Analysis

  • max time kernel
    132s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 02:04

General

  • Target

    df4b4879a41c953b796e08f84d8d6615_JaffaCakes118.html

  • Size

    157KB

  • MD5

    df4b4879a41c953b796e08f84d8d6615

  • SHA1

    104d4ee1a09ae8b6c578c768d12d2e06e45bb742

  • SHA256

    3a616bacbd957335c09f3574169229db7252dd5844690c23e06848d74323b85d

  • SHA512

    eb2a4827385654ddf86acf9e9af33bbeae1e87ce02386d02cbbd3b986e8d04cb37d5bf6aef86045d75a65b5727a5492db5cc75fd2ab02880e13b9d18290d9a65

  • SSDEEP

    1536:iXRT1YVvweLI+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:i5H+yfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\df4b4879a41c953b796e08f84d8d6615_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1264
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1348
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2160
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1584
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:472078 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2136

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5f1224bab809bf28a52d6c5466fe3a90

      SHA1

      9bb2f6f15781b1ae6106c926dbe10e1a6d6b8671

      SHA256

      674f8e37d2df22cd8cae6a127cdbe22aa338038a9abf15663d180af664836c99

      SHA512

      a05fc9f15f58d02915b9d261e7f71d118b6faffa8a44832456a6dbd495fca6bab66e2f246556571929a8463cd2035eb77440f53c7135f2a2ae076d8417447b76

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8eaca06b4b4678e126daa6299f4cb29e

      SHA1

      c7a5abbab5f36e462a423b43b6b7582367da4e1e

      SHA256

      3d256dd070054eb2f2409db88af0843b2f0c0f8417051fe2fdb94d25a32069e9

      SHA512

      62d58a0249f0607474aa732bd39f646e2d2865985a9a0669b08db62a420f45e676b34d25a04808b429cca6b5cc4f23d64bedc6944a121d6a27c2964aae62888c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f66b01a5fb56ebf8af4edab29a280160

      SHA1

      c3dcb8c7c70b446c66271211941f12d98bc393c7

      SHA256

      3a11b75a0d87321ac99221b5004f00f35a5564a09326ace16890369702780899

      SHA512

      550f775dc9458b94d21ce2b5f2efa0793334ce541662215c0d612d7084a81dfeec9a938033392929df5abc2b5d4967b0ee2ebbf57dd37022b049ae57ca2106b9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      934af906cc24b8e28d89381a0717c34c

      SHA1

      51d056c7d7ecbc855d6e419060d9abde40f0f23f

      SHA256

      8b65e80d8e7b3045586cab544f41d53ce54d1cd130fc7e9b8af33ad52e7dd7d9

      SHA512

      cc66f93334621a48c008a9ef04dafff674acd85824006db4cab6de6a924601a46f998f34a4bef2e3682ec120803ae6afa7d7aae03e2590b457b598a4db6433ac

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      0db1e1ddafd002320cfe393b815c3e25

      SHA1

      a9b895c699c537413cf113b087c4f1ab5724ef2d

      SHA256

      8b0715b1fdb7dfa72a0a0c0ac76e77ce763e92302741c65ff411c9803a0fb6b1

      SHA512

      83ab6e48cd168bd98c9f27517bf35a80056325a90019cb4b31c0ab1f0cdf404c98c81360a9b33e8a405add2f6aadcdf06e398948546a24ab8780a112425d407f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e934c0526849272338193ae2330c4a7b

      SHA1

      a84411b2c1617cbfa931aa6bb1c273b1503f7de9

      SHA256

      25cdfc3e17cc0cbf40cbe0127d7cd1f9af4be9a5e8e76d5b6d4be93ce150d39f

      SHA512

      2eae874ba8a8df2e2561d246b04afb99ce9d35eb10e1dc6cfaac373e9ca38f44383cb1fc56e8de9bed3b7cdec2a87281f72a21ad1e61b83460057f7d1095fc95

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      cdf5b1ad7463d3a58fb78be309fcd926

      SHA1

      1ef347dc12492851874f2255594c817f7f9d1ba2

      SHA256

      eeef08cfbfb3004cd9f3145011afbbc9f98029ff53ea1a40435dc019a60c05ff

      SHA512

      57fc4115961a26c4a7d9b07bb235f8a6455b0fb7da01c099552fc92c2fa3f5f9c4e15787bf8c64e9131737eff2738ae7c7ac59adf6a6e51b341c46e3b0262c2b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e1ffe81b55a4a99819ec4843f5d69136

      SHA1

      3e8557d33ba8c4cfd2918a4192013a715d02e8d4

      SHA256

      dfc1378cee02698093ba34402336712d58c18c122119a57f70096009e391c7db

      SHA512

      b28d770dad32d6e291ad8a67f7e18e4a11931a4329ed114ed41ff2a37dee5570374ad6873f7f4488d9c0139425b4cec439d0b29f61b9d8b1ddac799245be524c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bb5cfbf04ba74fab28552c5cbf0caca6

      SHA1

      e5003314ffe2e96a46b6d8d6a96176e01467c8b0

      SHA256

      849afdf01137799b2fbb10f83b879c7d39d0f7abc98522718c59aa15034d5691

      SHA512

      4739145d5580f5c1b283d0ae54e66c0690d2cb80d2678ca2e7f0b38584d27a583232963e4baa4613daadaa8ebaae1dcd2f0c7a3475b780423f05a4b5680c6276

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3ae96b25a54d48e2fd852bd78af69baa

      SHA1

      3fa6fea6c696753cefa4a706877c8a3aebd589dc

      SHA256

      16316580422cf35413403d10e447189cd7dec49650b2fa9febc2d23eb5c3756c

      SHA512

      59dfe550357051757e27455f4073d110a9ef4f6d28ac3ea8e99b8a7caaeb36860684daeeeaabf001af7b0e35d4de4f77a7be4007005609fab5054d11c1f962bf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a0f6de4428668c92b75d83066503ba6d

      SHA1

      78bfd862a1384e163db8676ca3e22b98b7fa6a5d

      SHA256

      e9e843188e52a9f67b814b6f90e06bef4d6078944295fd562f1caecc0bab6559

      SHA512

      0786c7105a94a68e80d2675287ce0b25f6f48103290bf6719399fcdb167cf8437f3e719126c55f228ac7ce34d99d441255be75d9fcd6c062d5d9c8664cb22f31

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      198403501642c9af305faa95ec501d29

      SHA1

      c7249e914002e3272de3399ea9e21c599de29c3a

      SHA256

      4bdd46e8e3c939fe8e1305bfe7c47ae99691a9a05a67f8ef09736cb696b63262

      SHA512

      5eaa0ddb9f36e2f541d02ec152c5225ed9d280d4b81aed45f6848403f5a90c3d31a384f430cf2952102da0d00db9bed520ee4706489245086c77ab2cff84c241

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      232ac23d07f0886f4350d64b34289c26

      SHA1

      a3c2476a748977cff298d9b5fa712c576b033372

      SHA256

      4a4124a1080c19dbfd170e65aed14e59af8f04af632f789e7ddd4b2e2dc5e899

      SHA512

      e85c7cecd9d5242fcfcdda5e5d983813927b9283e6f82e8c734910de94ccc937d5a292a61f9a022b85b55b5162e8fc4ff5e467182995e1808733ba59fc1ad14c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bdbff1fee3ad444f5ea73a489973f544

      SHA1

      ad2bcba48dc7b5be8c9d1e8a08c6dba1f5b0146a

      SHA256

      a3c0832882d2b696309517ac4e7a061a31e4ea6004b96e97bed72a07812b940b

      SHA512

      1934c0319712871c31e243d2b917ee7a966d76129d969840d8c0b2e485a54a917aa150f559c3fb2f10281a8bf21bdbdee663a476eaf72c3a5b8b5a954c971588

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      276692e85cf6df0656b72ccbc8a1170f

      SHA1

      76b489ab500980728f4f027ddd4059292cb39456

      SHA256

      b9dcae0148c60b3db186860a746ecccea3fcba3deac5f9e39d39d8562f528eee

      SHA512

      63c51cd818b9218434cb3d7eeac58ab1e853acd5180de6dae032dc722ab6c4079defd96d88d31adc976cb04f39dce5cc44ed6661cd5da3b54581c0eaf844ac39

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      16f851f0a9f1b913854c584697ce1a91

      SHA1

      80204d6c3f6aa2747123177de79b284ca45f0389

      SHA256

      8164d06440701e84cb27da7981da7c2fd0fb8eb7cb8c56a233e81138f81f75ac

      SHA512

      033fb3c6abd2ad5145e0d1bb9bfa83bbb4da581016bbcad71abc1b17d19fca8a94d3e73fe9ffbe95e8920fcc2d571110ea5a17b11f03e83044f51750c920e3c4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      859e569436bf671fb47780dd565829cf

      SHA1

      fc436a0984f09c77dba8108b83e11ee3af9fd9f1

      SHA256

      ec5fd02ef8eab65cc10bb832de775aded92be845a230b23ada0d6a30355abaa2

      SHA512

      a8e8906a7e4d0dfe2caa9b805683471f8e159da8c4482485146dbcf1986355dcb31895f0a2d1eb112f0544ff63005f826993e30ee2ece3339ad0b3aee876dad2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2f3c5a5a112203c4cb1521b18bdd9df3

      SHA1

      1fc4e21539ad115e5b38533a122d2932668741be

      SHA256

      c8288a0040d3764630726c3e63cbb276f1afade67b873ae430d5ff2689f85570

      SHA512

      ade1703ad565d1bb6fdbcb264e11dbcaab8371c60cc440f9e5d11927ef12aa3f2eec9911db0270d2792a1e366b89cd7604814cc854bb9a4baeb6fb186055cd63

    • C:\Users\Admin\AppData\Local\Temp\CabB451.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarB502.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1348-437-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/1348-438-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1348-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2160-451-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2160-449-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2160-448-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2160-445-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2160-447-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2160-444-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB