Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 04:44

General

  • Target

    10c30b617298dff59705da9fb038394e_JaffaCakes118.dll

  • Size

    204KB

  • MD5

    10c30b617298dff59705da9fb038394e

  • SHA1

    92dbaef54f355fc8806d85c4c3adb198b140a50c

  • SHA256

    9391da6d8fc9a7f07b81aac67ec99d63159fae2ec3b8b13b63f6e043b535c50b

  • SHA512

    b7d33ca3105c7b976fcc8ad26e1023c16f8ba0452b2ffbc90c704e7d357c89feeff5160ac6c55288b823598ce5c12f4991bc3ee4cc0ef9de31d527522d173ea1

  • SSDEEP

    3072:jvXmimD0k0QRW1PhI1sItKOgGdX3DUPnObj6pZnbR3nyf65QJgz8CevPfQ:j+fD/0QSzItKOgGFYmbj6p33oJJnZ3fQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\10c30b617298dff59705da9fb038394e_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\10c30b617298dff59705da9fb038394e_JaffaCakes118.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4232
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:920
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:4388
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:2924
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 204
                6⤵
                • Program crash
                PID:3496
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:740
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:740 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:3912
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4064
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4064 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:4992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2924 -ip 2924
      1⤵
        PID:2096

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D501F50E-3376-11EF-BCA5-F2AC8AF4D319}.dat

        Filesize

        3KB

        MD5

        3a459b6862dc0161d540489d93a36a4b

        SHA1

        bed779ce081a3b0f0103143a0343333d8c2a0a52

        SHA256

        234af64c4d1766d29018226bc1861c89dca6539c222199f9f8e610a462ecf408

        SHA512

        5d74aa0b492b460995ce937cc0b11f45aae7ebb61a0168e8321ff54183f57aa2451bed763cb4cafa00ae789d3b8e42d7320781e043e96ff6f2cf21f9b5d567a3

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D504574D-3376-11EF-BCA5-F2AC8AF4D319}.dat

        Filesize

        5KB

        MD5

        e85ba23a54ad26addef31d4200173caa

        SHA1

        f714f64e602406738d58fa354ee2803c08023966

        SHA256

        f06390bf1387a4eb6bf3b287a3999d9b1ad548c42dfe16e2933172699e320774

        SHA512

        3dfdd27fea0d71ca08a83ef2c7b864b289edcfb8537e8643753b3211437d387e479c032c90ea2fa1ad3a85fb9186e0b943b1a0527d75c4de1e1f34e90d071b0f

      • C:\Windows\SysWOW64\rundll32mgr.exe

        Filesize

        111KB

        MD5

        076b881c26b76c254df2d24b1410d64c

        SHA1

        0c3591cde9733b69f8f19be8458638a0a343adbf

        SHA256

        e778aab6e5d2cd6372eacdb27867e5df7d4555d8497299461814d8ce51961100

        SHA512

        5cff93b35a6497837d4dc53393bdc3e81753ef8c08b98ff880d457268208ae1ece6578450b9898dfb4b0d43c1a250b15f9e148ab4e85ff3a9a5db144c728afe8

      • memory/920-8-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/920-6-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/920-12-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/920-15-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/920-5-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

      • memory/920-26-0x0000000000401000-0x0000000000416000-memory.dmp

        Filesize

        84KB

      • memory/920-25-0x0000000000416000-0x0000000000420000-memory.dmp

        Filesize

        40KB

      • memory/920-9-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/920-7-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/920-10-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/920-11-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2924-30-0x0000000000880000-0x0000000000881000-memory.dmp

        Filesize

        4KB

      • memory/2924-29-0x00000000008A0000-0x00000000008A1000-memory.dmp

        Filesize

        4KB

      • memory/4232-0-0x0000000010000000-0x0000000010033000-memory.dmp

        Filesize

        204KB

      • memory/4388-33-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

      • memory/4388-31-0x0000000000870000-0x0000000000871000-memory.dmp

        Filesize

        4KB

      • memory/4388-32-0x0000000077EC2000-0x0000000077EC3000-memory.dmp

        Filesize

        4KB

      • memory/4388-34-0x0000000000070000-0x0000000000071000-memory.dmp

        Filesize

        4KB

      • memory/4388-35-0x0000000077EC2000-0x0000000077EC3000-memory.dmp

        Filesize

        4KB

      • memory/4388-28-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4388-24-0x0000000003100000-0x0000000003101000-memory.dmp

        Filesize

        4KB

      • memory/4388-38-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB