Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    18/12/2024, 20:55

General

  • Target

    fd13f2b6a785a63926091acb1f483b9d_JaffaCakes118.html

  • Size

    154KB

  • MD5

    fd13f2b6a785a63926091acb1f483b9d

  • SHA1

    af353f98790244cec1cefec5d04644a888df80e5

  • SHA256

    04c4fc9c992b6662595ed1d447a75d7757dc74ebb50dd9e012cf88fdeefc8a6e

  • SHA512

    d9783245f1ddd6b5053867fa552db65962753444abd1595a20b400ec622474a931ea5bc6df804d8aebbf70a2f4aac439bb152196f51f92df93f87001a8ac0379

  • SSDEEP

    1536:iPRT3dFnOat3nzS1oyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:ihLyoyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fd13f2b6a785a63926091acb1f483b9d_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:700
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:900
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:472080 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2044

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      04a8433ce3cc6bf38e880acdacbad4e2

      SHA1

      28dddbb1330313869a8e8bfe4b9b69b19286c5d7

      SHA256

      1ed6e8988b424d22dbed8e7abf1b91dda8107b7443a2dd9430f70903dac5f6ec

      SHA512

      fec5a3160408107bf16335c5255bdcc2061962085a6bdc9633664d5757b311e835b7b7bfc8b55c508a75d1221227e9584d26050c0af65a9e2dba4fe4f58e0f48

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      38d55e06b2458e4748e9f96387d68f9a

      SHA1

      31669010e780cd1f16909ad7192ccd8c66d9e679

      SHA256

      d082d9ec1b5fdcaac2edfef23e56ca1e116fb8e5219e869623b4864d6269bdcb

      SHA512

      67b89a9683b2643d12e3ccfeedc919c4314cadcf1a57dd1c8f31ae28963b4c456c62111e8b92ca02eda8c367916bba617b0f7877b28aac1226a6ba14718f981f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6900380267359c234631404c6e8e2722

      SHA1

      f19cc236d8a0e275258b2a5b8fb99db1575233ae

      SHA256

      49f86126ddf937dcaf8443bf2cf6e3d847df16354964cad9b1cb3e663ad01d88

      SHA512

      78c553ab6aa1277c68b5cca06575ce3764e41360b167048c0d4dd1ae7178ad5374752f28b5933cd98da7bd083f2e634b094c097857777bffcd02b9e6a09fdf5e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ec71e83d604952b0a09818fcdbfc12c3

      SHA1

      249c19f1415c655ef4959c986e93ed64191fe140

      SHA256

      f9f65e917edd737ec9b3c640b76d011114898863fb724efa1c23d9d15e2b58dd

      SHA512

      b5672dcee103bf475789635ec813c2621278a048d5a600ea54d368c7d340f8168eea72e67c0c782057fef4f6885848d7116b4e0ebc72427433f5acdcda0b9823

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      59d78aaed59650646c38c302e2986ef2

      SHA1

      4d2069b71ae8b6c429c4ef5108f49e91b85277c2

      SHA256

      122c414e89e52d06ae263ff546cea44094c19e5b637a81700870cca477539337

      SHA512

      bc2f6aac45aceec4b0339924849405c76a0fbcb0b8ea73814fd54c9956b3edbb97ac053393fd2a0e4efd2ac850c6c920679a7cee63c04032f74f2dc9cd27f3f6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e6e7c6e4b32415df4a42481f49b0abef

      SHA1

      bef1ee1a9e8f0bfe26fe0a9ffe3a25fcdbe37729

      SHA256

      d6fe6d3bbff40b5ba5b26b1f306b0c27982b91286348fafb692ab2d3d267d3eb

      SHA512

      f2c80e7541121bc77375842ff985446d0edcff7f0359e4e65b03bf4520a37a1b7525d584368c7201cffcd6637206a30a8153fdf134eb621de561afdfb6ea9ce5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3e5070e1ddb005de5c83440928d05368

      SHA1

      d79f71f2e62970c36c08e9959639847e08e218ce

      SHA256

      2568aa43472a8e3e28d24bf444ee4839e3c8ac489faf6e427e9b259e0f3caf17

      SHA512

      15d6a1ff72c04cd4f920f92a26a8ab9eb7d681a2c30f7e9827a4b574d85ad36c6ca45cbb4304a2550be76b6999aeefd6ad7f3cd2e17ec39ec0592cc21db28dec

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f1c57b773c11e7437b1395a1ea9f6f66

      SHA1

      d086de949f8ef0d8e135ce92f6cbfec9823b0505

      SHA256

      f70c676ab72db6f2627b1efc43870d55b6813313719454d7b684514d7fb828af

      SHA512

      271b1653fd9c1ae2a2c92a6b145b626c5c4fd305e47e941c18e97ec49a9164027945bf406bd26d542002cf609792db06b320aeeefde17ce552ddd39d9c33a7ab

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      73a18a22591611b9b0045f068b5b4432

      SHA1

      196d083005af6a2f2b661e7510606b6b4e745a02

      SHA256

      f7a9cb278f7e833a74cd95a16e3bb9d4f060a44ff466d3e73a35cacde12c83bd

      SHA512

      a341ece4a37a7a33e0bf6733214916462d6a4d33a6fa31b87106e59adaec4f2adb8ba0946f2809a7ea17178e51547ca15bc0a5d4393dafbb9c95088e6f12209a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a2fdb1edf560418067eab601bb8becbc

      SHA1

      085015b83ad6aacc6c9849dfc2bf13fdb2fec621

      SHA256

      98133b4250827aad9830bc87683b2734e7adaf4ee2b9347f9ca29f1b0febf990

      SHA512

      254c2c01554aeff4c2c41f30efef1b3e328b9aa782192e5b79b51871315bfafed80709f41e8753eca97536d95739056b3e400356f6bf28c0d16fc7ac73110270

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7b0abf4a2309143c7afbb784a2a2f779

      SHA1

      2f77d33f0f80bbd527ded4d32bedc08bbe357f65

      SHA256

      b3e4a3eb8dcec232e16b632da76a9f67194f8d46fa81a13ec8b1ec1881ba692a

      SHA512

      f80e9dc00d5de1dd1487aeaf1aca1440b31da41111e3cff5aea06d8abb4282fb168e27b957551f5bc7b648a8f1b399020f690cb82de6681ee1c12195873af9fb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      16468fa3766a7c1aa0eef8080c476524

      SHA1

      cde9c5085ea370c3ac16d0bb948bd891a4a30ee0

      SHA256

      0b30c4d697b65eab7e6ae8c5045faac2f15b933ae63341c923e12d74e81bc184

      SHA512

      7a52b3b8be3e432fd80ae079f62aa024692d14b6ec11cd5e621fe6479c0d64720edf3afa23cfaaa8c7c69abc19bc08d6707d3ca683abb86d3f2ce02c97b3af00

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      0a424c491e1301341ccb52d80e7f0280

      SHA1

      613e7c7ab3c09a8cef1e6288283f454b22d16247

      SHA256

      2a625af7408eee11f464c1b9f754e62eb6bf95b7b0779720b38efc3c1e6f36e4

      SHA512

      d2a947a66a06cb8449dd2bea5efffd66da79c40e7edd728baef0ddebe5f3c0612bbb0f18a9aaf11eb9aec8abf7f4508e0e12f3b73535ade1d8e7c9af92b6b9b0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      05e0f6a7471724136b9f298bcda19f6a

      SHA1

      91b60ea1e199741f3a1b61daa885134291b2feb2

      SHA256

      c93ac363c83de62ceecec29a678fc1ed817a6575cfd933eea12135fe276a0ce3

      SHA512

      c5c83fd096b5d49a17d259bbba298409c455636061ceefff4928baf56ff294780367be6cfc21ad647d43ed7c6ada03fe787f525339b6e2d959e4e13a42d689e4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ea69c92b36a9b782cd33a5b37cf0fbed

      SHA1

      bdb99aa9cd9e1678cc6c0d608dedecfbf5a7dd20

      SHA256

      f1443522a15f679b1a2f94bc7361dc6621d600390a629f60fb9eac8dc0dc9239

      SHA512

      8b58c464d89f3cbd07c6abfb58e62cfd5b87b20f9fff0d49d771cdcad0a9b4cb523fd64d669d4ca114aa07fba44e8e907fb645c1db5255162df82a6fc8f34b1a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8fe9d9c73a2c6273e4a385502b5f3c31

      SHA1

      60c9964cb714d6b8e0e56a17529d1763722396b6

      SHA256

      7e4d9ac5b12403aaf7ec8b90e5d77f37d0b2db7f1937d2081e3d6b3520f2370f

      SHA512

      ccde74a2005427586c690e2cddd979da2a8b61d814062fb2c4623775cb9186ed37c944f17ec6bcf763f7a90887d6791c88629d77e58a900d0fcccd962ae5b71e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3186e66e136672216a675e3049ef0056

      SHA1

      9b29559c35ef60cab64be4104ff91d7d2fdbf89d

      SHA256

      5460ce364299382242206405bfb9ee1e2f1b498e47f8656b25b4bedc7baaf3ee

      SHA512

      7d9786ee908e6cc8344cba741f0956a269d9d92a0137b034e399d32091bbbc9efae091713d291cb410c668e677f24bc20c10d76299a5ec65e16d99f3ffc43459

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d8405632aeaa0060c252878fd909d820

      SHA1

      f40ddf31b529e30c461364bbf90b5a09bf6254b6

      SHA256

      df7c494a33a96fcacd881ac776f288c17a25cc42d46a8a6642c6d2d60e17de36

      SHA512

      1dfd5acbf1a351c1c7d74e26b2e4b5e1dd703d8ac1c433a65d55b0351297a53b14c47cad50a683bc37248bc06aef6d6a25c9b782d823d64d3cbbe7c328a56f0f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      13357584cf94ceff2fffb86112dad5af

      SHA1

      83ed76e3dd77f39d2aef74b0076d9a2c1296ed26

      SHA256

      48389f4bdfada46f66b336c274f906148b00b178c6fd3cbf9d4cc02b313fd18d

      SHA512

      dabc372a24510d05c6b6d2493bb6492fe9e351e67567a1639a21659295d3c03fdfe5a2b933a5672513a58f25e9117d2e31dad129290925cfa5b5bbe97526d601

    • C:\Users\Admin\AppData\Local\Temp\CabE86E.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarE96A.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/700-446-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/700-447-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/700-448-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2404-441-0x0000000000270000-0x000000000029E000-memory.dmp

      Filesize

      184KB

    • memory/2404-435-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2404-436-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB

    • memory/2404-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB