Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 20:32

General

  • Target

    9bd874a3b5d22cb71e9849c8150c59df_JaffaCakes118.html

  • Size

    127KB

  • MD5

    9bd874a3b5d22cb71e9849c8150c59df

  • SHA1

    b2cbaace34f45646d6b07d5ceed8b4e841f39c4c

  • SHA256

    670c4c880d3ba0563c17cea5f95bbbc9f27e638e31d756cf8084267c55744a33

  • SHA512

    88fa3b94654dc41d82619a8046e5fe7fd934758d16810212ef7f52dcec927b17167e2453ec04f172a0272a8495bf3802d281ce388935a4dd7d3bb8e451f45194

  • SSDEEP

    1536:SVWTRLDtvyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SeByfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9bd874a3b5d22cb71e9849c8150c59df_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:280
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2924
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1544
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1568
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:406539 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      055cdf6948a1e633ef6e135f6c077ecf

      SHA1

      8bc87140583b4807def1af6ff74784e6b43c3bfb

      SHA256

      fb5ce2d1ff9793082072d55b4bc084b3289ebc73bc1543b6647b552c4876a3ca

      SHA512

      91f22cc0a94127488fc3e08f9bd54583139ebb8100685787fe5747df72a90a0daa0e032021d36c0cc6af2539d98a08f81fa775236689e678e9c31e6738b41d2a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      48a5486a879d0a11093c39a8940b7422

      SHA1

      4a502c09d5f01f8efba9e6733010c2adec146c68

      SHA256

      c526eb311c4bfd6996fdfa15971e770fa4678379e915226317b43ab7219f8541

      SHA512

      6c7c4c3ad9d290f647f8d8df4a10f13699fdea1bb705b02ac57b727c540038c1964d0b3c53a0597c9d2d4ffdfd01a9cec5dd178dc6411f7da19d74bd24650217

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9ae8f680e1e56a809e70e6713cbaa46c

      SHA1

      cc0eb567553f4ebc4ae0cee95c873742eba32236

      SHA256

      ed381f5d554a7240817c47aab3eafe0eb70c8c4c1e87043aa9df7222adc55201

      SHA512

      6640fa2160bece8ec21842e9a98767f22081b0cde5fb45917c90fa096e65ec0b14a46f536894b27745ead5dcc1efca5d3ecee5bf5514b666040f64f360e3b0c7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e2af7905de797cd727dc6f406aaee2db

      SHA1

      068bfe06abd90b2e04fb7140aee7e4e2745f3fb7

      SHA256

      8f030e0adc890af9ee0a0f80e50a5674255fb25df004de884a12c6b318d42afb

      SHA512

      0b14d6b945964f774825a9744bf7c4f0cfcc6e0077e096e7f819c0ba342924110010baaa086912d91b7d8158e3b0b30a698a5ded0422eb84619c12ab76a696ae

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f94c5d585e4ebd12bc14304fbbe7ccad

      SHA1

      6cab5586747a5f76844836f963402105bee097c6

      SHA256

      4a7ec826108023ab32e3a3ba46b6b1424c5c6e65016a4f300a232607874b09c6

      SHA512

      d36565a699f970568e23ad8a1e78e64f033782b42ea98d1e78ffd017949c90777b3b87d35f36a5cb017288d686d01f290a95536d3dac02e6d8fb5c9ba7ffc44f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d119465cf620bc39b934e96abb985b94

      SHA1

      6a5f7f9f2a4aaea06a41a2964f46acfbc13e9033

      SHA256

      795e67028df08163c0efc5698150222abfc112869e3a2c02d94294cc325f44a9

      SHA512

      dbe14b8e5bb06e51ec34cd20e3eaeb201f467ff2100d2e9363fff50fbb7db436f22d8b2769dcc6ff930d61655c98dfe65ec451e51b7b935eef292b60bde6e7f4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8516c1c90094d939ebd05e64ee536e0b

      SHA1

      082d2f5d675b573069dc039cbccbb540f033d35b

      SHA256

      761e3d6305a71b025b7a7e7c05ff3984aea7b53963f098715ef6f172de01b0fc

      SHA512

      e780aeb1ede57c8b01b103e3d9f05cf062c0ba2b0d987e58e1f0a19f9482b20f66262a805477d4d9814d87c6bf73099ac73ca42cf6f820cb595f55d93f3436b1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      445b39013f2b35ea2265ad6a14ef77ca

      SHA1

      a2958c72e67aa42356ac6efe73043ad1eafadcc9

      SHA256

      7d832de7ef3102f0bb90606668bac3d3fd7e785fd0e7d12f5bafff3f22d4385d

      SHA512

      02358056f4b4b8d33ba624d4759122bd2917f9f6e79a765f610107e1d77f55fdb1a7b131fa79f6c672e33069c3eec89bb7698b8c0e9b72b179129882c8aa086f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      79998dd0561210f4160549129384f795

      SHA1

      cb9e400e5d0e10a040b8f109f1e025a688a2df96

      SHA256

      123b29df4de4d5a289a055f07b877b1c6cd73d2ef9c19305a69607d0e2763b0d

      SHA512

      ea1557c370e2301ebb6546e20ccf2a160d61e4f6d5d520d3b4fffd9da2e5ac5f15dba23c949865ab2d05254792d91df824fce14da8ec80c01b79c180d8c9ba96

    • C:\Users\Admin\AppData\Local\Temp\CabBB5.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\TarCC6.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1544-489-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1544-492-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1544-493-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1544-491-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2924-482-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/2924-481-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB