Analysis

  • max time kernel
    129s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    31/05/2024, 10:17

General

  • Target

    86a79b44081c2814986f59239d62ed0c_JaffaCakes118.html

  • Size

    155KB

  • MD5

    86a79b44081c2814986f59239d62ed0c

  • SHA1

    ec8bd90a4898f02197d1bb42a15aa4593075d588

  • SHA256

    d166b938007f42f2842c380054cdd81eb3c779749eba8791a377b739b5b95e33

  • SHA512

    3304eca1f57de271d64c1754feb6f8f9d7fdab0dc6f23a956b43a69145100062d66804135af67eb4ccc57a0e3a842b7ab0d3003700bf68f7a5b36498e5ac5a6a

  • SSDEEP

    1536:i7RTpN9TTElET6pN5jyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:iViP5jyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86a79b44081c2814986f59239d62ed0c_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3056
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:896
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2168
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:537613 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1604

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      993a216edba62ed290f577b6703888ed

      SHA1

      c5446976cc4bd6fe4e4ee18780e772c603ca080a

      SHA256

      f259dc83411bdcd9b33853ca6b09115e64dc3b9524efe70e4609c657f17f60bf

      SHA512

      23b04dabae5074996b0bca26721edd7979af9c07c3bd968cec3eb9d9abb44ed4d436e2618233359f89a963d3408326bf638fbf74eb351728837bce53acdf28fb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      40c985bb6e05dd5107f2466b5c616f61

      SHA1

      31d7f64dccc2e9dd6b481bce0932b94732c94044

      SHA256

      b301db3b38c52422bca267be3151d89a40f6c1a2ed0ead9268424f3f97fd6fec

      SHA512

      c3b1d45ba3d6019013968d54bfcc22a3de230ebf5acb27b32b53bd1f01737d70dfc774582d2873c0e2ac2a7405f91a886ef5f28933ec6cb98e80e57fa4df33dc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d233de4c24ebb29f57469420cbfaee07

      SHA1

      436ba5840161e6f551c4b71d30dc724ffdd4b758

      SHA256

      d72fd1e43c23801874c952733e1bd8da24ec515d76d59a1a11f31b431b0ffc1c

      SHA512

      acc9b8c82697ab59db624070d5d9e0bc5e6a761a7fa388e0d15a22226624654653d20e4b80a9f6acc8740323905c942fcb995bf4b420addcc0313aab82136505

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e93b1dfeb08678b5c0839ac4fb328ef4

      SHA1

      55b8ed62708fc1b184aa97b9caf55f91490a86dd

      SHA256

      51f4ef899be33e6d48615c80ee417dfd9fd02451441cffb967adc7973976b641

      SHA512

      c6c04b60fb600ad5cf8b246fd5282b280aaaccea26cc6f89233e12298c306fca7abf40e8773d2adfdd652f59da8d092624255a015f44e1aa4cd256736b0d733a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      253c892e4c3d849f3f1424881e11f6b0

      SHA1

      a53b9f303134ec77c6e86e25c6518d2658547d06

      SHA256

      c32d53bb0ab8c31935388f50487cf2f71ef61621b6747cd37bcb16b38b3d409b

      SHA512

      ba985bdd938926379d46d132e488d4501fb36fd1760695b835fd26af78120c030ff6d2cfb9bda344e7dce4c387b503d145b6403c07aaaa935b810631265de726

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      847dce5a0b346dfb3ff9561454c1d157

      SHA1

      f121e07417650f562b4a3f566007867106a17edc

      SHA256

      87fd35d143d38ef60295697118f56f426e5266ac366fa3be17362e873ba2b1f7

      SHA512

      f4b0eb80ee24616ca8e58ce4872ccec9629cf5d7819100a3a71ec3d37901149787036407d95bce94e4f596ec43bfc33f1631e811857eb82d65cb86edf66e7fc5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d20b0bdf52fec1c5957bd4f6a616fb35

      SHA1

      56eb79efe851c544bb3b0039cac23a3c8ecc0cd2

      SHA256

      325b445f8d92d4866d3e46633c0610a450c710280e1b51f08ad55862d65ad841

      SHA512

      7fe56501b3d0e84ececb59fa28d1669cdb1bf5caadf228465103f378d01636c1817276751964a275a66d3ade2a0989f7d137b1007e6a75ba7a70c7c0c9776649

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1cf485b9879570b9c87478230b1e457b

      SHA1

      d091fe1a43bedf788000e795a162cd7bc24a4b8a

      SHA256

      da5ada40c0c52e0857b01c25ee9a8d0d4aab6076a8ff4652d9e099527dea55d1

      SHA512

      0d631dfcede14c1cd0ed33fd7b431f09e514ce4c50993a8e1f80b6f215ece0794dbf5009f0737671c234f641be2f5b9e812b9031e1ecf497d8dfb97386bcab61

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      653242359c89d68cec0aa45efbb27f85

      SHA1

      d77d606652cab7126aedde718d7b82a24284b324

      SHA256

      60a582ed73c5ef3efc3cabd1654b8b5060e17aee26aae80a2c3abb6cc332d358

      SHA512

      38fd82464940ed3bf4a64222e02c46f19fbad3b36b425ae7824f3ee3dff1dddde5977d46b6742bd2d22ca90b7ddc2e1d70beae1e6dede75eeea412b7b7032d16

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e4a3276281bc9bebb39794f6c1564ab8

      SHA1

      fa4bd877ea143ef5cc1240f44dd1bdf930e738cc

      SHA256

      79bc4c4ac4080dca1e1a26b3f37736efa2efea38ac7be169f0eec2d5fa5b13e2

      SHA512

      d4c3ae0d41259835de3a21c7d10453b20bba5f54ffd4a2a74947f53c8dcaec3720c6f65a27948d2418aaf8edc8caa06d80d303bf9ba180019842af794dbf8f43

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ed75ef5f163ec70d9278247f13376cc8

      SHA1

      9b2f480ba8e13f5748d71594772a973b1dc68896

      SHA256

      be8708d39f46b7eb45e2fbbc0964392c56e02ed9fbf26b81abb57e1631c135a1

      SHA512

      a669f484d337e1c18ec42415141af25000fbc61c6c373a08a07cc61295bc9617133b082b122f8e03f9711742071a4f1ab61c43607e70e465f0ae25e62915601d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8c803b632d355f621893cc4c453560d6

      SHA1

      88298fdb90bbba3583775287701da84e3311da03

      SHA256

      ea2c253462ec69f157dc242a6575b5d97533f67325358bd48306c4b407e99f69

      SHA512

      20c8de0f66d75fbd58cd359b539c5117062f558a94646d0336ced2e5bbab15d84f66f8135f10b4b12846e580cd9d61887f8a096f976edae1e4867e9c78a5634d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      37c65c73131ad1e4ec0914d2997c2650

      SHA1

      bff803bded2d1b71776c959b0d642832cba417f8

      SHA256

      7f0ba755c5c20681d69b7b6a87b808ba335e8705fe5acdf67b6a5a4cec9ec46d

      SHA512

      cc62d3e8920e13fdb07ad57bdab7aaa03501db20d5ec311a4c315132444c36ce8ce9958d549b134bac1acd392c050bc9b80ddf82844df9d8e59545c1c0ed76d2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      82c21d09ed4ebb7e307b55ce5a48a309

      SHA1

      3d8cc0ceae4faab90d19998d39d637e604445c01

      SHA256

      fdb5e0d9dc77cb8cbbd93cc8719f8123b59a4428ae7e1da5250b41b046da93b2

      SHA512

      9d3d611e3ba7125661651ab4eda59d85b23d2d13f5aa70358991eabcf6d0cde1fa462e00153a720c49ce086d3b7c2cafb4777c1f09ce0520be53d61aecc69790

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      39aba043a300e4e96e2c6a483cb0fafe

      SHA1

      ecbde030bca95e6250f7f22d91b319d6dff784c0

      SHA256

      0019724f007e863b11157ad24f7743d5aa83fa076e1e3f662db0fbac9bfbc073

      SHA512

      09c8886375f653674b199516b5d9a3935a6ae8c3d92f60f19b0227e6f7434eb7893facf0df4ad2185cdde5ddd88a1b2cdb3c680bde1ae7fef8a0a9c4fdadf771

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      90154b6d1b5e80b4609a8f0891691080

      SHA1

      23cef7ba19b1f039a42342fc0b41e25651fea047

      SHA256

      cc8ff729fa2bd2d7db850fc01526274f721ac774b8801b4aac7d019f0583184b

      SHA512

      ecbad8802da82f746fbd5bff6f97070df00d23a921870a214d9c57f9c9b0ba453d5a21b46c28b680b5f0cb8437ee8dfb317ca11ae048a4adbaaf8c4a0a100e0f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a70656fc4f7ab2d8d8367371863c689a

      SHA1

      2bb2329512ed3aee67c2bd85fc5da30b2c0bd6cb

      SHA256

      e1554d6d4773e9a3ec50a3c894428febf3e513d2136b8f2eb25946d5a8b30eec

      SHA512

      e073707e50052e332d25905885bbfc4478309595cebe7820e94609d9109d52c7aa61cc5e949d8a544f0d91a0340c92d8ad9a5c38c39a2e718ec40fd9db1e4352

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      dd3472e6ad42a70a7249c5602e3dc227

      SHA1

      e0271472793a3369c4010fe0f4e88a776b1bb037

      SHA256

      97720a89a486bab0918b02fc04fa6bf54ddc5dfe65f50247c6182c9f9768da15

      SHA512

      36fc3320cfd079ac88cb05cf5323ebc4def457a24e8f7f5b0655a493a2a0ee984e7efe5e81b91f36a6d83eb948a9554a4917e945b4c7244f28c0e48771bc5a2c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5d445bb136b37ef081d41b1fd1bf7182

      SHA1

      e77d021d88dbdfeed7541096456fd5d3e5ad0669

      SHA256

      eaa8f86d292c3f98fc86762a2700c732a7be8731611205e164631969258d6d89

      SHA512

      e05f7cfc61aee187626e8bf1e1001b00be43f5bda6c451aeabc500731e3a1617ba6571ad8744c32787f038c3ba46298d913efb438ac23b0f302cd266a340a707

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      555c84def073cbb9cce782b7378904ad

      SHA1

      b586832515dfb18470107baff1e25b8fe2fc4459

      SHA256

      38a864f74e461750dd2d6877d2cddebbd916dd4dd73ba2be118b9a7a9fb782f2

      SHA512

      8c8fb6577e0c7a45932a7941f63dfee08bf867d8475262a17df0d6df4de2c9eadfa3aaa4760203d8c5523f062f3b562e6666f155d85252754a6992675f006d59

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3bf5d5b89a56157c0ea0f67c2ce3b996

      SHA1

      9895a48ed2d3b73e26e88703f47c4710798ed006

      SHA256

      f804bd40337577233b5f7b86b79c24ba840bb942466b8506cd50f800b0bc60c9

      SHA512

      9312edb9cf69c9b18ae4621bd2d779c223e5144a2ab5f588a19c9fae61f202d054b8797e4e90a28e5edd9f589f426da69f65ea759eca7cf3c4e4e8c8b6cf2eec

    • C:\Users\Admin\AppData\Local\Temp\CabEB2.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\TarFA3.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/896-491-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/896-493-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/896-492-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/896-489-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/3056-481-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/3056-482-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB