Analysis

  • max time kernel
    130s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 15:30

General

  • Target

    058142b88f201bada06f297bf7f46037_JaffaCakes118.html

  • Size

    157KB

  • MD5

    058142b88f201bada06f297bf7f46037

  • SHA1

    458a2cf86228b2af68a98ee873222714612b02cd

  • SHA256

    dcb48d46d3daf1e15b34329b74e30b6f015d209eafb71ff5924f134cdbcd93cf

  • SHA512

    34710d8f18a460ac97aec937de0d9a3506acca5028da9e71855689d154c56c46dad9d1e1e70223c062f77d7fd9f23608c8ae0a645242587db8d8bcb0fe34c7ec

  • SSDEEP

    1536:iMRTN0cE1y1OFPANyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:iOo8gPANyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\058142b88f201bada06f297bf7f46037_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2136
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1696
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1912
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275477 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1636

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      6ff9d656d459c23790918c4056cb62ff

      SHA1

      ad6e2c43ac1eb6469ca581d2e04bf14da3eecb21

      SHA256

      6e731b076c362d46ad3a5292eb863df4c08c20992f006ce376113c97df899b3f

      SHA512

      819542dbcac33c8b21896d6fb7a375f4fa8e1cc2e4e004a5d1811840e9d8f4391ef1a85d07925811b857359e0d2e63d360bcd0c0319c8e53b8d79b82ad266387

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      2fc87cf86e6a4befac7cbbc33f7ff02f

      SHA1

      b0e7ea4e1398d3b88e9cc011316773e05a3ed779

      SHA256

      2294ad6b417adc3097a051cdaf307574cf7205d2829eb2adfa394f717711ba23

      SHA512

      818b95fc71b91005406cd9ee3fe809962d9588162f2db7b3f550c1684f851106f4824d55649762d42ecfd20e7bcc2948a9b2bfc016f232bff229e344fd3e6359

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      b58bdf2dc55f2a088fb34f5b1ff6cd12

      SHA1

      f46b86c4913a919f06b473cf4e4a2320286f71c8

      SHA256

      4f3df054c903d7a18e6889a322d73b9ca4e229589b464615961a5aa647c8b232

      SHA512

      d4eee8525f5b45984b5467e34e8901073d516cb0e9407c2fca48ecbe1d52c1d8c112f5216c6c77cb1bca875a5a4ec8dd776dd99bf0ffa9eabbd18edc8b0c0592

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      108996d6f0a727c4434b297e471ce64d

      SHA1

      f83ea60235f29fe0a0124106dfba62d9f3a6bac9

      SHA256

      e79958a02255ff83017c6a9f880ec1d0e1f9f2728a48d933efcbb8bc9dd945a1

      SHA512

      9deb916aab84cd8bc21b65be950e20a1ac7cac3f4315c5aa29a14c539dd049ec6f4979c0becd70702934f001e441a92500eb23e2cc8b25d0a4c73a020db227dc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      9d89e1183a180b64de7a57450fb8cf46

      SHA1

      f62d7d740cc3860b6ccdd7c6ea2cd9709731e825

      SHA256

      005aceefebb93fdc62e5850088c81bbb5fb5e990dde6a446593c048bc12b96c5

      SHA512

      79eafe66d255f9df5c6bf839cf026cf5654423be74fec5ffb1a0bfe97e9373ce512018b6f024422a011cdd664ec66efa2af043b1fb6942d6d99c6a58b012e353

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      b2f87e67f3b6866d5832ab1fa22dafab

      SHA1

      873ad4e8ef544b0afb8d5c12b33b8124f7c710e5

      SHA256

      521eba4e15642a9cdec0bdf836d9e5f02d44c7ccfe82149cef5e1df7f5c0ba29

      SHA512

      a2bedcca0e0d86743f0a0b897c4409e70ae903606f1fc8efa747ff827e17e4f3ead3383e7306553e5732e868ee3a6c6d78ab042c9f15c244dc9fbd58c9caf1b8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      c2ca053f21e24334c3c767e306634574

      SHA1

      df0a3c3a28d6677653946cc8c33c0963c89029b8

      SHA256

      4783bd2698d2c809f6df4826534182655123b43540082432043f6b8385153dbc

      SHA512

      efa8814595be637a4f6fcd52655bce5ef87d08ad8aaebd828503b6bf8ccaa0e4c4b1f2edc3ab0095bce778975377b82cf35bdfc1ef0d7adee711845fc4ec1044

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      0973c96849a2f42d14d5aa1d8d820b7c

      SHA1

      b0418eeaf101e917d484fb84dce5a4621897b1c2

      SHA256

      a58296192b2fe523ff67c85a32c478ac68abe0dfdd2779419c185ea628572194

      SHA512

      bb3901b2b6c44c8cbc79295deb76434ae8c5b9fe80c8bbf393e196a5914ec308b5fd4b7a9742d646855c5ecae0a67f4d619df27f691601686cfbedfc83679701

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      fad3dc0f424f6c17cf808ac3a151a37f

