Analysis

  • max time kernel
    118s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 14:38

General

  • Target

    05692140f4e5a07e6aa9cbf65e082f93_JaffaCakes118.html

  • Size

    347KB

  • MD5

    05692140f4e5a07e6aa9cbf65e082f93

  • SHA1

    23783865349f57c95ab623f7cf3dfd2dab9a0629

  • SHA256

    82cfcd0f6e872dcf09bb5c7774739a1cfb8f444334d4d56331b8a97a40b6af67

  • SHA512

    5b6616338d4363db5fba9b837aed2d145db835a5492bb7ee966b3dec15875332d794e4247bb8a8532dc1f5c7dc1bd9663d22681935d24dc3685dcc765c310b59

  • SSDEEP

    6144:7sMYod+X3oI+YptsMYod+X3oI+Y5sMYod+X3oI+YQ:P5d+X3Z5d+X3f5d+X3+

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05692140f4e5a07e6aa9cbf65e082f93_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2952
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2500
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2484
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2864
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3028
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
                PID:2240
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275465 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2488
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:6501380 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2344
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:6829058 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1700

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          613c543ddcdc4409637ddb2f0fc110db

          SHA1

          5b6dc0ab1b099528c38297581cdf8d0c3466c2b0

          SHA256

          088c7098a13579a79ecb0d7b22d58708726b58a8f0507564314ccf19a246b39a

          SHA512

          6da92faf444048d58712788848ef4b29e94248c17d4f33c7332d91a8c57eba08982239c2c53182207ba76d7b061eda3cf156cae70e33fd63c1f173391f8c93c9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          ded411084e8df62a6751d2c0e402362d

          SHA1

          1fd11e4c2e4d2c58a0f8c2f559fc741dc4099391

          SHA256

          b520ce2eb92995994f6b3ba6011ce295f23c50014ed095a7c11f9bc53d643a1d

          SHA512

          ebf19ff2ac8c645377b5ae017fdd39ec494f44d26640ea0696ff1a0bb01bd474ad567880690bc78662a94086d7d784fae29aac63c3bd0350533341d03711dd23

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          8ae8edb31a569ce07ffacb49e5b7091a

          SHA1

          83b1281a74916684d3e49081bc6d0c11dc7eb8a8

          SHA256

          ef9b202b3541b6f091ba6b15378e1025a9abc5d2c1a69b6b4749904a00c97ef9

          SHA512

          cb585fe63a5c76b14b1da8c7f6db06876021d9439abebaa8c7672e5942e316238dc1b2d591da4a3bdeff3b438b14ad6c3d97ae4260e121ccb6aa57ada431fa9a

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          6dd2ac2cfd797ce5a7b917ccd55fa22c

          SHA1

          7df2da55ce089c8aa46e1effd15582d0034fc2f2

          SHA256

          2d2f0f7e7b163791fa679c7aac40867b63159e9f69ca8e06beba7cdd95e210a6

          SHA512

          81331267fb23defce7153636069428bd25a4da10fff360fddcec7c5c0fe988f44c91a838173293bc4073cf4fa9621d2ea67cd42d1176bb80fddc259025ad37f0

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          6cf929aac7c8d373e1b46d3cac3414c4

          SHA1

          4b23a84823f2b71044cc16eb315cc364ab8071b2

          SHA256

          5d36e2fd55578755135b37ac1acd178cf4ba78deba8c2eefa3e4761d6c671b03

          SHA512

          1b3d72d4b5bccf19e1f402b2923b53f6f2846f3d5422a251088153c28ee47be93264cfd1829952963129127eb200c61af601fa8bbbb03d48c8185b7662ca4946

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          cb706207598630306fb8ce688343e6e8

          SHA1

          e06406217946e2d1bf042960b5fcc491e2d80f83

          SHA256

          84fc6cb5ffc0179b5b433ba6878edf4ac44e6fbc6da64f6dd2e58fd5c64bf3c5

          SHA512

          4375b36f4e28852963e56d9eba73f9aa6269a87848fb3619666f619c6805e76c7d85fd81f615743b7e19b4ca6b6d93a12177b74b8d6dd896a9ade5978fa91c7e

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          20e633b927ca2598d2734d37c98085a9

          SHA1

          d5c2ed6b005d58aa6d08dba27572e8fca12b1791

          SHA256

          72741c294e3c6528baa160defb53f5b23137fe8e9a2b4188957f3dc1e40cc9be

          SHA512

          b71370ab2ee7ac14fb6d96fd7d8c480b237eebacc377e610266dfebdfeeac6812646cab59c1a80611449a299b1d8408fa96e253d0c7f256b0713ff61296902d7

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          14df025b6f41edacb341ee371ce99e04

          SHA1

          2addf5e7a831a38c5724b8ffc278edf727c0b517

          SHA256

          d3729f7af4fc4ce8cd2cc5d63513de25e283fe5baa9bbb9c99d17d9c1541c994

          SHA512

          06bd8e560f47a443ae69c4f87c0a05547c0528bc78ef86eb86cca026769211c4911851710e6aba093df391f94c3302c67066c987812205ad5cc9a15169ca2d4f

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          344B

          MD5

          b83e4486afe3455ee8a401370c9e5171

          SHA1

          12f344f85900a3447e23b6b6fe816571f01c8e83

          SHA256

          04c00f74fb3b157f73fdbdfdc049f05cda07e67bd26155564086ad71d323ffca

          SHA512

          a128a06054141cd3297df8440a9464b26092d7cebc80c663a40daa6a3c7abf1b34c96e8d7f04561dc83238e8bad78c33e1d780df2ae7beb890cdaa254533098b

        • C:\Users\Admin\AppData\Local\Temp\CabBA6.tmp
          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\TarCC8.tmp
          Filesize

          177KB

          MD5

          435a9ac180383f9fa094131b173a2f7b

          SHA1

          76944ea657a9db94f9a4bef38f88c46ed4166983

          SHA256

          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

          SHA512

          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          Filesize

          55KB

          MD5

          42bacbdf56184c2fa5fe6770857e2c2d

          SHA1

          521a63ee9ce2f615eda692c382b16fc1b1d57cac

          SHA256

          d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

          SHA512

          0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

        • memory/2484-23-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/2484-20-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/2668-12-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/2952-15-0x0000000000240000-0x0000000000241000-memory.dmp
          Filesize

          4KB

        • memory/2952-17-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/3028-26-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB