Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 20:08

General

  • Target

    0f5dd209d4b48ac36c9d100d4e9c4bb1_JaffaCakes118.dll

  • Size

    189KB

  • MD5

    0f5dd209d4b48ac36c9d100d4e9c4bb1

  • SHA1

    95cffc889960b5d4db51e27833cb650c8c7ac933

  • SHA256

    73f0f24f6324ec5076968e1a02c8c71a8b7653272cb608df94675176333728fc

  • SHA512

    39738069333286369c2eedfc3713948c58d5c815f178ff50048154bf70766cd13a4ecfd47b4dd3963cd1e8bcccab04b8f39fd64cb82975904f0b5d61951e3ce8

  • SSDEEP

    3072:Rt5Gf4bwPdy5XMxJZID/RlovuTyB9yyo7GcXABr:RCIpJJTEV

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f5dd209d4b48ac36c9d100d4e9c4bb1_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f5dd209d4b48ac36c9d100d4e9c4bb1_JaffaCakes118.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1600
      • C:\Users\Admin\AppData\Local\Temp\fxvVpP6P
        "fxvVpP6P"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
            PID:2840
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 212
              5⤵
              • Program crash
              PID:2644
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1632
            • C:\Program Files\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3360
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3360 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:5072
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3360 CREDAT:17416 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:4240
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            4⤵
              PID:4048
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 208
                5⤵
                • Program crash
                PID:692
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1776
              • C:\Program Files\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
                5⤵
                • Modifies Internet Explorer settings
                PID:2072
            • C:\Users\Admin\AppData\Local\Temp\qakhvrorqrjbmpbd.exe
              "C:\Users\Admin\AppData\Local\Temp\qakhvrorqrjbmpbd.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3076
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 640
            3⤵
            • Program crash
            PID:3668
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1600 -ip 1600
        1⤵
          PID:428
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2840 -ip 2840
          1⤵
            PID:3636
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4048 -ip 4048
            1⤵
              PID:2108

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\fxvVpP6P

              Filesize

              96KB

              MD5

              74f37fe4cd2c65109465b9998183a657

              SHA1

              9419ff643ebd890e108c2732a40f9b3628b35a71

              SHA256

              4e84e2831364f0a0b9c7d552e58b9706d0de6fae139942207af33f515dcae40b

              SHA512

              95651b579b497f8a3f4b0eb42f90bd8a722a50b38e3b6c22133ae2390e68bad21d74f7fdc4a45fc43c8aa798c5775e87bf6cb20a6e1ed9c7e80ecb9b302b4a81

            • memory/1480-25-0x0000000077152000-0x0000000077153000-memory.dmp

              Filesize

              4KB

            • memory/1480-10-0x00000000007C0000-0x00000000007C1000-memory.dmp

              Filesize

              4KB

            • memory/1480-17-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1480-22-0x0000000077152000-0x0000000077153000-memory.dmp

              Filesize

              4KB

            • memory/1480-21-0x0000000000400000-0x000000000043A1A8-memory.dmp

              Filesize

              232KB

            • memory/1480-9-0x00000000007B0000-0x00000000007B1000-memory.dmp

              Filesize

              4KB

            • memory/1480-12-0x0000000000400000-0x000000000043A1A8-memory.dmp

              Filesize

              232KB

            • memory/1480-34-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1480-24-0x0000000000400000-0x000000000043A1A8-memory.dmp

              Filesize

              232KB

            • memory/1480-4-0x0000000000400000-0x000000000043A1A8-memory.dmp

              Filesize

              232KB

            • memory/1480-6-0x0000000000400000-0x000000000043A1A8-memory.dmp

              Filesize

              232KB

            • memory/1480-5-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1600-15-0x0000000074B80000-0x0000000074BB4000-memory.dmp

              Filesize

              208KB

            • memory/1600-0-0x0000000074B80000-0x0000000074BB4000-memory.dmp

              Filesize

              208KB

            • memory/2840-13-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

              Filesize

              4KB

            • memory/2840-14-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

              Filesize

              4KB

            • memory/3076-37-0x0000000000400000-0x000000000043A1A8-memory.dmp

              Filesize

              232KB

            • memory/3076-36-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/3076-35-0x0000000000400000-0x000000000043A1A8-memory.dmp

              Filesize

              232KB

            • memory/3076-41-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/3076-40-0x0000000000400000-0x000000000043A1A8-memory.dmp

              Filesize

              232KB