      SHA1

      4c6216ab6ba1e95104d76b6fe89ca9703007825d

      SHA256

      dc8caecaa7ef33eeeb9be06439b3a3bd257633f4688f2963b30abfab76743457

      SHA512

      50a10e72d59c1f2fc427605d68265eb5b7b3f6d1a3aeb0c7134d1eb42d7640d46d8358f3b0123504db3f87596e3b1b463df18c6d4d06aeefe57aedfce1a0fea5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      490b554bdfd943133cf6c31297934f07

      SHA1

      b6209998cc253adc0a7809850bb34a85c347fe81

      SHA256

      78e53b3384680bfa8cd0abb12bd52bdc9cd8f8287abf78aba01f8a0a2269faa2

      SHA512

      4141f4d4d32ef29b313e0e69756cfae300b6000f83f832a47829621e2b0231c0a7f10e13e40e6d817bc589b9c0f65eb114718b8ee80082920d8f2369ce22d60d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      2d98576fdf30ad475ee8a3e68de8aa1b

      SHA1

      37a0b2729ecd4850b68986ffb73d5faa53b9bf3a

      SHA256

      d8c6342a630c330da221b63f1df83de64d26ae29b54a0b87cf80035bbffb8eb6

      SHA512

      23b7d1e9569bf7308fc26eaf36099543d2c3d202a246d66e4d441267815989b57c57ade0e380a2e5f6cb59b3f4b2f005dc8d78e98a5fb9d10bcdd8b92db26be0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      f54306791b12b28a7462545711868744

      SHA1

      3a66836ecf12bdaa7f618cda2ea607da280c2a8c

      SHA256

      1612835b01e93eaec9ca4b3588dd3d9719103a0b77d335c35bf59ac3cede8852

      SHA512

      7a121ecd3831ddbd8669209774cbccd03d87c9677f29e6f8fc1725352acb934b94316b21b46948f38b6dde708ade38ca72ab96e782e0d43da236718a3d3c9bed

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      84a6f21aaeb997a5db4c400e4a8bd2f0

      SHA1

      9fb18a8a3d51a9ec0899b9a3eccf1e3c651ef1ca

      SHA256

      871274417b8a08e0233ab0591ed45d294418081cb2811434041f992cfbe7b024

      SHA512

      2165ebb33add7cd80122246820daec6523dbc50da7fb408e2c5a2a2ca485680e11d587c93dce5ab6ac5148787928041f33ea3b62ce7db5a39aa502354b9dc6d5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      d4a44a7dbd9e46e947bb9ef38267af21

      SHA1

      f8940fe76fd2667ac568e39882a5af05b3d27498

      SHA256

      1035ad9492e9c37ac39e5fd3737ec284c3265c64a5264aae41c11df5c49ceb9d

      SHA512

      0f3ce8c45e48ec16298a57b5a9aa4c6ae2994b42b6e0c87515e003f486b192525faa98f280af2ce093548cc1c62afc7f0108b7965dba23e30b6d387b91c47950

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      93e1403aa102c8e27d105ad723665c52

      SHA1

      a7e2e46cebe20ca78882034ca88d1924283b1ade

      SHA256

      704095edc81687252759500097681dd418ea9be1beb1af2c9b3c370cb593e767

      SHA512

      3082b4d614b5f0f0fa67e6068bec84fe5d4f1d77f0de2901ffa5651eaf89452179242e400e53cfc7ff6a02e5e1d1f3700273fe81e810094678b9f30f5aec87f9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      89d2dd0e3185e88fce988cdc55173011

      SHA1

      a7166639a2077caab95bc4e1b45afdc3e8c983ca

      SHA256

      e8f7b20f008caf629ce3d78c38de74c33474cc623b1ca6c65330e95e1f45db49

      SHA512

      e53752f8aaa725f221423ffc7a3512993cc9be6bb25a696e93c63abe13e4225da1f9839ffb519913a2092529c86103f18e8b6ac308ced61d502bf46bdaf82da5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      2b5346bb2adecb7eb2bb7454e13b1be3

      SHA1

      57b0c65ed7871dc44b767a52ee697184e40cf0bd

      SHA256

      40da0a83b5d5375c58339b186778f710ddc26ba318f48b934290ae284363811f

      SHA512

      cf03c1de5a842830b61ee6e45fbc516759f165803618c61df91926b58c72969883977da993208445f745af33c4073687850506b1818b9940ce1a574cc2906ce2

    • C:\Users\Admin\AppData\Local\Temp\Cab2879.tmp
      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar293B.tmp
      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • \Users\Admin\AppData\Local\Temp\svchost.exe
      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1696-495-0x00000000774BF000-0x00000000774C0000-memory.dmp
      Filesize

      4KB

    • memory/1696-492-0x0000000000230000-0x000000000023F000-memory.dmp
      Filesize

      60KB

    • memory/1696-493-0x0000000000240000-0x0000000000241000-memory.dmp
      Filesize

      4KB

    • memory/1696-494-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/1696-490-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/2136-482-0x0000000000230000-0x000000000023F000-memory.dmp
      Filesize

      60KB

    • memory/2136-483-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/2136-480-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB