Overview

overview

10

Static

static

3

171ff1fc81...18.dll

windows7-x64

7

171ff1fc81...18.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    125s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 18:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    171ff1fc81cbd66bc08a149aa4f7aafb_JaffaCakes118.dll

  • Size

    128KB

  • MD5

    171ff1fc81cbd66bc08a149aa4f7aafb

  • SHA1

    991e3273caa02ea4b39bb7bc0d1adcc9b2892f86

  • SHA256

    a5b90acade437f168da01cfaa49afcd53b1009f651205eb6d8b218e804b45546

  • SHA512

    efccce0e4118898862ce31f8eee5b9936d974ef31e10c489a0618d2661dde63cbd5aac72c477acf88db7166ea88837ac02a6058313b277487f89507037428196

  • SSDEEP

    3072:cnyNyBzvw3LUfoOTHUAKyvE/vb7HDnrE8Mx:cnZvw3w+mvSvb7c8Mx

Score
10/10
ramnitbankerspywarestealertrojanupxworm

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit
  • Executes dropped EXE 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
    adwarespyware
  • Modifies registry class 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\171ff1fc81cbd66bc08a149aa4f7aafb_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\171ff1fc81cbd66bc08a149aa4f7aafb_JaffaCakes118.dll
      2⤵
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\SysWOW64\regsvr32mgr.exe
        C:\Windows\SysWOW64\regsvr32mgr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:4072
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:4236
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:4428
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 204
                6⤵
                • Program crash
                PID:3300
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2308
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:4868
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2732
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4428 -ip 4428
      1⤵
        PID:4628
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
        1⤵
          PID:3456

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                471B

                MD5

                fa34ecb8815a2d98849888cb1cdbf38b

                SHA1

                84fd0e04586009efb3683c98da8d9aa41487cd42

                SHA256

                5077a54924f80491a74ed78bbd73ff7bf85a27caddb80ceaa9ccb86f8b9a11be

                SHA512

                ccfdb76ccedd0076601e17272d346229e2b9c0dd884c09bb7701b32c5dc177da8a91bb539ce751297d8ea44716fc497e8a337a9499c93a474ba85915f28f1053

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                404B

                MD5

                779dc84cca87b362d74ec4915bdf5998

                SHA1

                d6b6afac63544f782eaf0fd654e8fa3d628b6d8f

                SHA256

                f97829bd947cc227a8aaa832afc54368f4be311770416e4bb0e7d8f11608b555

                SHA512

                9d9c52d5e8dacb3881fbefdca0dee594f9d5653bc0df3101c77e537b9ac53cdf93f71db15d0478d2f7961daddca4a48022389bf8d6a7771f902d88045dd7681a

                Download Submit

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                Filesize

                404B

                MD5

                780f961187af1dd983c6a7e9180dcb85

                SHA1

                6924cae1ff61088491ae228b2db5676e2bc5b473

                SHA256

                badf6b64fe497889ec4f4f6c42ed53407390b2db930378d81336af09139d5ab6

                SHA512

                8f224169990fef00eeffe49dfee2b75d67542dcea2162a0e88e27ae056298f493f454a125aec978d50d00226e9fce5585deae13005419dd3f70fac8ccfca2fd8

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2E17061E-34B6-11EF-B8C0-F20C5DF75BB0}.dat
                Filesize

                3KB

                MD5

                8427ea7e51935b00b620aa4f9e622979

                SHA1

                58221246a013696e7fe695eb3ddf05625edfdb21

                SHA256

                3642ef391ab772b16cd0d0af08a66f8916165a68099fa0fcae72a364e0a2cae5

                SHA512

                9914d2298ecf0badd5d24f6d0e58d838f87a64640e3d541836efc7a5bb3a4d61c793a9e7b22f16d3a56b6fff1ae15885c095de6c59966937a18bfef9b82138ac

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2E19686C-34B6-11EF-B8C0-F20C5DF75BB0}.dat
                Filesize

                5KB

                MD5

                27229a7cd5aa4f54e379e97230fd7d16

                SHA1

                6315e2648c7f3c6461c69d222f99e11369d1ed69

                SHA256

                63bc8f8305941cec854c38fa74405a2ca38cf2bc7a4c8374c9d48614445b4219

                SHA512

                464b143d9ff2ba899d8f37704ddbafee49812b5951d26ba0e7b0d23c2e0f6243239487ad378e614e0d009c593ef8c018f4f4b1c57cdf6dad99c0e4ef9d977c7d

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver68D7.tmp
                Filesize

                15KB

                MD5

                1a545d0052b581fbb2ab4c52133846bc

                SHA1

                62f3266a9b9925cd6d98658b92adec673cbe3dd3

                SHA256

                557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

                SHA512

                bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\suggestions[1].en-US
                Filesize

                17KB

                MD5

                5a34cb996293fde2cb7a4ac89587393a

                SHA1

                3c96c993500690d1a77873cd62bc639b3a10653f

                SHA256

                c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                SHA512

                e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                Download Submit

              • C:\Windows\SysWOW64\regsvr32mgr.exe
                Filesize

                59KB

                MD5

                0e0f0ae845d89c22bb6385f64a6b85fd

                SHA1

                0f3f1e7f18ab81572c5ce938d3880d4a5d7100ac

                SHA256

                5a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd

                SHA512

                baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350

                Download Submit

              • memory/3588-1-0x000000002E200000-0x000000002E222000-memory.dmp

                Filesize

                136KB

                Download

              • memory/4072-9-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

                Download

              • memory/4072-20-0x0000000000401000-0x0000000000405000-memory.dmp

                Filesize

                16KB

                Download

              • memory/4072-15-0x00000000008A0000-0x00000000008A1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4072-12-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

                Download

              • memory/4072-10-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

                Download

              • memory/4072-5-0x0000000000401000-0x0000000000405000-memory.dmp

                Filesize

                16KB

                Download

              • memory/4072-8-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

                Download

              • memory/4072-7-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

                Download

              • memory/4072-6-0x0000000000400000-0x0000000000423000-memory.dmp

                Filesize

                140KB

                Download

              • memory/4072-11-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

                Download

              • memory/4072-16-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

                Download

              • memory/4236-34-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

                Download

              • memory/4236-28-0x0000000000900000-0x0000000000901000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4236-39-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

                Download

              • memory/4236-29-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

                Download

              • memory/4236-36-0x0000000000070000-0x0000000000071000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4236-35-0x0000000076F42000-0x0000000076F43000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4236-30-0x0000000076F42000-0x0000000076F43000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4428-33-0x0000000000D40000-0x0000000000D41000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4428-32-0x0000000000D60000-0x0000000000D61000-memory.dmp

                Filesize

                4KB

                Download