Analysis

  • max time kernel
    134s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    15/06/2024, 14:38

General

  • Target

    aee5767eb2519917679a3cc9b48b356e_JaffaCakes118.html

  • Size

    124KB

  • MD5

    aee5767eb2519917679a3cc9b48b356e

  • SHA1

    aa173538328ba1957d56f07bed46407522f78864

  • SHA256

    a45c3630044b36be9a6f7d15472407ab3e440a7ca699e9aa12de68ada9659c64

  • SHA512

    4622ade00e9430a4cb6eeaf35433267a1264c6a2b7d56b2621ba276086533f3c2d9b08857c21c1ea8244b0db5662b3c0ab198f3957065d52230cd3824a749ecc

  • SSDEEP

    1536:SrcM/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:SoM/yfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aee5767eb2519917679a3cc9b48b356e_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2880
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1428
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:472070 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2684

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3f4e23638139323f31d2ce036280a81e

      SHA1

      446132150595195068fdf1b7a82b562a4cfbdbd4

      SHA256

      802760dd4a2467259622f7b381581ebc3c67e307316741a1dbe9e057019d7db7

      SHA512

      7de51d99d3f9965afed057965715a04c7bc277c30710a97ee8eaf3361dd1e2a376edaa9a799e1541fb4ef7c83e6700b6969002734cc0b403806c1cc26b4d4683

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      02ff9783e2383a1902082015bf7e35dc

      SHA1

      f09306ac2d40c93dedd752d08172c7713bead5d3

      SHA256

      042ae6f01dfb70fff59de182a2e06a0faedf1595b18fd57f6758b4597c456ca5

      SHA512

      f9c8643dfb2415c6e46244af56e13c725a6c8b07f1b08d045aef26be19bfdcafc42b6903f9f41db72bf281eb58647f8dc7d9d8ed71f883ca613ef1c33d8ea289

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4d32e0903d37e94db6189aa09ebb3e6f

      SHA1

      5fbf676eb89f058531fb2f436fe507ecb166d4f5

      SHA256

      edf6c2b22225f6dc299382001628799148e001b70ba68c15121f8b4b20e796cc

      SHA512

      a83f43d426d623f7b0904a9d979c5f853733b2da1f50384c828ca6c1eae0186cd2b2d1fd6a439e31acc7d1d2fc5c8bf4fec7f5ed92465a8bcc054f2821f45152

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3417ffbdef2df26c511341b1efcd47a3

      SHA1

      031a5f968ed196d03c31ba0f472baf62ff3009cc

      SHA256

      be533602929691dbf00dd68bbb79f32c8345674078ef410e375e588e41ab741a

      SHA512

      f3c8fc090db191d3fa7447acf0c067d399b686e1ef57726e415bfa8e1f4c05c65bb0b07318460f635f4f9e28f46e1fa2954c7dca136eb06b0872b2ecb74e7fdc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e0bf4a692a56788d40d069cb992d7c65

      SHA1

      f8ada05ea32343ac5a135315d9c009e25df54ed9

      SHA256

      88c319d1870c0d2b6f5440eb0927ee6bc1c72afc291aa0a931538717c8fb5301

      SHA512

      c71c06de40808b91fdd7ac39ddce53dbb10087b9a41949fec53d5845a983d5da14440a17c89e158378efbb716da07d4db9355eeaf8a0e622f3da98b78b51601c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b3308ba0fb044a3c009488953b3ada76

      SHA1

      42325054f7ca09216450cb14bb8c79bcdd9f8c13

      SHA256

      2fdfc4f24891de94cc68e7e8ea7c803aab510a2cf8b7d2b3f3fc26a15a9c4d72

      SHA512

      4a19f1ade9e36c2f48657caed44b822fd4e088d538dc1b0f6cb654457b8c97de7b7cbcf15b21a15e290a747d129aa48aabe80ae0cc8a53d6591c52537cc45ea7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3f1146d49655b0fd970ff49d66f66502

      SHA1

      2002af2965ec64012f19920c57620afa7056e6fb

      SHA256

      61034636696841229d59abcdc4655c8f2c7082e66233df2e03e3e68dfe2db352

      SHA512

      2aa0eb8233e2ea315e0b1d8d2a54588c0de54e12df419d3d79e5529f50b29055847e36ac503f8e8ecdc68a25088b90b03238ff004e1bf89ee4a0cad81edafa40

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d9ce3909c16515f09bfe61e63125dc5e

      SHA1

      50bc665c033df99ba4f2e1d0c9d11174cf0ffa85

      SHA256

      9ae69d6745b5913605551b37228ffbcea8a4398cb2083d485dde857d9f97e5c6

      SHA512

      cad0ab206ccfc7235d043d5e392e675010cf3527fe9fd8a3b2a6f2cf8238f4aafaec8e144d3b50364264dd0dd92b721c1748f9586017db25623c40e5baf9c95b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      54057f83d25343e81a0fd69d8e40016e

      SHA1

      7acd798ab9b128dbcf54859ae5d07c8f14d619b9

      SHA256

      dc5fe73145c01af713098d553e61467279e63d64c819b7e0f5185ae5ab9d7f9a

      SHA512

      23388922a5e4bda504e047073f91face554cf5e65a55ad372f33b6e07b3237d17f17f953edd54e60c341da70b95a90dc664ff48e8fd48871672865b935efd490

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d7aebdd5fb22ced0a3cf5f1a023153cd

      SHA1

      bbdf60e00869852bb365c4bcdbc8792322059287

      SHA256

      22c4d13e568b9379f5e97925cc7ffc3af6568873ee6dfd7d8e1c8998436a42fb

      SHA512

      e4d2688cfaae4c735c2311e5735783fdd0a53fc52eef7ea8043cf61beaf07f2202d3f5bc29976c6438555ca6b89fb3a2fe8fbfd4c85f20f3b3a5eb106abccb98

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      776cdd38486423f780c2343a5e255bc1

      SHA1

      a0832239692533dfdf6b74b6028d2465141cc9c4

      SHA256

      fbb0e03d14c395e50cb2027c04964acc25d54b2f14702bac72a9ff5f6d5ae8ad

      SHA512

      ca838a317b57dffacfab1e5e7fbef34503855eca2cc34537613afb6cf587e5a00b7574338545f8d5d98666473c44a57c8626834e4aca3f829894ad06b33dab9e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4c4097892ac87aa91214aab60772688b

      SHA1

      5f7ab00118db581f8bf4daa28285ce73f82a83d0

      SHA256

      49d17b74c7b9d5c2494acf1aff8de3a92d4974153db02ca56e621b13283fee9b

      SHA512

      df0c0a44978359ed69a5b67cf542e759ca50e89798bad80a9eca8cb7b8eb9c4d073d765ced4838e210dc4e1ec3c508cb6613c17ad1249dff90f159870303ac2c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3f6f4734d3e2236f6a4de1cc2be30b27

      SHA1

      01bb7d7708e38bbf4b9b013810b44542406bad98

      SHA256

      31b966b94a7f9316376e33fe30c05e6faa048657044bece62643755666babb6b

      SHA512

      6ba121d8968aefaceb7833cd6a780c6ec61db265b57333ff43f5f88da65bf3e6527c291cecbe0b79db91e3e426a8df03dd1f1db26be45056a494d67bf3f51fac

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9e1749c9870bf7f58bd3190d75252b0a

      SHA1

      ff3b2a499875359a2354c0a822500933ddc5a1b3

      SHA256

      4da4d6577ab58e40b420470ee665326f3e8bc7b63c2bf8397ee6a1cc8a3b3ddb

      SHA512

      0ecbb1e102aa89f2913f749ef8d7876ae1bb3a465708b92d7d6bbeb8c5aa46f8ba5b24ee43f2c4b352be01611ead496a476f3f583d5489d3802db85cbb64a1a9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7b42414d01f4b0e1b12f74f53e58de42

      SHA1

      04bbca286393b44997690832cc74ce4131723251

      SHA256

      e066ee97f103ee5cabb3f969f29c1a92ae815b625c1426c2e981c16e9f6403f5

      SHA512

      58e7570320e578dec0751776d9ebb47a0775f1191402146a15b9d98883f9a4539c3f503a664a68198cc31ea5b0961bb13eadf0d00982e4d32cbf1aa140d9a194

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ffa3af756a81ade43ec87f2ecd82ee7f

      SHA1

      28ac9ed1ce5c052d930c446e32737477df674a72

      SHA256

      9bccd8a09f603b3779052b072bad48cdf2888dc12e9a31c9d0e4c816e70be00c

      SHA512

      8f5d77059d8df7cdafaaaf2480963ce1d03d4da8fcc91d0080e45cff03e60cbc360b4c270e16343bd96a5a2697bbab2fba5c3d1ddf4bb8d20b0142b4ce3e2313

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1dd821b186514c1c03b03f4ceba1c89c

      SHA1

      01b7a56ef976d3c40f435ab6e5c66adf4ef205bb

      SHA256

      760f4c17705b4421328eb5d801bcd97014a09d1065362f016cfa969f2e5c2568

      SHA512

      ba84d34cb48f2de8c256c29eb29aa581e114af2b86c94f30df7ffc77746331c966dc38924b2d39d39af5f1a3f200f60c5b0ff06329c5766a60989569a704dfb8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bd0e52c31cf692e7f0545002b3223865

      SHA1

      a9a4b8a9327d8c18565175c96fee629607c0d2da

      SHA256

      21796d6f4e7debb84f73d5b52a02261dd3f8088275ab5966247353401afb13da

      SHA512

      fe872b038b08d2f8c597ef361973e9365d599857e87a8ccf0ab434637d9393c94d6fce706b1836e68b27299006df320d62ad5c946c85dbae65752dfc4012a3d5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      61096f43b7005f2df7e3aedc61a74241

      SHA1

      727108508c8821a6727026b87994edcbb6ce072c

      SHA256

      1410cb6c268abb17fa3d463a5c095c10cdc5e1ffe22b2d935c610ed80f73741d

      SHA512

      fa77a6af0db1affdd9046875148cc512456acea6dfffd7a69efbaf52f49000ee3e83e0c689d92cc4cf70f31b491102291d9ac7d003503b5cc9b720c08122fbeb

    • C:\Users\Admin\AppData\Local\Temp\CabD442.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\TarD572.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/2880-19-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2880-17-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2880-15-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2912-8-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2912-9-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB