Analysis

  • max time kernel
    81s
  • max time network
    91s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 07:48

General

  • Target

    113da7d187f20fe726dc04e1b86ed1a1_JaffaCakes118.dll

  • Size

    193KB

  • MD5

    113da7d187f20fe726dc04e1b86ed1a1

  • SHA1

    592790461e388de6cfe81261622cac52c4c2d337

  • SHA256

    bd5440f408773d078e21b726e5bcc8931aa78b396204a969edd3f06a40f01520

  • SHA512

    84eba7665a4906f4e5064676cec8eb98b1fda00a1d524ca91174d3eac21799e1867bc9cfbb76566c8fc21017080c061c19949c534e86436f05b95ad4bf0855cf

  • SSDEEP

    3072:I73MITL/9oSmkbx3ZtffjBTnIwanLM0EWARqiyp0giE/Uco+yuO:OdTpountf75Iwk3Biyw2RAuO

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Modifies registry class 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\113da7d187f20fe726dc04e1b86ed1a1_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\113da7d187f20fe726dc04e1b86ed1a1_JaffaCakes118.dll
      2⤵
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3428
      • C:\Windows\SysWOW64\regsvr32mgr.exe
        C:\Windows\SysWOW64\regsvr32mgr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:1156
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:220
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:1236
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 204
                6⤵
                • Program crash
                PID:2900
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2280
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:3416
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4752
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4752 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:380
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1236 -ip 1236
      1⤵
        PID:2416

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7782E3C2-3390-11EF-BCA5-E20E9B62A9C1}.dat

        Filesize

        5KB

        MD5

        bc300c332f319c40ac2296c3a87ba7c4

        SHA1

        82e669515b8b67f0f05c3c1163143ccdd6eedce9

        SHA256

        5ee3ca598f3cd405b286362d2d2bd96f0489f0b51828a285a6ecf15a2d5ef24b

        SHA512

        4861a7f85d5d0d85a6fa11fde77bb4b387855cb0d2341c899b31e0b0883a8028715ee3fcfb683a042a39679b7bc8791038df714b13331a2246026aa23cd3a7ad

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{778545F3-3390-11EF-BCA5-E20E9B62A9C1}.dat

        Filesize

        3KB

        MD5

        bc60cc1283505ab3d53e87209309f3a0

        SHA1

        fe7269907085387aa588d5e629d8d29fdeb5e639

        SHA256

        e374e8acbc77bc428155d3bc50e40f25f1721177a016f81c1ef9426b2863f53f

        SHA512

        789f6403cd8fd874ba749e039fd67b2fa56f85a3c437f4af264703a946084cc5a65d59a113c9c585e3a2b1783e58bae9b93538337bb74fa3eb946989f1b2b893

      • C:\Windows\SysWOW64\regsvr32mgr.exe

        Filesize

        96KB

        MD5

        8c51fd9d6daa7b6137634de19a49452c

        SHA1

        db2a11cca434bacad2bf42adeecae38e99cf64f8

        SHA256

        528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3

        SHA512

        b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837

      • memory/220-26-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/220-38-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/220-34-0x0000000000070000-0x0000000000071000-memory.dmp

        Filesize

        4KB

      • memory/220-33-0x0000000077E62000-0x0000000077E63000-memory.dmp

        Filesize

        4KB

      • memory/220-29-0x0000000077E62000-0x0000000077E63000-memory.dmp

        Filesize

        4KB

      • memory/220-28-0x0000000000430000-0x0000000000431000-memory.dmp

        Filesize

        4KB

      • memory/220-27-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1156-7-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1156-6-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1156-13-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1156-14-0x00000000014C0000-0x00000000014C1000-memory.dmp

        Filesize

        4KB

      • memory/1156-12-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1156-8-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1156-11-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1156-9-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/1156-4-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1236-32-0x0000000000160000-0x0000000000161000-memory.dmp

        Filesize

        4KB

      • memory/1236-31-0x0000000000180000-0x0000000000181000-memory.dmp

        Filesize

        4KB

      • memory/3428-1-0x0000000075800000-0x0000000075833000-memory.dmp

        Filesize

        204KB