Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    76s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    02/01/2025, 01:10

General

  • Target

    JaffaCakes118_61bfe3be7bf49e600923429210a501a0.exe

  • Size

    80KB

  • MD5

    61bfe3be7bf49e600923429210a501a0

  • SHA1

    21f03322be5f6511ca075a7ee82e244589ff4a72

  • SHA256

    bc2cbdd0432b2e82c14805fae8b528f3844cff0889c7440202a80e0e47530ac9

  • SHA512

    91ed61dedc5a33a3dc999836858b6a3ddb2234696b080a9a915d2d9f5df500d813cc10988577f514b43ebf18559490ef5ae2ca69d153728500e3f0a60a88d385

  • SSDEEP

    1536:c3jF2srzVRv7Kf4AH+pdcDJVoYMeKTn1Wk8JmF8JxFnSC7hcKn:UosXjTuoaD6eK71WkAmF8JnSC7z

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_61bfe3be7bf49e600923429210a501a0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_61bfe3be7bf49e600923429210a501a0.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1276
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\DesktopLayer.exe

    Filesize

    80KB

    MD5

    61bfe3be7bf49e600923429210a501a0

    SHA1

    21f03322be5f6511ca075a7ee82e244589ff4a72

    SHA256

    bc2cbdd0432b2e82c14805fae8b528f3844cff0889c7440202a80e0e47530ac9

    SHA512

    91ed61dedc5a33a3dc999836858b6a3ddb2234696b080a9a915d2d9f5df500d813cc10988577f514b43ebf18559490ef5ae2ca69d153728500e3f0a60a88d385

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2ac9bf9dcc2af686baa1e45bcef67f66

    SHA1

    be513b8d62d46d1970ba0ee66a88bd5015cf1808

    SHA256

    c21d548e3d94ebab47743463ac27783ff10583d58c34f028ca8953e956681456

    SHA512

    c015170f557a9de15e2191f6eb11eee35722cb24f140e20d5a866dbdca4e992bdc652ae32343d293bc565fa421f13aec29bb3a16fd70e97f86ef4f3a80b86968

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bf4088dffbfc9694f64abc04d61be42d

    SHA1

    a8d6c649931efb5d796e9c218726b55c6242a936

    SHA256

    0ff43b381c0d92031d2f75b9818976a0bf6d8583370032e383fbe329e5d76474

    SHA512

    123dcb47f445ade97a552f491d5eb97ec5ea01f148289089fc74a07b0c5fa371294cdfb1a730d85dcb34eb91453572600e9f2ad391c24e16a9ec2059c5c80fec

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8520b29ceda11d18913d250406470bfa

    SHA1

    f82884c6a872fad2c8fffa6111989c47a401d51f

    SHA256

    0fcc3f8a022b8e437a3e924eb86ac6b567b3f0fc47ef6a652ae6387ff1313308

    SHA512

    a54bac36feb8596c601c43f095bbfa439a06e818c201173f48194072de32ddf7b065a3e63977aec0a1d24e0a74008e417faa35968a45488ba0a0e239229091c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5a4021caba0b0d7ccafa52c66f3ce8ef

    SHA1

    f38ed055295fec668cd6048194ef65858376da2a

    SHA256

    2f2917aae5e75e53c637974c06bfff6d8f87bc3ffcead13e4ad70022c7fec92e

    SHA512

    76c21741d4c7c7406ffbbdffb58c586884bb652bea9e0c1bf1684297e7e5e52f20064f833c66fda27e16618f5ed1a171d4da63dad780ed69e44818ef5af2eb9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9d282e2d021d8464dbce6e67c1f9a761

    SHA1

    0bc2e2d535e6dc3893a20b8684f1c387facc7d1c

    SHA256

    693ad060062db6b035c8c49f0e9547db4e89936e4e001b9a16946c8db1687f0e

    SHA512

    0b517b2feff42ed4a6b538024125c73c527458c02e9728209d4ad6550241243deb67fb6fb9bbfb04e7f1ecb5e6880ff1b00a523e697c3ab175333f04e7841753

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d6a0080494e984548fbcc2969be4a71c

    SHA1

    8cd0a593d619dc44939220712c23e715cd90ceaf

    SHA256

    14c55feaf6c823ecfa41ba59ecc1fee43e71140ffa8c3b123e7d379da2374e33

    SHA512

    5790cadaf4021fe5f671fb125c5c61220a02ad5110258e32cbc53d1258f663eb231fb5f0ea428e491bc6e5c18d415a0b6a4c91f52a990fd3cd15c418c4284db1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ca115a505cbca28e632f2b9e836782b6

    SHA1

    7cf50ab3156d5cacc586709eb8a6b00cd3d9a5e5

    SHA256

    b28688b4e856c22f29b1311d96e57d8660197335069192cb5fe5a01c66b6cfc8

    SHA512

    469a8298f5cfbbdeb56577c3dc26b8945e85dd873f1c19b11d8a97b831ecfe13370c85aceb1a1e4c5c6fa2e36d82089f7a2d4fc3820d1cd240edda7c6f787526

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b7e06969ff883c84bffab7fe1038dd9d

    SHA1

    901ed78c385421efe724c50a0fb596e940558a4f

    SHA256

    3e18d9583af7bef546d8fe3f4eb36c5e21c366af1a915ada11e61b30c2735a3f

    SHA512

    fe8fae350bfac96a3b4ca63f5b321494d7de7f83608d6ebed7f48480e6907b95684b468d06a6d46420e58d2969516bb6e855dcf78e47fc6b514eaa0b9748aeb0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    16243c0a69b4c311a2d3f514e737bc73

    SHA1

    5fcf09896e7474e5a94614bd73a02cdeaea95995

    SHA256

    22644432175d57a92b0a245c6455d7aa5528040b2c3b9a80c6634b5817580f9a

    SHA512

    4b6bb55d8044d568e8ec01286446b37244ac5e32edf1c6a31e43db79ddaf602e8cef3d3edddb4e32589d1c5086fd2b8bb2f5187e4be6643634e0c876bedf0c64

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aefad5d76b7d53b89d61d62824d54cbb

    SHA1

    0cc8fe73bd85b6976aa1e523cb55f3a938635312

    SHA256

    7cf2b8af10d416aedef19931db9108da59030ebdaab8fde551fcafffd0870f96

    SHA512

    7de3fb4e19a6a84173f4c33e3c694fb820318777e1d3289840368aedb0a4a0c23bd5350abd3c61c74b24dd16764dd0a6dcaa59b84ed3a1b46fd32d50218026dc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0f6406249fd16bba8a0613c9f1ec588b

    SHA1

    3cc2f282ce00c753a08f8e2ba1da882dd7a115a7

    SHA256

    00737e053227436a5402fdeaa1157e94d6d815b65eb65a3e0f85063f0eacd8f2

    SHA512

    4e98cf30973d773835fe6d9481c3cef0038ec2daf558d946e9847f0e6c25467a4857c9e0189b0605da0b25efe13a08df4dd84723fdd20d0ff571acde410087cd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b3053a283feb84a2b98448384918a067

    SHA1

    df55ee278963dfd851a766f143234ae734013dca

    SHA256

    2c2703e3ebe6b6a453cdf7bff2255afc12424695fcac0561fdaefa228f01d621

    SHA512

    8cf46fad4b363eeb5ca13820fc97260c968d2a4b04d99a00774f0a713d113f172025e17c96f42f1bc50856cec6aef2c3d97d8d02a124153e81194894493894f3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f2d2d0b7e5801c1df7513acb241480b6

    SHA1

    9d74da7fd4c1f5f1c6b37084f2742aac2bae0975

    SHA256

    1c24c21aa9c578b2ed17a909aad3a10b1dc952be1bad68fe8a3709c32fb49882

    SHA512

    2b9284e61288ede2a4d17fac1aeba5c0691f322cedf75064ec6e7af05f545ec1cf56d99ae13e4476f6ed80f18c7a6750dd523e115dd58be86ac51e5b6a1c16ad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    18dd37dd4fa38bb9dfbd4c8d0230dc65

    SHA1

    c6637cca43b54cac589d0867dc9368d6e466763b

    SHA256

    1e88581e9d295d7f203159152b595c112af75aab4ca8cd46dd92c08d4da1f897

    SHA512

    f9ede767583505208a01548c0bb0ef88e93458870f3b8777006fb33d04a414237fc4deeaaea55e71c93befbffd624c5c0d077936c7c7e5375a9fb5cc8a56c8df

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    058559ba5fbf06d4a256e16dad4d1a57

    SHA1

    d57baa51abe42e86c9a0cf02dec8daa420786c25

    SHA256

    eabe34176d3196508d467140d71341a7840de5c7907edcddd40db5d5091f38fd

    SHA512

    6678a7955bf6d90bd9ae19eb2ab76aa5d65598462673f2bc0212a44a3c07cae9ec2f20901aa5dc66f4f59d96ab5f21499fadb839d98696b4007b4fdc823014af

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    99e0ac26510d02310306a606903c4561

    SHA1

    02a08c2c415b05ba1f149c2beb7e1f9bab1624cf

    SHA256

    0aa5bdeeed48be7680c238faf639e11737f0f76c6513baff0be09542b09ea16c

    SHA512

    16eae74c63bbc15426a5bb6f16b0f7791b1c241cca3b94e504af8d42376d321eea42e525dffb89a433e397b8799b7e6399ba16431145a09d7a62e153bbe64346

