Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 07:09

General

  • Target

    86456940f15005496b32151d18285ca0_JaffaCakes118.html

  • Size

    348KB

  • MD5

    86456940f15005496b32151d18285ca0

  • SHA1

    e34bf1d23c219c76772e9a2c2317ad5327f70892

  • SHA256

    4e9d41e6be5727a830b81ee41f092a9a3af38725897dd62906d410da2277e75b

  • SHA512

    3382517cb38a4e69e679300f27b173501382dcb6e06eeb034376b49737af16be03edf0b52d617bd78c8b481dbeed3ce993ccb40e77796652f4d924eed6097b1d

  • SSDEEP

    6144:/sMYod+X3oI+YjsMYod+X3oI+Y5sMYod+X3oI+YQ:D5d+X3t5d+X3f5d+X3+

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86456940f15005496b32151d18285ca0_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2136
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2596
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2284
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2496
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:3028
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2196
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
                PID:1552
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275464 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2460
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275472 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2208
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:209931 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1572

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          92c8b5479fc5d238787be45d0b598aa4

          SHA1

          99f4bf985342a993c2b236cf878539ef2244c3aa

          SHA256

          188910510e5d81f8059e8856f00dc1d229c872fdafdb8512050e777e9f1dc1c1

          SHA512

          22ce17aaa13546d3064c68d04b388d8b0f4c0eed60d1a9e8911c97be801c6810a721f95c3a6721d7af9d13bd9cd8f685647e5256008f7760d62c502efcdc15f6

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          c58a2a8845183813a3bd2315b9752fe2

          SHA1

          8b17ce739d2f861f6cdc436f64d0948106753a36

          SHA256

          b71b01003f8331253640f067b4098f746bd54eb094c4c04cdb7b1073e7e3983a

          SHA512

          f343077054c371181ede1c9769c01a6fb56e4b8a1c9e7ecd77201491570dace2388ea5ac5adb599550c24ce3c3cb8f2f28992e1bd5d2bdc010ac775d2239e3c8

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          d022d5ec71292f46c71ab04e0b780952

          SHA1

          865fe1654ecb3aee0db451b358af7777a09acce7

          SHA256

          712b0155a5e4aed273a77ae15549ff78104624a6c85e04f1e6ce04946d133a95

          SHA512

          4918ee459221a5f2fbb0775e3506ab9ed3bdad73802671971ccf6d7e27a1b365999b2a6655792c8d270d1d4e5cb907c1d9e12b199621db67eea85fc36604338b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          8b4d302913ff085ff7964f30cefe0a0a

          SHA1

          9ebe534adec0823e2a0f10b785e1f94b1a79f9ce

          SHA256

          2e778621ba6fc51abfb61e417bf844df68891246ea3cd405af2b378ab93fd0f5

          SHA512

          994fba03ac557822bf4280b2955d4d87740e5b2808c17c0e4dd0c410a356e2d002f3453f6f0f65562951bd6a5d9616425a3a9672a78097e854b21920f25152bc

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          a5a112c00b8e49ddcbbb86d0e70f717e

          SHA1

          a574080d833f262b7d8a4ef26ef33cc26988c702

          SHA256

          d98109397f6415bcc90164f80aea4f11df54f6661688b35b765288e2c795aff9

          SHA512

          c36232473221bee3119ad9d8c3ce0fe0367a5288028e2190381b4e4162cd048eb011d2b71b1000abe44b37f2877ef1fa1a3262b181df21a8905028e357d1a0b3

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          b80a51f94c6a7777e3b31910299896cd

          SHA1

          ab8c4314c1a5e133414951ee7e71abbbb89b4bc7

          SHA256

          5e1791f5676ee93aa25b1f91c4005d1da81d596ab707635b667af138e179ac47

          SHA512

          8c461748f128a71d51a0226902de60de48a6858e7efa46b95e0e0149769efa7360cc4b214b73f2649faa0026a73714c022a0c35f1fbad317c612cc0d940f97b5

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          a830a27fc9ff22407e30673bad27cb2f

          SHA1

          a31b1d0e0c6bd9a3af6ced55fc3b12a0058e6019

          SHA256

          b768d99ebfee2aa490d621dd54e241205e20ea9a434a2d4debfffd03e3544460

          SHA512

          433f2cbcc1b1fb922bcfa656f1d79ad9c5962f39b3acb8ec49cd52702af1c82f2f67484e733f5e34dc7785623dea040163bc63623b79bd7ba94a47ef796fcae8

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          a96d611a7f43da6a2c58f334a9f7f883

          SHA1

          212f60a99bc71a9c6ce98b17b9097e0a35bce2f5

          SHA256

          9aa5391d72ac9e4b0a6648f42cb09e4dfc83eb448898506f861cbc1dca3d58d0

          SHA512

          c4421d7d5f530ddbced388b0f28117579dc7b297a9a7bc6d0789f3694050a752eefddf9d566373e6601cbce0b6d32572c4c9b994c9fea85b94c4466280066d5e

        • C:\Users\Admin\AppData\Local\Temp\Cab1344.tmp

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\Tar1435.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        • \Users\Admin\AppData\Local\Temp\svchost.exe

          Filesize

          55KB

          MD5

          42bacbdf56184c2fa5fe6770857e2c2d

          SHA1

          521a63ee9ce2f615eda692c382b16fc1b1d57cac

          SHA256

          d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

          SHA512

          0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

        • memory/2136-15-0x0000000000240000-0x000000000026E000-memory.dmp

          Filesize

          184KB

        • memory/2136-7-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2136-9-0x0000000000230000-0x000000000023F000-memory.dmp

          Filesize

          60KB

        • memory/2496-25-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2496-27-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2496-24-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2496-23-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2596-20-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2596-16-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2596-18-0x00000000001D0000-0x00000000001D1000-memory.dmp

          Filesize

          4KB