Analysis

  • max time kernel
    127s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 14:20

General

  • Target

    8e5de36f41a6077ac31d6f86963e40cd_JaffaCakes118.html

  • Size

    159KB

  • MD5

    8e5de36f41a6077ac31d6f86963e40cd

  • SHA1

    de4e75980d9414b649af5b1cf47b4f778228a563

  • SHA256

    fa1f5b2cad6dda5ce41505619657f6abada5502a7f89de64a0cefcbc9121773b

  • SHA512

    90271a84ada328a585e554d243f53518bdc35ff5a41426bff486b3f9eabb092252dc03e9cf00c99ddffbcc299da1af631b52e0ba2744cf962a376d98195006f9

  • SSDEEP

    1536:iVRTT0QZUus9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:iDPs9yfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e5de36f41a6077ac31d6f86963e40cd_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1424
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2948
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:604
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2988
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:275467 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1588

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      91c3659ddb9de50178ecf2b1ff480e67

      SHA1

      bc481b1000c83d2781c3c1dc330f97d9d5266c03

      SHA256

      910c870883d65ed48e1e97ee3c6ca6f2205ef0021a986f77932dac5ff687e2ea

      SHA512

      26c3c0b62ef38871b068f155e9b6d53600dcad07bd479cbed044daef6d0fab09695cde8e92a59f3270bf4df5258875f10c2e1feb58b22cf864c43db7f692e507

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bad81a3545cfdd38340629f0d8f43498

      SHA1

      94a1e7ed604c74dd60818a4a2db1fca7ec5f5492

      SHA256

      2f130d66034f0d52ecc3e3e736b369e22f25d7ac4ac61e0be8eda311996034c6

      SHA512

      0641d6e29710ec3e5ac4d0f157f93188c8454bd12aa848911fa3a198923ebc7f90b25dc329e0d1cf8f8dda089156e1f120a95284a6f07f963e81d147c60640f3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      cd01ffeb1faf7413e5b2121139df4dcf

      SHA1

      bae93ef91528e9b1ecc05e63c6cbccd98b1ffc78

      SHA256

      b8e6b2df8765a812531ad8c32471c046e3fefc0b8d6a822c9fd5783d56e1de1f

      SHA512

      fd6cc1b474bc01f7ccbbaa6aab6bd413073bbd383c40c6cb04237711cf9f1b1f2ef97a7fccd14c9cc71bb81338390ad31e2cfbf1aec3daa1829c56b12a8a9acb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      79143ea36cbe0b994db7353b2de5a103

      SHA1

      fd96cfe4045ad1f6d1659ced327fd03c5fdf9ed4

      SHA256

      7c873cdb65f9583a7220e44fa66b459b16a7e7d2a9d5358a6022734843264fad

      SHA512

      21709d6a84d44a2d4f7668c1b5faba046e7518a839863b5bd9d3e1ac5abacfb5bd6455040e7848abe7122a2633637328de910087269d1a3bd006eda8c732c655

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      203a111d84ca15628f464a883a9b3dfc

      SHA1

      822841ef1beab6da486ffe4a0d51b21f31bf5270

      SHA256

      9f68eddad2e06e2fd64867c6da5f6317684a4f9bd1e59b01074c4f4590109bc9

      SHA512

      efb3948b4aef838634a2efbb53a9ad5c391e1db6ee5840ce328c795980461accd3561f894fcbccb743b134d4eb725bb43479e53141da9c71787fae49b983c92a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      af7b10e31efbe24668e6bc4f4a949446

      SHA1

      61743cc97d8c6d9e17c1ca067eb47fbb39e7ea99

      SHA256

      5d6db2cd12a5c4b79e3a2376514ba568050d54cae6ef031abc374c9532576288

      SHA512

      cdb0111f85af11975db61d06afe71cb791c395012524a0c8cd5c2b7f86996394e7d3f59584e6d9dd40954203d374da61bcb3ae5e02539dc39e7533acef11080a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bef199548751f370f6b90473853297e5

      SHA1

      b8b2e5e3ff412563c668dda4ec795271b9bbca9d

      SHA256

      6b952e95a38307fe93bf51d8fa4f1f1f95f06150c7b1532589dfc560522a4681

      SHA512

      a94e35d721268ea1483168561203668be1504e660a5b36a5d49f199a8cd45492a9913faff850e69004468f9f6e7352f1b51faa3711e37ff21b71091a1417841b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      66fb6668229d77167ea98be6f2dd1620

      SHA1

      34a6445986075a74323b9774c777d7a1e26e003b

      SHA256

      2a661fe9fcdebcbac7307d4645f9a3a5a0811f7688c4309d265f19b5867babef

      SHA512

      ce0978f30ff686fa62f802c987701a4e251c258acd4c1834c87c5fa6efb2e98231bab079c6a8378447b8bdcb287c2d1ac13a8d052fd579d98116d1d3ddae90e3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      59b1d5db181d4f10ef27eb440b823176

      SHA1

      176d8be2e48731768fbd6c8df8791f053a0ea227

      SHA256

      2cf0e176f3c12d39c6b009d65ff7c042caa271ec32801122af248eef044716ea

      SHA512

      7b1648ea88794e6b6759d93f9b3391400a88e40f271fbfce17702dba62d05dabf936a79a0c292f2c2eefbf0c6a9de3e0d130cabdf6f478d80abdb897e793e099

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7a4123c008a954adfac0d86242b773d2

      SHA1

      3531970b563a079d84ae70720cfa9dc2c213b54d

      SHA256

      77239516e88f507babb0a1da669c9732078e76dd77cdae3f8d56ade284dd30b5

      SHA512

      db512327c40a02e6ac80283a2f3e63378be96d94c49ba5d0f831e949196123f911bd202064aac2f8158dc3fa19dfe2de714c597886a742751dafd91d2f106854

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      53234130243f938d6e5fc1c47f1c0b6f

      SHA1

      5d03d714919d3a5cf3e27f03ccacd482601f5ebf

      SHA256

      cfec137f61cce41255f19288a9fcfe6b7e12f68e8c3c33adccc083e21d442319

      SHA512

      ccc3a0a27156d7cea570d0fc7f8359f0bc618593510f08317d4c00189b2cf13dee789bd0d1e73dc1f60309931b39094fe80ffc3a4386824a499fbbfb4002a112

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3bb78d05865a3f6568d54721e58a383c

      SHA1

      b944cd879e317196c99f4930a74587cf449d434f

      SHA256

      af21415ca08b741f1eca3ea03f1d078a25c6d59c7cf414298969583e02661c69

      SHA512

      f0a7693036086e4bafffb3ca0b623b623f6eca9a0277084af51213aaf7f2ed2e47037ccc842ef5edf14fead1842c0351d8ecee0a7532d998bc441a116ac93a1d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4159df8fc59ad17b99076dbde0fd06c1

      SHA1

      da650e5b5f0a86331b9d5815773a0c0de81c0f88

      SHA256

      50b150a0589edb5d74b6ca130c90912401dc0cc4e75efbe8a43ca086e8686d0e

      SHA512

      b9277308664551e4bf76b9a08220ad5be0c8c476e3c2d8582db1cf0506fb60d684de55cdb375afa29830681e97ba28d9e0ab818b777183e56024a1f14a9a5d29

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c6686f2a07cffb1771349e5634f7de31

      SHA1

      c63e8579e8243c7a74b8974175f28a7a71aa749c

      SHA256

      c9077acb245bf27f7c59832489599c5d1b3b7aed62b840f13017e25673edb770

      SHA512

      3442c842cf6c263b60cec7ff2c97dbbeb2baf2c721ff1403027dace211c78417ae4f2e901e7c7de7670476ed2d5d6ccde1b296e08b3c2eb58af1feb5b694b0a9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c08fafd024f2895bed744fa8f7945b91

      SHA1

      ede8e4f854fddba80c63fcb481c8b1b71e402d6a

      SHA256

      23433e9e48420c5ce51f0a292a8de0a54e07c49e9cb21e7415b6d1837bb68b79

      SHA512

      8a46269bf9263901c8d6ad2c5fd26d2f07a37e50e6d3db6d21ae55e476d7a4384b12d712d838a621b9f592153627fc30d5ec6b71ed995d2b2220e0a3b3dc4dc8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5ffe74146ef7a0abbda793dc5edb9f59

      SHA1

      fa68964e12d13bb35bee2852d20493895f545f45

      SHA256

      97ccb45c70062ad97b59e4fb970bf7855b8c0d81839bf678159aa930d89ec394

      SHA512

      b8247477927496313681c44d878b957df431a4de14dcdfd05a045abbf8edb3ff3cc9899f08eb1dd70d298e91845116cc956a3d56a04d6aa98f207988597a98b0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f456e89c872261069dd5f2cc2e85ec4b

      SHA1

      e478d13d3f5c97cc8e5f3be93fc22c62531e6056

      SHA256

      16506e3b0f827b30a76df323488291a2ebf4e422ae4cecf27ddad373679a55ef

      SHA512

      13be9f103f9cc4b6aae5d24647103a9f34c89976bfd1d3ad405f11cacc21e707fa7bb51d812e860d9c24cd5644573d0f2661e2fd67a553f475f6f148313ae519

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ec61ee3fa821695c2f5e6f02a82bbea3

      SHA1

      b732f437104469145aafc36b74545f70d03ee10d

      SHA256

      2e70ae210055a163158cb30f1a23a553a138618422fb644e12a42fb37581f658

      SHA512

      9c62767db359228c44b94649c74f45ec36eb7aff22fc543888a439f3f10f12518805b9403606ded8db0fceb440077c771bc7fb30e325c892a34996dcf36af3cc

    • C:\Users\Admin\AppData\Local\Temp\Cab1528.tmp

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Local\Temp\Tar1741.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/604-490-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/604-491-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/604-492-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/604-493-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2948-481-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2948-483-0x00000000001C0000-0x00000000001CF000-memory.dmp

      Filesize

      60KB