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4adae8a6f971307869bef2feef4fb865

    SHA1

    f53b6998ecb9c0d21607de0e262c1e75ab8b924c

    SHA256

    42cc4ccc276f922acbafb51f55570a7e9c7de4f7eebff9195cb9fcc23f1a5742

    SHA512

    a6e39900c006bc44f72df22a1dea07fe6932eec79ea119968a45548e78c509d9865ea1a0128488abc3bd162a4509ec706aa4a6f7377f0cad7ac425e595c1413e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e7e6ea0897ee4ab595a1b51c81fd97f6

    SHA1

    e52988e49d74f94bd6f9748e98adb2aef37d2d71

    SHA256

    aa9890864b4bb8cc73cbd47a31e6fb5c760aca78dcfa7c7413254603a85cd4a6

    SHA512

    b935c76eb90626b938a42e7c68082de11b415f32c3690cfc6a293debbf7f1192d6682b1ab59aa5a62ac9f753d0322f8980208a41cf4649cd66506e561eb78249

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a7dbe088642bc37c63f1ef235a2af605

    SHA1

    aa9ccbd58d40580a6134fdfa8009c04497d5afbe

    SHA256

    88a9e3a82e09390e6cd42867f135679dfb9a8e976b16f76b74dda97b53be985b

    SHA512

    6a55d1b406e1edd51a6133afe51a103f150efa3dc1f18bebb8044e8b7594aad9c4527c0ad19567892ad25f2c9b4870387ff2f7e36578b5e8e09ed9408b17de8c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2994d0d58d798392aadb0504b270fde8

    SHA1

    0adb98f8aa1abd5f8e24271f527131bb3c4fe161

    SHA256

    a18fad0d5264125ab131aa5c8c1eec900d356785e808862e6ab001d4c6ac1c93

    SHA512

    383150269511c1e1b38cf1ac4a0a994b4b2790688c022523132c6399c9b65f3184a6cc0e9ae3cd9e12be26949273c2079c9a3475d539ba8b8b7d9a330950429b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    200e9439f8f0e201405a6627a79a4008

    SHA1

    f0a2606f8d45215d7a73ecad00fd5d9ee78b38e1

    SHA256

    0734e4cb221fe46ae29ad4048b6af4a2775aea6934ecad8d918a5bd672ec6022

    SHA512

    276ff9f0c406bd409bad6b8ee0aa2953bc42bb4d3819c2c4611815092e68dd18aa0c05763a8ae67b637ba071a1c1df5051b33a03eb73256bd67bae90cd524f64

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b8d9a6a09fdbc69102de62b0d97e0a3e

    SHA1

    42be97d8b03dc89c837f6c197fe91f0fb28ad13a

    SHA256

    2f9bd5ddbfe11283c2226183ba4d6e72d89be72571c56af9240132faba95eb01

    SHA512

    b50e112d5eecb731edc3535ac8146aecc5f01f77b20d3c3119cc27d1421cb9bc394794b47dd1d4849ca148419b52481d342a9b1886251e92b626ce778e778b7e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    988ec29f47f0a1332cda35cbc463d534

    SHA1

    139a16a1dedd2dc3daced9f2b19469f678523834

    SHA256

    09db0783b444d5916a3935ab1e81415053ef16d42ce80bdef026e4feecc24c76

    SHA512

    375d3b2eb61d3e5b3683445588cf04ef3bd54f1c193b707e97b682559f9920dfec3d4b663d2ad3cb285a1ce1f58152ada8f1be3a8441bff35f2767ba6f3e8032

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d2bd681f92ed0c1de06d6256e7e20290

    SHA1

    0abb0bbdca3154069a1cc3a8523dfbe2353e28dc

    SHA256

    76a21b2da6e697cae7f02409c927a88fa0bb8beb52a9ab4cd28f176538b3bfc5

    SHA512

    04f7c055f951c6b8f4729b4baf34f2492152af4d48c17f26b5c39caeaaed6dfacf3c62656ec75044668842c85b89eb6c1911bd1e28ebef386b8327b9ea7a6ff0

  • C:\Users\Admin\AppData\Local\Temp\CabDB83.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarE028.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1056-3-0x0000000000230000-0x0000000000232000-memory.dmp

    Filesize

    8KB

  • memory/1056-0-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/1056-4-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1056-1-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1056-12-0x0000000000240000-0x0000000000272000-memory.dmp

    Filesize

    200KB

  • memory/1056-880-0x0000000000240000-0x0000000000272000-memory.dmp

    Filesize

    200KB

  • memory/2052-17-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2052-14-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2052-19-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB