Analysis

  • max time kernel
    66s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/05/2024, 22:43

General

  • Target

    14ce2b9eb290de782735cec1517af9e9_JaffaCakes118.html

  • Size

    347KB

  • MD5

    14ce2b9eb290de782735cec1517af9e9

  • SHA1

    60860f7535503279a4c76753a6876f97b8872b70

  • SHA256

    e63840e25d8e3be7a6be39237c8101c239c0f2f21e915fae66eca0aba37f014e

  • SHA512

    f7a3ec1537782c1d1883561951fcd55121c610055c8978c3a0b5891c1c69c88bb018ccb262c88474983f812d60d67c41d80c0d60f2fc0c703afbd781d2e6104d

  • SSDEEP

    6144:zsMYod+X3oI+YGsMYod+X3oI+Y5sMYod+X3oI+YQ:H5d+X3+5d+X3f5d+X3+

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14ce2b9eb290de782735cec1517af9e9_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2576
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1724
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1676
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2152
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1848
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
                PID:2752
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:537605 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2496
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:6566915 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:776
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:209932 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1672

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          a94909cd7fa479b20f02bf19a29b36e7

          SHA1

          baeeb7882a0bdf3d9b1c782bbfa9e2e0ed4d9830

          SHA256

          d1e4fee40a1955247e4974c05b43e4b6e1567670fa614ef9811e9439d9ebd2e6

          SHA512

          cec8ade66b825506c26fa556233bbeaf066f0582e6a6086809edb2afc0acb5433d7410f6b78b028a69339f3493bc0f65b0c6ff3bc6b056f19caaf00e9d22d5ac

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          e6192b9590fff78e9630b60ff4bfd02c

          SHA1

          7b17769278768750c72e74951e354119ba5d1e97

          SHA256

          f74234fcbd9d16a2a8f35fd2b00206ea80367468371488ee4d47a7f2ff641bbb

          SHA512

          da53af76b8243f823b1219d229002c87c8827b2b72372870a2febbb3c5eccf0226c9cc633cc14b3750610fedbb699f96ed70472d1753efc4fa0cee47b03be8bf

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          20a977eeb5c07c67ebeb603c4f64ce1c

          SHA1

          4d9137bd1a2a1e17671db441a54b4d92b3f3eab6

          SHA256

          3d127172a137629f443dca39d0e86c5eb4add956a60c2808a5cd0a27006dd685

          SHA512

          8d88bff78f63c152c4f8cdb4c336ed6a5cda67ce196c2e184815382785dad2c4d5520f5c5838e17f5c32bcd15f38db7d730bf4639078b79be71c457d052e61fc

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          647caf4936646c4b2abf2469b4e252d0

          SHA1

          1663282b36a5c417943185fa433f1753c79bdfbb

          SHA256

          7d1e86a7a1608c0dc607d3afef12966182e3d97f6eec3f63aaab3c7b722225dd

          SHA512

          bc9add92fdbb57be75d20125b77fd08ee5590146a2987767ec0649cc82388dcdd72494ed090a6148818047b7fef6f4d76a733effb68447e8bde258f08d279790

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          0df703fc25c88f2f63a55c38f3e73b31

          SHA1

          e884c9ab0f2d8404e942a26704d269252216389c

          SHA256

          37fb5045cf295f8eaf0bd112315ee73f56613a76076cec5f7fe3ebbb80166a15

          SHA512

          5975968ad65148c233c6508871a78337d4c8c2c404f8d440e4a5f06904e31124dc588235f6566673f2266bbf788c13b2516f24a57a0dd2545f7092d3c6db1bd1

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          c566463c07d25cd72bfae85d97e6d4f8

          SHA1

          7f0a6d9e34e730ed570bf1f92724eb30e9b7e90c

          SHA256

          8cf557c80c8d69eb749c8da87a428a22ea60e2ec693b1363a649fbc4ef8ed659

          SHA512

          4dcdabb287dd04e2db17dfcdc5969e339e0cf04aeb4f917711fdcab778c42eb9b991bacdfa9c6c1f7fe340e2fca9ad982fa7a814c664a3a40e34127a248b647d

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          3261c95e884ed31dd30de64ba91e14e4

          SHA1

          9282d629caa75e83b239657b3446d53d45f517d4

          SHA256

          2528a71a31e0621fa7d89993118c26a2a6be764efd32de185ff1fbdaf8836e09

          SHA512

          52089d2ef105aa54d8a334a92f887ecea5c7b3c492f00f1ce6fdc763ae3a33bb94f311eba5e242a57a4a9180f3b6e1f0e7b0676fdae5d6ab9101cb311f5d4a0c

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          145c8862f74d45886e659aac234d8614

          SHA1

          679eacd6bb70f0526503dd06a10b00a447549988

          SHA256

          8ad74e1457d1b8bbe45e6235f9c0868512ccc859f3ebb97d9573e1294b926713

          SHA512

          50a735dbef619f3652caa5bfabdf466eea406aec1a40d6237e99f1bc490f3d41e4e6b8d575c870b34608a69b8706adee9d957ae7a10eaede199aa0ffec4c42e7

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          eec5525097beea1ad275af1bfcea708c

          SHA1

          254d78e2c3442413fbc9d0c5db73ce53adbea117

          SHA256

          9bdbd5239291b8650ce306e8839c2b4aeb01474c0374f59dee709b239f4361fc

          SHA512

          3210d76074a4960c1770a231482d636de59080056193e0e8ef990bd04a88764757ce79c2dead776227a1d08781dc1e72b19827d02ddee17d90e3d028ed33cbcc

        • C:\Users\Admin\AppData\Local\Temp\Cab1CE4.tmp

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\Tar1DA7.tmp

          Filesize

          177KB

          MD5

          435a9ac180383f9fa094131b173a2f7b

          SHA1

          76944ea657a9db94f9a4bef38f88c46ed4166983

          SHA256

          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

          SHA512

          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

        • C:\Users\Admin\AppData\Local\Temp\svchost.exe

          Filesize

          55KB

          MD5

          42bacbdf56184c2fa5fe6770857e2c2d

          SHA1

          521a63ee9ce2f615eda692c382b16fc1b1d57cac

          SHA256

          d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

          SHA512

          0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

        • memory/1676-23-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/1676-21-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/1848-29-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/1848-27-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2576-16-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2576-18-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2684-8-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2684-9-0x0000000000230000-0x000000000023F000-memory.dmp

          Filesize

          60KB