Analysis

  • max time kernel
    136s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 19:51

General

  • Target

    ab2ed1edbe11c8611cb4971df2fdc122_JaffaCakes118.html

  • Size

    125KB

  • MD5

    ab2ed1edbe11c8611cb4971df2fdc122

  • SHA1

    1806142af671e5eda32020b0659d54138470dfa3

  • SHA256

    3e5668d12ae82cdce8b8048ba123e56bf8c5d22757fde2f32f04c472ac9d21f6

  • SHA512

    a3f5a28e2754ae01459b578a8b057c439ded6f504eeaf92e0cd33b428ce638aee109d2d0ab12c13408b30ae3fc8e95233daf78854ffd3c8eb8ef18f64dfa1efe

  • SSDEEP

    1536:S9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQy:S9yfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab2ed1edbe11c8611cb4971df2fdc122_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2712
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2520
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:930819 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2668

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      fb583e3c5cf1c1f0d0eae4885cac2888

      SHA1

      3a5423282b54e90cd469d676bba9a42cf4ed1fda

      SHA256

      057afbaf586308f6a392b51e2d0a3995fea6408a595cb2822784b4b7062a9e60

      SHA512

      63a7ea6daf7fb8f785165641da693ce827a85bd2b41e8289ec34f0504470c3410350dfd94497dae6ab3a0dee8562fc4a7043a56f7ba9ad9b8d3831006364ac58

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      e8c7d76fd1f4c220988716b15b30ac44

      SHA1

      eb4296130d927d11fa214732a9b91456708871f7

      SHA256

      425c21940b37843407779479228fbbd475a688ef62bb87e1e6052fe41c29d688

      SHA512

      2254d110d36afebdce27c7fcf1b78983ec79d3e28f9d6fb6d82ddcc3556c3ff679f0ab277f44f1a3db6a778729bf0df821233d2fc0ff11cd11df318e634c7365

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      6f55aa7c765a23bb3cb5e51780ffd8b7

      SHA1

      d5df861ab5d5c081fb8daa291f4d9149bddb316a

      SHA256

      0201ecdf4b1396ce86a7d44717d1dfd7ea137755b7980339de5848da95ce0f9a

      SHA512

      61275af9227c234dad0c4e154be36e0db285ceae6eaa419150875c03c30ca5357bb0525ee0f8929434ba539e8f6b83347755c2a460a51808db83d80380acd8a5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      1f4c831bdb5fdc88b31ed95770bbec58

      SHA1

      2bf569b8cc79d7e2d89ea5f4b5c72b6c7cac0919

      SHA256

      8cd9615e5d7e3044ecafae742290c3635ab18e9d8973df5d7dcc5dc328035a76

      SHA512

      d90829eaf4790193e3b7d1a9dda335de57a36fd095057aaa0e835cf4eadc572ca17c5af3464e9c9b9b7b33e81fce3d4d3941c25f3e2028f157d8a5ec73016179

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      2078204e16cf0a52b11280bb94c3feb6

      SHA1

      a9cb5f58ffcdcb00ced76723818a9d36ae9b69d2

      SHA256

      ac10f2dffa5c5328266ad8ce31e3fe0f571456d9a782b4604fe13e1c795f032c

      SHA512

      f0ba178e586a703359b5106317a7373b2f366422ce9c225f057af7a481bba015b74467a11945ef0797b4d2f67b16192802c7b7e84d6a545d68a9da48fbb0667d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      ca7111e87cac791f5a50f272a3c4791a

      SHA1

      bca567efa292e5386b68a36abb01717f183d9a17

      SHA256

      f2c164af72175d414b9401f96accce77d69079790302e3fd8ca7c11344322caa

      SHA512

      e76be3d594bbba89fad54bcf3d61ad5551297bb9f29326ce5c70097a035a772d05e510b98cdc58059b6f2e5184cf3de57f2658eae9bb404ae6f20fd1189ca985

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      fb06960881b7e0ff023a4d9b839ab4fc

      SHA1

      0f2daaeea04667b2a9538106f0aac6061b47fa57

      SHA256

      862217c21b1cffac96af32093833402b41d65ef9d46dd36c3076287a8e735b56

      SHA512

      160d0bb5d21170d0d9b9974b15a2dddf051d661082749a133cad02b068669dea67333580a458725a1b48a592d84f8ad52675b2eec1330e890030706020535945

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      6b3926ee177a97c54a72babf6fe45fae

      SHA1

      dbd25aa82663cd01bc1d026d095ed4304d24744a

      SHA256

      02061b8b69171b865bbe6d0652be57c4a6e5e9a308c8235781527770a845e0bc

      SHA512

      e4cdedb7b668c1c7ee937c16518bf89ca36b2bd26fa0db47a432edcf5dc89ae24b159858e4f964cdb99c68814c2f6b0544422f937c4edf77fc18d0edc0bfe37d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      cf0fef18ecd93092812c1ab3d465353a

      SHA1

      66044a2c62eaed433cd198809b46fb51df7b5c1d

      SHA256

      ad381236a72d3a249d41662a5a03d6a69c183da1ef7560c4146899b9444bd222

      SHA512

      b079d07762913e794348ec9426f499ead6ebaf397a8fcfb23c93d47c545220a32bf8d5bd424e77b83028f5198a8f4757d7739563ed27dfe43161334ddd7765b2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      988e95848ff59b38b2820134cae9401d

      SHA1

      3369d0dbe2633408615a23082aeb4a3123b95067

      SHA256

      975876d84dcad7a205a519c24c779bd44eb1a6092c0911587402080076e6f7bf

      SHA512

      a126abd048aad4eb4d9f772f7dfc8da850669167c11ee20f10f2184b11ff16168980b850bd0559a5b3be900a81512b425a2713b4b6a210456434733d9a5a61fd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      f1b0ad384fe7448ee5818ce4bcfdfd56

      SHA1

      e5531f7b509fc719756348f76cb29df9358dc950

      SHA256

      12775b3e37ef4a24084ebbc429928c39df06858cb5a216c19cbd9d5214cfaec6

      SHA512

      d8b6b42be5a6a1169fefeafbbb058f8c4fe50621ecd501292d0a7608e5b49a3aaec3658a03fbe56d058d9db50993f26756b8048f1f791321e382197a3ecb3574

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      0431a8c15184bd831a3ac8305787f45f

      SHA1

      a27f414c3eb880b1768c3a5e03fc3b007c812577

      SHA256

      25b7ff462ec11de905ccf13144efdd84fa71ce8bbf040c478b06c5aa8e4b6285

      SHA512

      6b7879bcde62311474eb2c0502d56ec71730ae117b846d865962b653ba85dd69c7f8495deeff9b4ac44bb1ff38322d9cd80c63b145878171751b9100980112c7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      48bb7e7a182cdad7b75bcd1d50d5496b

      SHA1

      3bfc4415b22b665895618ebbde25aae6156d9c25

      SHA256

      63206ed0512e19f169ca207030864e5a8659a4824d1a8360447a15237be7964c

      SHA512

      89241513a0779ee198e4468b29534b99db1c34ba45c70635d1744b902aded57a1ddb950fa97362318494c82fa517e1c3841f20843f0dc4acb569d41ff643a6a1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      5c34b2d766d06b0286c6ef615fd795fa

      SHA1

      e809ec35c8996e114752a74e6d7eef3136139f1b

      SHA256

      9ec6bc918a41608f4bcc95617d89bd1771ad2a2fd064ee8fa5bdd501ed6cac3b

      SHA512

      fe571fabb8998abe52544037de61ae715d6e49d8409b5e01689f48a3c994d7288b6c0380167e92b55677d8ee95791cb0e575f76085df9db8284c55e5dbeaf7a8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      f6d4b7a61a37f03978eb1d01139b3283

      SHA1

      514cde4311b0a9ea799c2b17860d2deb6a70d3cc

      SHA256

      003e0502d5afe1c4dbac7f54e0c092241bc69f08437138b75e275e2ba5f5f517

      SHA512

      939b6d29a96056aa43c08806da4d28366403ca0468a7f56523d4c9865ba59e83a490388767b776422d7331c36ae5dcd5d5ca9013414598f58576b5a572f15942

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      8d5423707e6b3059d3572eab61ad0303

      SHA1

      f10d8a9fb1e1bd9585f6e2667a3976e3a51b4978

      SHA256

      bbf59fe0aed73b27daa83540048021231022a10f32e7e082bd544e18a84220e4

      SHA512

      4a3ac44f47d99f88db90e0299be89cf1a0003eb2889706eece49c6deac164e3f57b64ad4c83063014343feee96c1e22b2e711a24622dea58b07b201cf4cc6aad

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      303b82d1d332db320c07be61e3e7e08b

      SHA1

      8618bea4cfb248cd63c9c29adee83acfdf9e22b1

      SHA256

      23f980d7189125f12ebf0edae84ad35869a704a6917574907b725ac401a756e0

      SHA512

      1f2c323955cf8ac3fac1b64e20b397844e24da88e86c7a4194301a7b646f1fdc848b5b94e22ec9b25552bcd9111024aa29517dc7cc9942fe9eef77ea5f7c225d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      3611c017e9fd44bbdc5b510a9c00bc0c

      SHA1

      a93c703a274a45b2c699e1cf2204e560c5f87252

      SHA256

      e0b6684cda5b016fa165498f3adbc0bf6214bc5eaacb595b675580757b3215d0

      SHA512

      8ac709b0408f5de35a077155b11ec77f8e5a7f8e05708aa623fe4ef7d7b2368fe9d35f400108e9f3177344cc5cf2bd7025f92331232f1684a5caa17a7762800d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      a43080b79d7d30ae1256bf904c67e747

      SHA1

      4dd8714bb141d0b85ae53357874524cdd74ca083

      SHA256

      44ed8c79ff81d7ec827958cafd1686f4035c261a290bbbb18cff22640de14065

      SHA512

      05fe07fcbf2bdac04fdfb7e575fe861997b701afc19044d491f3b7819da1a7bf061d1087c0a659a0c82addb0d03c450e59f5ba82e816e66dbf52ddf9277d76a1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      f4944304f72c5cc0bdbc57f373ce9209

      SHA1

      e70509512a42d92f4b8aa08f6c19a1ec92337b2d

      SHA256

      299b67b397d9ead406863c283e391a4aca35946e8e451bbb27af53f194a757e0

      SHA512

      57b5b6b2bbc2ba02ab74b81ebbd365033e6413c2c4d973f6eac512fe2bb7c7d61c0ebbbeaf956d24a411bebf4c18161fc937b2c4cf81c6e7c27f5cef2c9c8439

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      8c864eca7252e434ef5c465bd82d9e00

      SHA1

      d801ca03708141e41ded0cb4376ad3d34d047fab

      SHA256

      56afc977d1840d8d9a7231c12bc6ea76f0e6a4df65f9f57a417ab586df250eb1

      SHA512

      37134b8eab9e944fdffab2b57ba0b58c4983c5fb23eff81c08a610c9b471d1d5271e249c5ca90c1b2d47c9846abbb4f9833c4e720f15cfadd0f98d4d29ffe75b

    • C:\Users\Admin\AppData\Local\Temp\Cab76D8.tmp
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar77B7.tmp
      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe
      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/2604-6-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/2604-9-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB

    • memory/2604-8-0x00000000001D0000-0x00000000001DF000-memory.dmp
      Filesize

      60KB

    • memory/2712-17-0x0000000000240000-0x0000000000241000-memory.dmp
      Filesize

      4KB

    • memory/2712-19-0x0000000000400000-0x000000000042E000-memory.dmp
      Filesize

      184KB