Analysis

  • max time kernel
    94s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 21:45

General

  • Target

    109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe

  • Size

    46KB

  • MD5

    109cfc09fd1bf2dd9c1e05c681e5a7f7

  • SHA1

    9c5d91f9ad9e1d14676e7ad194a72d9077d2ee77

  • SHA256

    0a0f7f83fee9778a35af0d7ecc3ff7ecd99d365a659c1ed8da4804467f780a48

  • SHA512

    8012e00d69acaf133aed58033bc1815650cab3330464fc7eab2f034bedb10110210bd6e23cb30af822c46038d08d39e993cf15f3a1a3b81a03cfb27963f77157

  • SSDEEP

    768:pL70HBuggGV+NxR72o4kAwkVZVVIifk8XeaBx:pLjggGoxR72o4kKZVVkaBx

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\109cfc09fd1bf2dd9c1e05c681e5a7f7_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:848
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:17410 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:852

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe

          Filesize

          46KB

          MD5

          109cfc09fd1bf2dd9c1e05c681e5a7f7

          SHA1

          9c5d91f9ad9e1d14676e7ad194a72d9077d2ee77

          SHA256

          0a0f7f83fee9778a35af0d7ecc3ff7ecd99d365a659c1ed8da4804467f780a48

          SHA512

          8012e00d69acaf133aed58033bc1815650cab3330464fc7eab2f034bedb10110210bd6e23cb30af822c46038d08d39e993cf15f3a1a3b81a03cfb27963f77157

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          6de4427d02d49cee2c46a8fead1fafa8

          SHA1

          bee49bf0e4452ca72442face8e655bf4a8c3af17

          SHA256

          46d5cd7ff558e5c788807eb674587359c6a660cef091eb420676977e49833d53

          SHA512

          c80311bb92f9f49de96d06e9a76a3ef0310365999f00f401fd003d438b66744a88f093b5887e1723c6b8179798697ec24c4b2bda489323337f6cec6d28ef6434

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          302b76c575bbef3233c4669a4d3a92a9

          SHA1

          c955f832c55c0d097f7706b6f8bed8ab0b57d228

          SHA256

          220b62706230f7067f46990d53ff3049f68fa203e353658ef8ac642e00e60a8a

          SHA512

          e1c6d04c0c94f36b3de57ccac272015b17f40d468253c0511aa4f18e6ff5a9e6b40ef30d4961aba764d0c55618eb4c8b64907400eba3ab2ab27a525b9efdf27c

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WLXU5DI6\suggestions[1].en-US

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • memory/848-12-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/848-9-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/848-8-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/848-10-0x0000000002040000-0x0000000002041000-memory.dmp

          Filesize

          4KB

        • memory/848-11-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/3996-0-0x0000000002170000-0x0000000002179000-memory.dmp

          Filesize

          36KB

        • memory/3996-7-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/3996-5-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/3996-1-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB