Analysis

  • max time kernel
    117s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 21:42

General

  • Target

    ab98dda99a5d53835aa0e814f239db83_JaffaCakes118.html

  • Size

    347KB

  • MD5

    ab98dda99a5d53835aa0e814f239db83

  • SHA1

    5d438c0a5f8b3d5a5b8a5fa0444124d200f6ac93

  • SHA256

    e6735cdd45a72a3920b888adf4ddd823e3decdcef65ee1fc22d92d5e36d67bb2

  • SHA512

    1cd8ca62afe35f72d20b0c7b46ca4b2f487475f1931a7636910d4a7e3c57ab4578844a4989645c94260f2fb7daed5fed447bfc09f29ba1c2ecc80f342bdd1481

  • SSDEEP

    6144:isMYod+X3oI+YG4BsMYod+X3oI+Y5sMYod+X3oI+YQ:g5d+X3/5d+X3f5d+X3+

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab98dda99a5d53835aa0e814f239db83_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1360
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2668
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2588
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2628
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2544
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2508
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
                PID:2872
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275465 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2652
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:6697987 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1844
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:406543 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2848

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          2625f77d5c7746ccb3b6d423e50109cb

          SHA1

          b6abe62255268afdb233b16a349f45a1e330f729

          SHA256

          3395a2eb17dc507743c501099fb47dc5dc40fb8831eb0ff7f9c780045598c351

          SHA512

          d9c96bd34ef14dc35b642a2f57baa6a91669264834b9c4317af5288c7920bf3b3826cf3175e3244875671a2dd4e0db02fd8a6c9fb2ec430acb60532a6f06091d

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          5911c6a4faaad20867b3b9cfd31d1752

          SHA1

          441d6cdb45a63dae6824a58f22f18d4e1e030fa5

          SHA256

          898adfe605ca5f9771b4bca349b11cc354cd108ac5fdef1b6ea49df382cc9428

          SHA512

          85ddc1dc45350adeb4958db41e36c4f72ec166973ba5898808b587d5e4bc2e55c8425d4b54a74e4d4aaf8ceea68a3c63cc3890a61c0bae803bb4e95a172453ec

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          eac2d1b41ea32cad6e3340e89ec5e9bd

          SHA1

          d24fe849cf045337e13903f28fafc84d60b08245

          SHA256

          468ff228259adf7bc5b268f6683584d04195cbcccdc2c9b84ea878aebfed0ec0

          SHA512

          dd763c7d246a196d188290d36adf673701ccccb0e7a1b1bf66dbd1618adcb5112129e2aa84c2fd3c5d7df508913247c32951df87d314576c5018fb226d6deb81

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          0cc20669a2d76aa9b1cc7bc3fae07bf3

          SHA1

          f9ee9223fad2763b50c2522a0e8433e040feb454

          SHA256

          e7b84f430678fd96c71b1b97616ce1a1c5f4b5276e94184a4da1f85d70bbfa70

          SHA512

          e77a65a2cf34cf9c7a1feceebf0f7775518b15310e1ed0e88035be8beadea691f29d1fcdeddc2618afd4b0bdfea92281f5486fbb7341d38fc4dd72580ba8c06e

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          0523dee7b292832190a2db63267a15ba

          SHA1

          2ec53bb11e7990ba563810cc892a4bfdca3a3152

          SHA256

          472fdb9f9546307c15ca1a3b56827f5ae43e1008128dda42ce64f999e632636a

          SHA512

          e272cd19308a6bbc7d61dc80386d2a541aa24c098a5a1b8d8763b5d894ac7a45e1caecab1bfc852181e55a5a417f5bdf0ea04cd13d71da95439572c687d7ad47

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          69b37ca552fb66993cad62c9fa923e6e

          SHA1

          14bbf5a7d544e7edcadf2a693e4310bfbab0092e

          SHA256

          7aef43e60a9e0efe1f7b940049879817b8cab4f16ee5e03469a1767f0cd3f540

          SHA512

          83f5d47c4c3656b772059ae4f35055d253f23ed07606fdaff23457113e71705d431fe71ae5514a7ea9e97d7f8e8cb4d46e06fd01a23035cd4f1d2d344158823e

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          4169ac163aa0a77cbc225d709b2cbdd8

          SHA1

          920b7bd3fdbc46886a824ec9080daef2750a3229

          SHA256

          0cc8793607d6d2fba0f280ea3f6eefb5f8b4e567f3272db90114a14198246b62

          SHA512

          e070213a3593d1a9d5ebf5210637685b2846624776b45e323f37dfb7de278bb4a0f5d3469a35f84f3556682b23bffe31b0bd56e88b62beaac4734b59f3bd9f60

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          3b10489a1cb6b200b49ed75b80b18705

          SHA1

          490b74a29d1f83235dc97beb9e61fa0ec2f2ec14

          SHA256

          4bbc6c5cacbdd0d54248cc52983415adb56b7c67057e62c95aab8bb53ac13402

          SHA512

          8d562e86e33f5f43aa276a508c61498098cb99c4eefe80960f2d6f45641c7a1a517c56a651f621ad5299e9229ee84a9d7dbf76ca40580c37f02e46c5953f91f3

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          417e3a19f6d9c3f5ffa871f9ff8edaeb

          SHA1

          660018fd05c365a2edd52dda92dc438985ec8ee8

          SHA256

          556ad5bd3ecda866ef698dd01d06739661432a5126bd2791233a94f5b588414a

          SHA512

          08311e185ed498a71c9551d1d577f0c53da947ef5b31aa69c83221140e2204ad8ab7de2752912e619207d928ec31535a5a34a8a90fcd42f90e41f498d0b64060

        • C:\Users\Admin\AppData\Local\Temp\Cab9B2.tmp
          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\Local\Temp\TarA43.tmp
          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        • \Users\Admin\AppData\Local\Temp\svchost.exe
          Filesize

          55KB

          MD5

          42bacbdf56184c2fa5fe6770857e2c2d

          SHA1

          521a63ee9ce2f615eda692c382b16fc1b1d57cac

          SHA256

          d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0

          SHA512

          0ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71

        • memory/2508-30-0x00000000003D0000-0x00000000003D1000-memory.dmp
          Filesize

          4KB

        • memory/2508-31-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/2628-27-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/2628-25-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/2628-23-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/2668-20-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/2668-18-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/2668-17-0x0000000000240000-0x0000000000241000-memory.dmp
          Filesize

          4KB

        • memory/2928-9-0x0000000000230000-0x000000000023F000-memory.dmp
          Filesize

          60KB

        • memory/2928-10-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB

        • memory/2928-6-0x0000000000400000-0x000000000042E000-memory.dmp
          Filesize

          184KB