Analysis

  • max time kernel
    118s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 10:16

General

  • Target

    916aa5e89c5ee6220b77156cc9c8136a_JaffaCakes118.html

  • Size

    347KB

  • MD5

    916aa5e89c5ee6220b77156cc9c8136a

  • SHA1

    be0883d22ea7098c42478ff8bec10c16915e0749

  • SHA256

    e63e332e6860c1f49b36c183871a85b9ecccc1f47c12bb8761804937da217c9f

  • SHA512

    b84ad72091603183cc33971688c4a44822ba8c2c1fb35717198120b231ea57ab3347deeb64d19155e64b37e7822b2ae51d19ee3758a828c6b09908ac26fa33d3

  • SSDEEP

    6144:SxsMYod+X3oI+YZsMYod+X3oI+Y5sMYod+X3oI+YQ:S95d+X335d+X3f5d+X3+

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\916aa5e89c5ee6220b77156cc9c8136a_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2460
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2904
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2656
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:888
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2532
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2544
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
                PID:3064
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:209931 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2692
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:209937 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1660
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:5256195 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2980

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          9f8c98b2664d66bbbd210a5ae19c7173

          SHA1

          62cc9dabb41c23d810cd362c1ee318943ae903b4

          SHA256

          a4ba3ab630727ee3fdc85c28327aa57263712361736c970c11ba9b3dc8dcf847

          SHA512

          dbd79fa4f8f7ba413c95ac3b7e270ccf92cf0ebcde23ee322a0a336898899f56a0bcfb0ce8482964495e89244d3f05cae809ef3d80506bc2be9c31c37249608a

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          aeab3c8c671ccedf4796a4ad82105dd4

          SHA1

          ada3a158298847430ee38a2ca2eb49262b980029

          SHA256

          bb3d6d5be36d0476da0af818297c26c2dedd6e504384516250f3df4bc8157e4b

          SHA512

          3900c91b836895aa96222931b47d8aef888cfe023d7f0695f8bf0b8a937f0c8f32245a9632f322a3cbf4665ff984a7c9800d6cc5f4ffe7ed4912a2c558b95f61

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          3b5d81b1c793a3d21393c6e40a9724b0

          SHA1

          fbae2a2f9f8f8dd4f66d40f41858f3ca0939d798

          SHA256

          c3b5bcf1c1d7ad7e316063b003bd1ce021afcd54950d00f76814fa0289d6b583

          SHA512

          65fe490b048a1a5a2dfa8ecf23775bc5cebcc6ee6ef7ee12a04091073273ff7e27fc3588d3295c3f21ed2752f185c500c307567fb6268f7f3230296024482cb1

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          fd5be201c39e1f77dfa7912679133af5

          SHA1

          ecbbbb52820393db235040a9439b615725e6a09f

          SHA256

          2a7329a4c5a13f353a92a8c780c98f002680a050d55bbff2c571e5e37fa2605c

          SHA512

          8c5633a14e0944296fd08a3c27da9ebf272d55f67a43a3e4e5a8cf4fe447aa8b704d1643145be2eb3f59cdbcc0ce8e9d12933b543f871481783ddcc0dc63572e

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          734fd8bbb8e93d7c5b35aa66e4e30269

          SHA1

          b8e92b5ce3e61c694c67dca2e424d27f86283f55

          SHA256

          b8bb08e9d746d8917a39002b40b8d063253c16a9dcc7c12338466477d93577f7

          SHA512

          5761d224488415c6b60284dc017e921a3a06d9f84848e84153f73c0533ae9840e139358bb875ddbaaa8e75f74744be4f6c9a8ae9f4850faca570ebdb750b6f8d

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          41e997dddb4f3a0f73f69f80bcf2b347

          SHA1

          aa39b811292849e8166b2af823c13b36c3d5cdf6

          SHA256

          534a44374dddaf9dffca4884f58321d02fdcb1ec666f2ab8645ac6ce5cb68da0

          SHA512

          d2268cd3c6c5927c3b00753d94d5ae8d4de118ab6b137ac9ff1b23c3bf78f752863726b2d10a8c8caf1869f97cfd3f6cdccf626453adcee30b0b007e868fa7b9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          0036ca4ddc63d5a0cdef4c14b833f94c

          SHA1

          8d586d023d9fba94cf8c8a7a9922d97b6ac59df5

          SHA256

          0b14a1f77bf377c9d123a673ed60ee65bb436e6c31adcb49a09bd51e3a37cdca

          SHA512

          dd2c552f09296cd20013e5e3619501c43497e3ea819debd4cc44aed0c3315701d84e4eaf43113e839148055c4610583266e9ed5fe4a8066f088e09782d684a48

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          fc302fe61e41c324213c5fde8c3c4f80

          SHA1

          969531016169898cccf2f49c6308ee2302f5a2dc

          SHA256

          34941f6e577ec940411394101c3d4aac37ab08cbc8fad0df45e03711c35c6366

          SHA512

          dc8d79133d6c8eae7c2c81f9543b2d680d1c333a00ef790469d7c2d3fd7f0b78eaeecac6df103c56f4a69dc30414ae36d22778fbe88bd3f165072c1153be2a69

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          d629467eedf23663efc4a19ebfb2faa0

          SHA1

          240040bc174312a954a93d0bca8882e36e5bb9da

          SHA256

          b5013b2514b82592df8ba8240ba63a966690344ba77404cc3a2602baa4527f15

          SHA512

          4e3974ce76a1281141d5290f28c2be1d73a5d40d15285488def75045827d15e1f82136c931154efd8d6a99de7cc7b4798b02c0e5846a10cb0afee2b576ee66df

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          1e43beba89aacb585f86b82ebb21023d

          SHA1

          91ccdbdffd9f71caf43fe5a8c127aed610bd4d79

          SHA256

          608e064e32bbb5709f879b147b63185399739ec3cae3fa7b85fe2de95be4b4a2

          SHA512

          00dc2b1244550ee8fa8d1750e7edeb3b25dda9ba67e7c2e6242777d5af373965e1245d43332ffc6e5478d151a83176dac50ae1a8b0f138212ccc89fb72df697e

        • C:\Users\Admin\AppData\Local\Temp\Cab23A9.tmp

          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\Local\Temp\Tar242D.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        • C:\Users\Admin\AppData\Local\Temp\svchost.exe

          Filesize

          55KB

          MD5

          42bacbdf56184c2fa5fe6770857e2c2d

          SHA1

          521a63ee9ce2f615eda692c382b16fc1b1d57cac

          SHA256

          d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

          SHA512

          0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

        • memory/888-24-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2688-8-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2688-9-0x00000000001C0000-0x00000000001CF000-memory.dmp

          Filesize

          60KB

        • memory/2904-18-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2904-16-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB