Analysis

  • max time kernel
    81s
  • max time network
    91s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 07:18

General

  • Target

    1128a69bef2a54b8c04e4232db4cf045_JaffaCakes118.exe

  • Size

    92KB

  • MD5

    1128a69bef2a54b8c04e4232db4cf045

  • SHA1

    d51dc1c53356399c2cfac0b3398d684015663dd8

  • SHA256

    72af033ddfe9ad63fecc9121a96b2e502667160e0c0a71743bb7c591eb82d0c6

  • SHA512

    46b8231e3a8d87c36dc5dba0f097aeb1b2f135434991b18eb99c6ff2d562f2e3f32cc1c73de6380787e903ee5cb3efa870dfe8acd4c1c4a6ace9086a1ca0a108

  • SSDEEP

    1536:jVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApE:7nxwgxgfR/DVG7wBpE

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1128a69bef2a54b8c04e4232db4cf045_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1128a69bef2a54b8c04e4232db4cf045_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2964
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 204
            4⤵
            • Program crash
            PID:2268
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4900
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4900 CREDAT:17410 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:548
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1252
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:17410 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4936
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2964 -ip 2964
      1⤵
        PID:3352

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\WaterMark.exe

        Filesize

        92KB

        MD5

        1128a69bef2a54b8c04e4232db4cf045

        SHA1

        d51dc1c53356399c2cfac0b3398d684015663dd8

        SHA256

        72af033ddfe9ad63fecc9121a96b2e502667160e0c0a71743bb7c591eb82d0c6

        SHA512

        46b8231e3a8d87c36dc5dba0f097aeb1b2f135434991b18eb99c6ff2d562f2e3f32cc1c73de6380787e903ee5cb3efa870dfe8acd4c1c4a6ace9086a1ca0a108

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4E4F60CB-338C-11EF-BA70-F2AC8AF4D319}.dat

        Filesize

        3KB

        MD5

        b471e17a33ea3e6f2589e1a1ee2dd927

        SHA1

        8492a8375ea662ddaffa964c2cdce5cc6f65dd87

        SHA256

        9bd830ee1b3c7060ee716ed18183df3b36338022066dbd58aa9f6fac76af6bbd

        SHA512

        398a31f14649f952d4cf688d52030fe2409e69bae583330a02225cf5f76b66012ca9b54dbf075bfa040ab6bc724f0e1ca0cc47d7acfe86694bf71b00874d0828

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4E51C2EE-338C-11EF-BA70-F2AC8AF4D319}.dat

        Filesize

        5KB

        MD5

        812924d45332ef34cd141728d613c88f

        SHA1

        1bce12bc403e2c824e4f74369749d6fe87f23453

        SHA256

        ff284d20537d834ce1c05206e1d034d02f40b80b33d58b2129ae6a35467f7a26

        SHA512

        507e4d1fa806397f1d76b5ca0df9975526a99615e634c2042586c2e3ee7b8855b41d0ffc8bd0c97def245705a99da56b55c3d4d1f9fde28d9590b8147b45f2af

      • memory/764-31-0x00000000777E2000-0x00000000777E3000-memory.dmp

        Filesize

        4KB

      • memory/764-30-0x0000000000070000-0x0000000000071000-memory.dmp

        Filesize

        4KB

      • memory/764-35-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/764-34-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/764-24-0x0000000000470000-0x0000000000471000-memory.dmp

        Filesize

        4KB

      • memory/764-26-0x00000000777E2000-0x00000000777E3000-memory.dmp

        Filesize

        4KB

      • memory/764-27-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/764-23-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/764-22-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2196-5-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2196-9-0x00000000028D0000-0x00000000028D1000-memory.dmp

        Filesize

        4KB

      • memory/2196-8-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2196-2-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2196-0-0x0000000000400000-0x00000000004B0000-memory.dmp

        Filesize

        704KB

      • memory/2196-7-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2196-4-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2196-1-0x0000000000401000-0x0000000000402000-memory.dmp

        Filesize

        4KB

      • memory/2196-3-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2196-6-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/2964-28-0x0000000000E70000-0x0000000000E71000-memory.dmp

        Filesize

        4KB

      • memory/2964-29-0x0000000000E50000-0x0000000000E51000-memory.dmp

        Filesize

        4KB