Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 00:17

General

  • Target

    100f36a7d29d60a09c7a517a9611bb10_JaffaCakes118.exe

  • Size

    95KB

  • MD5

    100f36a7d29d60a09c7a517a9611bb10

  • SHA1

    bff8809dba549f5843d2abf080afe6382e5eff7d

  • SHA256

    b0dc77c71f44e23480c3293493e9d5de9da43de6fec80c67db6f69ccc7fe4ddf

  • SHA512

    d1ed88778f6d91e6fdfba007cca83291fb96a7c3255350a2d28797a5e307e7008b067f0405fdd60dc6cb021e96b04f7d55258f62dbdd5dbfc2043140db34e98c

  • SSDEEP

    768:v06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:VR0vxn3Pc0LCH9MtbvabUDzJYWu3B

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\100f36a7d29d60a09c7a517a9611bb10_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\100f36a7d29d60a09c7a517a9611bb10_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3128
    • C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3608
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:972
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 204
            4⤵
            • Program crash
            PID:4560
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4624
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4624 CREDAT:17410 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2112
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4808
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4808 CREDAT:17410 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1420
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 972 -ip 972
      1⤵
        PID:4776

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\WaterMark.exe

        Filesize

        95KB

        MD5

        100f36a7d29d60a09c7a517a9611bb10

        SHA1

        bff8809dba549f5843d2abf080afe6382e5eff7d

        SHA256

        b0dc77c71f44e23480c3293493e9d5de9da43de6fec80c67db6f69ccc7fe4ddf

        SHA512

        d1ed88778f6d91e6fdfba007cca83291fb96a7c3255350a2d28797a5e307e7008b067f0405fdd60dc6cb021e96b04f7d55258f62dbdd5dbfc2043140db34e98c

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{795D8455-3351-11EF-BCA5-56103091DE06}.dat

        Filesize

        3KB

        MD5

        9becd12ab477ae2987a6426397f09380

        SHA1

        aa899889d66fdde6bac8ab45ad0c2c34ccea8b3d

        SHA256

        ad056ff06825728b1aad8ba18b0bda8301f92ce1d5d0b0d09d6e37e660eb0c1e

        SHA512

        a3b156e5a31809d787b6ea98645f0dcc93af94863f053d687a28162169451ad1af0a6d7642ed8472519232fb193da1d50189439239989f8f772e8c7a743d3691

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{795FE5E9-3351-11EF-BCA5-56103091DE06}.dat

        Filesize

        5KB

        MD5

        269a27d080c734bdacc30835a7dee18a

        SHA1

        cfa614f59b8061a1148368f5971096a7c1dae86f

        SHA256

        d5e3f0d64094980acf1dc6d52a2e11e108bb412c55da8b1979be683fa1ebcb6f

        SHA512

        d5f877c434da051333c62da715fe4c6e30f50c2b544482ff4ccf9d549b67824f22b281264bac3952f0d4322b865b5df04fc76a8f0a7db5c5420b061378ef8189

      • memory/972-28-0x0000000000B70000-0x0000000000B71000-memory.dmp

        Filesize

        4KB

      • memory/972-29-0x0000000000B50000-0x0000000000B51000-memory.dmp

        Filesize

        4KB

      • memory/3128-10-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3128-7-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3128-4-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3128-11-0x00000000008B0000-0x00000000008B1000-memory.dmp

        Filesize

        4KB

      • memory/3128-1-0x0000000000401000-0x0000000000402000-memory.dmp

        Filesize

        4KB

      • memory/3128-2-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3128-3-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3128-0-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/3128-5-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3128-6-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3608-23-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3608-22-0x0000000000430000-0x0000000000431000-memory.dmp

        Filesize

        4KB

      • memory/3608-24-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3608-30-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/3608-31-0x0000000000070000-0x0000000000071000-memory.dmp

        Filesize

        4KB

      • memory/3608-32-0x0000000077572000-0x0000000077573000-memory.dmp

        Filesize

        4KB

      • memory/3608-25-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      • memory/3608-26-0x0000000077572000-0x0000000077573000-memory.dmp

        Filesize

        4KB

      • memory/3608-35-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB