Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 01:53

General

  • Target

    105471cd9d4eb09ec42bac2b0290f889_JaffaCakes118.dll

  • Size

    532KB

  • MD5

    105471cd9d4eb09ec42bac2b0290f889

  • SHA1

    eb25bc1ab8a97b3a2b4272938a009fef7de51c05

  • SHA256

    7e08634dac987ef53fb2fc692f6788221bde14b3b48cf28650539b0c24c89c41

  • SHA512

    32be63e092fc98dd035e385527b084ad49ddc1847e6208ceda8db4bcd19e4bee9b2b781b96c60ca85ff5ca50e14a8dcd7a9da86f654ebf3c56ce5cc4152c8658

  • SSDEEP

    6144:0ZLT3A5Dp0HvFIc5vBlcQGSgS62iiiiiSySYSGS+8c8c8AAANA/AA0fMGrgPhclc:0ZL7A5l0711g8onrOcWAqVvv/JYeiJI

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\105471cd9d4eb09ec42bac2b0290f889_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\105471cd9d4eb09ec42bac2b0290f889_JaffaCakes118.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:3856
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:3500
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 204
                6⤵
                • Program crash
                PID:4092
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3544
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3544 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2120
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:996
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:540
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 612
          3⤵
          • Program crash
          PID:4900
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1920 -ip 1920
      1⤵
        PID:1148
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3500 -ip 3500
        1⤵
          PID:1836

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E21B62A3-335E-11EF-BA70-4A6FEDA150B9}.dat

          Filesize

          5KB

          MD5

          591af6151bb0829176f8edec4fb399d9

          SHA1

          38152118fca1142ec28ae692fe279f58ac049fa7

          SHA256

          dda11e48e6cb25213bc94b0538ee4957b20ccbc9f5dd853614df416cba277733

          SHA512

          67160915a087f6e2a368c321b9992546cc6796a2dd7b5794df6b42b80e96902af8dd5adfd831ff75a3685d47061caa4aa83a1cdf8f73bf5192a1075d31665fe3

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E21DC531-335E-11EF-BA70-4A6FEDA150B9}.dat

          Filesize

          3KB

          MD5

          e34e82adaf08e2ee4ec44c42b8fe5f48

          SHA1

          b8c92a7c810a7e4f70c6dac2d59669959b6b66a0

          SHA256

          3a659f8decef1fb10207fa3cd9cfd87d723e46119125b59210055935fee9a123

          SHA512

          a3b85bcfa9716bba14afd6e8cf8d9f2153492b82f354ee61a97d9d217f024d5e148cfeaec5affef8d8ac989a0e8c0bf20420b5c815f1898cea9dc20026dac4da

        • C:\Windows\SysWOW64\rundll32mgr.exe

          Filesize

          60KB

          MD5

          c27dc77f49f2be740e3bf1b64387882e

          SHA1

          82f4ce73d55f46e1ecccbf406f9420364a82872f

          SHA256

          a0bac67a54681dcc7ec8204eb959a540356568b06b1a03cec6ec42ed6e9f1715

          SHA512

          14880de329428973dbcc2c726fee09dcc3666ab7aab69e32864577e01216ca8a58ac901d261ad1a84e0d3d6926c328b53d92beb695cc3dd1d6f453a5d853314e

        • memory/1896-28-0x0000000002830000-0x0000000002831000-memory.dmp

          Filesize

          4KB

        • memory/1896-35-0x0000000077152000-0x0000000077153000-memory.dmp

          Filesize

          4KB

        • memory/1896-41-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/1896-20-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/1896-39-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/1896-36-0x0000000000070000-0x0000000000071000-memory.dmp

          Filesize

          4KB

        • memory/1896-30-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/1896-29-0x0000000077152000-0x0000000077153000-memory.dmp

          Filesize

          4KB

        • memory/1896-27-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/1920-34-0x0000000010000000-0x0000000010086000-memory.dmp

          Filesize

          536KB

        • memory/1920-0-0x0000000010000000-0x0000000010086000-memory.dmp

          Filesize

          536KB

        • memory/3500-33-0x00000000005C0000-0x00000000005C1000-memory.dmp

          Filesize

          4KB

        • memory/3500-32-0x00000000005E0000-0x00000000005E1000-memory.dmp

          Filesize

          4KB

        • memory/3856-8-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/3856-7-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/3856-6-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/3856-11-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/3856-14-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/3856-9-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/3856-5-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/3856-15-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/3856-10-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB