Analysis

  • max time kernel
    136s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 17:06

General

  • Target

    05ab2330614a984d75aff6caad77c68a_JaffaCakes118.html

  • Size

    123KB

  • MD5

    05ab2330614a984d75aff6caad77c68a

  • SHA1

    0cdd714b232d232ae6e1f34fcc06ddb5a67bea9a

  • SHA256

    c8cdff24c78a0d351dc2c6e88d9c9312e3e74508a2d634a16b12aece46a62889

  • SHA512

    55db560304ee827d0e2a47dbf09a1a7eb20e766d72438dfe24bd9039bf6fc7d9f9c42f264c6cf47774bede0012bb5d60c6b42dc11062b67860898731c58e1f94

  • SSDEEP

    1536:a3iyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:a3iyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05ab2330614a984d75aff6caad77c68a_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2724
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1400
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:603139 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2568

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      f4ee6a5dbe1b423e53fc4a5d02484914

      SHA1

      1e77cb421df802a444a77aadbda3cc202a7cdcdd

      SHA256

      31cc3b83d36bf5d6619eb8191fe849b34763c4a9bc6e13cc56e009778033c167

      SHA512

      955795d6465fa58269545262bdd1dc698cc18c1768ff64614e3c2ec18fd0f3816d99e30622e9d68228bc42570c01b364d4c476fbdd32eab441f034faa9ec1792

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      89bdc0f79b2ee1b15bd58baacc8b2c51

      SHA1

      5de65c012d86f43110b5397d5b66e2fc2648d39f

      SHA256

      6b2d37a602dc196a9395036b4dd1793c8894c99313d66254b789d76373192c4a

      SHA512

      a5eee6236a08c6289baf05b7fe5f79bbd8084583122c28e90fc280126ba7221284ae2e91ebfcfd35dd35a79c80db72c01567b211bb7989f34e50e289a40c4938

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      ee2db8c72f3ede794cc7551bc69838fa

      SHA1

      c25baedec7b852aa26bb4fed7df13821afcd6f7e

      SHA256

      fed77a1b8c1f852685b77ca72c9ab289ffad56e7eb24ef162022358d441cb1e9

      SHA512

      56f90a3b3a102615c003d6583aba96832883ad10962edd74060394871b132e0f903cebc23c3f6371f7e510725fa4924b361be6f358d84188c8e9910226bb45f3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      d69ed3d47f5fa6ad6c9377409ac2d227

      SHA1

      e9cb7545cf374dd24afa1eb53005f0da8e0aaddc

      SHA256

      4d94e661cf8b1d9e1877b7f21f00c410ce041b625355fc8ae9625a9b4a7c4f1e

      SHA512

      1a24495affc232345bccf9ef74b585c40ac37010b927a831d57fa67a07d1aba29b3b354b693bd031247245355856f48e8fead76248d209df848abbaa3f8870ec

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      373c65e2bb297d8b9b9a1cec920ff244

      SHA1

      32e8ff323be2ba257027f868d4faf5d19a8a60a1

      SHA256

      d350bdfaa6de1adbaf401cb52b3ace330b1ab8e6ae5b5b4deba5ddd6fa469124

      SHA512

      bffe5c863e23016e8582c69a61c319fdca1ea08c0e83d3ef84f4bba5ae2402e50ef33a478cda56e73446aa93ccbc91c3cd27f8842c88d08e005e8d44b24d77eb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      845647ff3ff5606de5660beb3d54f78c

      SHA1

      fc79bd384e861b1350a88661f4574dd2a588c467

      SHA256

      d2528949f21056ad6014012c24342059c41f0229403921ea63de0e9585fd2e96

      SHA512

      80a73709edfefdef286bd73d68d85b8004f9ff48655039d4bd56d0843aa8d2874be20cc9e6b2580494c74a926cbce55d7c5cead8f7e435c896e830c1c60eaf17

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      aa2c49403d9af76db3c64d78127c7114

      SHA1

      7882fcd8e67dbfd4e2613f5428140bfc25f08442

      SHA256

      a4fd9eec5520b329f84a29889977649fb5101fb8c608d8de1b2ef5daacbe1074

      SHA512

      3d63bdaf9d67ef17a6d2c62b45b407dba909e3527a6f0b85433429d48bd242916686713f0b67aaca6fa31680c4e1b0942a17846be67de552df26d289debbb2b2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      57d4198c675bfffee952eafe90486778

      SHA1

      46919f914dec3c8f1e5f69b8ae38ba415a48857b

      SHA256

      f017b3d3db86cf3d6ea20687b1eb64deb7b46c4579fbcacfd59b1a9af7535514

      SHA512

      a61a09827b2e53ed8e699e02c9785964701d87bfe6db8f97af24c989db7336e7388a6a91710d696a4ced5068a0169cc5639019e767e94d129b1d9dde26c5f509

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      1e00c9072faea1158eec3fa4bca5be46

      SHA1

      79621cb27e69434630620e3d0223ff0d0c2af6a1

      SHA256

      e57ee008995a0053cbc8d018047c7af5e7d902f21881db62816442a77df9cb9e

      SHA512

      5c4c132e8c065cef33c865ffeca57219f7102cc0959b699e8f522f75e1d72a8e4076768c13c2bd0e741c26677c4ecb60daf41f02bc1f8c7bdd17b0e3cf3ad3f1

    • C:\Users\Admin\AppData\Local\Temp\Cab945.tmp
      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\CabA22.tmp
      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Local\Temp\TarA37.tmp
      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/2552-10-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/2552-9-0x0000000000230000-0x000000000023F000-memory.dmp
      Filesize

      60KB

    • memory/2552-6-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/2724-17-0x0000000000240000-0x0000000000241000-memory.dmp
      Filesize

      4KB

    • memory/2724-19-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB