f6aedccbc455

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1c7148e7413cc7c5d0322be9e506fb99

      SHA1

      58352f1221faf7dc66d538ae0e2213746ad405d8

      SHA256

      afa45bd17f98a67ceabc90cd60fbe7d6ae9c09441cfcd09a9323c9d5b23c0a1e

      SHA512

      b808d5e4ccb8bdc31dff6a604048432d1e013577fc7f0d68bbc462aa8f5237a9b74064867a846ef97fb98e6a3805369447312a2c521934270b4ab5df804fc206

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8432cae49f2c0f3518a72f16a78fa740

      SHA1

      45e8d814c658420144850e3ab72d98f39fd66b6e

      SHA256

      fbbc8ba5b636f78a7eb93651d89ade1fdc2ef34a48a642d3189361bd4f979201

      SHA512

      724dbb3e55f28cedace1bd043fd831579a4c9a9a251f37deb46e29a60adc06b9397d499a142371f0c69a4f0a00e7fec0456a02df5f743057bad8c6dcb00ac135

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8fa84c13347b38bca05bb9ea082fc2e3

      SHA1

      d4d6f797219541c511e92e52bd13152a2e4c01eb

      SHA256

      2485a836b82f39a6f92be68f851071c71f344008789f80a86fb6439e18120ba5

      SHA512

      5d6e985388936ccff3c62db2f9a6cdcbbf88297665d8f2328f09f5c2ed8c35c67fa93b45ccf0925aa25482a54485ad9bfe3d3067d0753aed42f88a4afea21e5e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c2bbffdf4eea8ec99d865624ca65a42d

      SHA1

      3fe606d70ba6a0cb17c667ae51e39902b3164608

      SHA256

      8d5bd2007676466d9aa2bf7c241ccb16d5d77e54d9626c523fb2c9112bdf08cf

      SHA512

      efdd5366381f665a96405c196c878d6442a174970aceefa5034ca26510ded63ec3212d2fe48d3baed2f3884a05a368196475dbb27b7960600fe93ab5f2a1355d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      482cfa1877108726f40dae2c69f47a7b

      SHA1

      92549792831865bcde1d47f34a51e2e3fc46800f

      SHA256

      b16e464bb2201b62a2c44cbfda213b88ee0d26267eba1b8cca727e8ca1877b86

      SHA512

      37d789f7d7866dac6a755bb9c7e26e15f43fa5b794b0a533a2592ad59c95570b3f445e77826b22514184272ceceb85061cda843495ba84d6f026b3f3ec89ef8e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7cd335e30fc591f6820ff99f2dc4beb7

      SHA1

      d78947eccd04e63183570b985299f1e568f44b2f

      SHA256

      8138d262e557b36054b0a7672af08e0bbaf2d210f3dad5eaf4e56c015cfe182d

      SHA512

      66fe31e16e8960834b6a5f4e2377c0ffbad40c4b2043fa2b13a52ad2664935640c8d43b7bb5f795cef025d509b5a1b5fd0a62e197209dac583272773c7e4f246

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      15e6f704cfc5e7674ee4e2761cc25fd2

      SHA1

      a1a18197f85213b075b6694228f06f6fb8c7b47e

      SHA256

      86599efc07d9e9a27f44987cdff3625b2817ac536fe64614c2590196196e4030

      SHA512

      2efd6c5e9260f4ea2ab58987bbc43b796d71f61e0e2e0b9946b5b622b7e1706ce34efe7509a2caf0beb9e035e52acff25f0f4bfdccaa759a0c322d6acfa33014

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      0645b38c8d81f415b44da3cae2ff23d1

      SHA1

      0919f82f5c3b8770c2702889a2707df844febc22

      SHA256

      8ae2c4bf29158fa47d2e1df6857858300b86b61c5a7739272861c82fc7b293c2

      SHA512

      00dcc2d2b739e633cff106a392598fd67ab0a99374d0e47e4fb28b5317c7b5dda2112b1a6495b67a633c649232da155923756eaf73605a75bb83c7893f505285

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      004804f5d9368e76d1d594a5bc5f8122

      SHA1

      feaf564c5ae9469ba8ae12b0a04ca6314812a9fd

      SHA256

      73361f54169f83c2193a5c3ef9d098c431571aa945ffd651bdeb9b492959044b

      SHA512

      edddcdf8991aff692d5ea65656b06721ca6f28ef94a36ecfc6ef133197a51fc59d1cd7653ddb083a6f63de55bc534117d8772f12d3351f459497455ce0e08666

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4b6dc085ca127e3c5c330c5e6aedd30f

      SHA1

      eaaef4838f40e7b02b0c3004a227881d4dcef335

      SHA256

      9e2336b1893dec27482082bd8c80505da6f67df46d2eaed22c12e2ffbb46af7c

      SHA512

      54c93351af16e1776c1bbe2907f9d4ea311e204394a1d008f2aa6a2ef55cef11a26ef2ac2f9f1f2b874152a6645661d45083ad582da8c70caa8e31375ff329fa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      37d45cc0417b60fdcbf2fbcac3159538

      SHA1

      bc286d4d117e6a4ad7affb7f50feae1942771902

      SHA256

      2c49e8e247cd3380251d4ada1f876bc5532e8107717f4ab8893c1ffd71f64423

      SHA512

      13874dda16d821c12d7e25ecb87b33bd318d8bad0a5d2003b335f1ef0f1ac724598b346f3b42078ec6e348d021a4f2fd93d130ad7fcdf3b1570eac0d885bbf56

    • C:\Users\Admin\AppData\Local\Temp\CabA5C1.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarA681.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/2252-445-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2252-446-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2252-447-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2252-443-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2524-436-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2524-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB