Analysis

  • max time kernel
    132s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 08:51

General

  • Target

    912eb569c08ab256a09a779db9009308_JaffaCakes118.html

  • Size

    157KB

  • MD5

    912eb569c08ab256a09a779db9009308

  • SHA1

    da1ccc1b5c3c3739e4bc616efa87ead69c0eb6dc

  • SHA256

    286a48a44b6801c8d29a0d45a1ee2e3577f44968641aec782a1af03bb90c8234

  • SHA512

    2596cecf6069c747fc0c1c83569ca3821eaa427296e8989ed9df03ce0b73ac4000789ce9d4e73bd32f07f949619f735128a41b38955a8156d19f5f2c54361761

  • SSDEEP

    3072:i3mxIIAdEcWyfkMY+BES09JXAnyrZalI+YQ:ieIIAdEcTsMYod+X3oI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\912eb569c08ab256a09a779db9009308_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1052 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:804
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2276
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1052 CREDAT:3814410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2284

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      726e65065b885379ee57b8d9e9f1fe07

      SHA1

      969c3d6ee1f254dc010cf623cc32f5830210a1e8

      SHA256

      ca75b393fcbcd1938a6566c7dae72bfac7832acb2f77f2939cf5d513bb38772c

      SHA512

      737be6cd08798a6509a26df1a394f66cd201bb9492c1710a5ad8bd5be6bd4764ea0ad7e287e18f5333e2d1681d3139a259691b37f31acd9f7028d51397a04cbe

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2b1feba184bfc8c518005dc5801b19a9

      SHA1

      201a192a1982963c8976a46b562ce420734aeccd

      SHA256

      bae038df6c3e717bf08274d5cabd79da79141329017e8e2e944be78f5ebb3f89

      SHA512

      1038f2af417eff055abdc315efa9a670988533e73a25eec537f02a024baab9a06aa2835e44e78a3493a5aa95602478083df9d94cf3cb8e251bdd1603a88f9f7f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a751274e434681c205d2d40ccf413b0e

      SHA1

      5c902ff600318c0856e3844984d3ed396bdc4686

      SHA256

      7c571f91148b4626c2c3d4e4f647313f899423b3a1c00e859a8c964277a0d02a

      SHA512

      2ebb81e4392cb645f3e78eb110c4efcf92fdf571d368a0ba62ba89d0770ae264b9494bd9060ccd0afe7db5d7c8eea2d728022628e1150b2d6a8eea7c49bc99b6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c51c574a591c695923b65ab672e8595b

      SHA1

      9bb38c60a2fa1af6871334682d5ff149f126694f

      SHA256

      2a7addc055b455abbf31ebecf7c7c9c8107eb0d2e54f5386388893a612e75eea

      SHA512

      3475ccfaa8728807d50c97ecce4d7d9641ecd38f62c9ee9d2b2804cdeb912ed251ef56f142c57b27144fbfc577b315c44edd341418e13c1e39852fed23c1e73f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      00eef249bef57c33edc75e41386b91d8

      SHA1

      e3af1c4818f600b19617f05fc6a8af291e3684e2

      SHA256

      f2f1b18841e466ac9f916db5ecbeca27e9e906f1809044658c3021875723e724

      SHA512

      420fbf62b11fc6d16cdaef7230003ab20e85d91c68c66a73b97f21bdd93a440a046f03e51c932e3ddaa532263ce4af0b8881c689ecdbc616209014967927f04e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c41eccb35d31668994020413aa69dd3b

      SHA1

      0bec36f7af4426e8910f5a53f4fe5382a3b1055f

      SHA256

      236d029e25c7d3926fc6b1a7ba3f04aac5235db9e7c3e9f53cab03c44c87582d

      SHA512

      f0a16be191623e827060c944942fbd6ae92beed07194df654457f1de64b2102cd021c96934b58a8293004f2ce6b1fb165066b81bc6751ce9f9457e2ceab2273d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      869b13aa180d5359a03d5774d772354e

      SHA1

      631fb2ea12a6fa2c57d321144bd21d5eb8802990

      SHA256

      cf7b28e021bd0ab92e3b0812bd0b2e1a1ba701f743e3fa8b97dd679e80ee83c3

      SHA512

      e1e834938d306c62849dba74c28a6c9b033256b6a20dea5b97f4ca7c413e3d41c5635478e179bbc25c7e2f3174105f6c977e06302c869366c98d29cd7f12bfd2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      300bc4cf2f87a7a7d96307f90cf0d910

      SHA1

      1ea8f3cd52cab252065058b1b8ae546df5587c8c

      SHA256

      3b4852ef8694d180027a7a5637fb318f49cad097602db6217d54e1af41202e00

      SHA512

      49dc19d0564fe992c5cc1f0a2bf312bf52063e1a557210bebc34eea536a3fd4773bc0a9bd9b3bf43cf9a0b24229eefec925bdd39ccf1403671b36c29e65d5985

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f6abb8f563831223fb3ba4b3006321dc

      SHA1

      c9ae7b94bf76a7b142b2ed34a04d14ab2750369a

      SHA256

      9408d8bd2b23f7515e826495feaf69617246020c6f5596051b3da9ac3ba57cf5

      SHA512

      ca35b2d5627c9c58da12d05ceb0e6f044901a4fdf39b483fc81e2979556b781ba7daaa18ac85807e78d3832f0fece42f55a058b67483958bde0d72bbc3dafde9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9029d62282dafebe2b6eb11af17957f2

      SHA1

      519708800706a2e74b58a42b4d891815773bd37d

      SHA256

      f905aa5b497d80e1d7300571f6710742e3978c17ec3504924718af4cdecd877d

      SHA512

      96ef1b9af240983aa7b4ab1b060fd6cbf4fb85fcfa94aeaf34fb605aa89e1e4b8ac0524dff7fe2a9bf9fdd88cc4611fe35e8b4988a4a44dfd51e8aefe08105b8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      fd8d2fb26ade2222961dc35c10d12a34

      SHA1

      4699a6779a6cb99538044ae25609af61d001267b

      SHA256

      6b6d6e1801b765055065bc189878bebb5ddf9e64cdd3a6d583da1d15db9c1256

      SHA512

      ecf8d0b43a93a425382f3303096cfd4858adacc9d5d5f3b22209babe22ac475565eb2b17af56ccab4a815d3d4bc25cfde6be2c8258c3e5fed26463c95ecebbf6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1444c3b33abd46731331779553a96ced

      SHA1

      37ddb533f5d0f16b9583a6312895d0058095cfa1

      SHA256

      4f569f7e46735f8193fc27308c40ed17921577c6054617a7367338ad395f7dc8

      SHA512

      cf3489291384bce4864f48e384ea59aca6a822d55bedda5b6fb054ac1aa6a29e5b04ed8c14740092d29cbe137daed47dd23ce1dce582b490b3261f5d8db9cbd9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2d111b1f7b12acde06f41f33d3013116

      SHA1

      a0be7f6fe3af0d186642aba4352258921547dc8e

      SHA256

      6825950ac2b9ed5953f7365b0af0bb0db2c789baff958cc2017f0c7037beb066

      SHA512

      9eb1ff27ab1dd7b03d3870f4d5ccbe3745de37b62b6fd4b2afac0793cfeafb313bcaa942a446b2805f0fe89d90b6f69ce04280248f3b6bbfac3262365b99f6aa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9df7b4ab98751f873eb1dd1e2db164c2

      SHA1

      a1fb4b36e2948256a977eddb126ed4200eeeb47a

      SHA256

      7872801bdf3aaf8c66b7fe2d42ccccdc17385075ee90407cc377d1c629aba2a7

      SHA512

      6c6edc1ac139162c8aadc948f210948f4e80de269b3c0fece2449b26c9777394e71557cf16083fb4c42c0592630813c5766f468117cc1a1ddca6ee8853eb3617

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8204a546b36c6860e80a3da37adb5d81

      SHA1

      314c6c95b9704cb87eb01ed12489af0257cd2e29

      SHA256

      caad0573ec824adb51a0a2251b87ceb94f5f57a250a0c6ad2f22ad5193af83e2

      SHA512

      1de9009b6e72a5bdf5f13eb22bcb0b1d4d3f86127e8286f4d10845d8b374455e69d73571fe9d89356ab3f78fe72c752e26ea256526248eb19832cd1f1430b231

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c9590c861258309a9c44ab7ff41d4f77

      SHA1

      6f2d13f87c7a57360eee9417603a78cd67eb52fe

      SHA256

      c0bf38f57809e59f00c70b12ea62e4984a688a185ead8130d639bc036872717f

      SHA512

      a62d5780bab9a59457dea0733a2eeda72da737fe8afd960660aff131e449c9a9c142d13147cd8739fadfbbaa5b05bffc1bb56e53948d8d3399301c28c29851ec

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a543eb5a595f23be26ef478265a0f8b1

      SHA1

      a46e98703e526bed20008b57367d0cc13d1dab6d

      SHA256

      60790c8458a801105ab973ba310564fdbdc0716bc361d9e64b3cca4747c10ac9

      SHA512

      a503c323b81604efd82e2017129329826e12d2ab321caecfc8ea3bfa58cec98c47545d6d1e54e302225ad7b959ee5a5197e8db80aa0cf580a13848bdded9d8a4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      94cc5007f9411efc6ce3acb9ce59e861

      SHA1

      712376555e7fa9a5e22eb2eeedfad8c8948ebe47

      SHA256

      12a7e2c3ea5297f617d94de052bef1facee923a4848f0f39bd091649317297ce

      SHA512

      06280a7e6c712cb306af5fa9ffb1c75c80920df99cee84002f88f8558f2f496cd27f67df83f835173ee4255c15e4a5fe61e2197dfea1a76ec00591db7faf2261

    • C:\Users\Admin\AppData\Local\Temp\Cab985B.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\TarA57C.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/804-491-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/804-493-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/804-494-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/804-495-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/804-496-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1708-480-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1708-490-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1708-482-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1708-481-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB