Analysis

  • max time kernel
    132s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 14:51

General

  • Target

    0f3c5acd27eb21ee0ab09d35d99e9aca_JaffaCakes118.html

  • Size

    158KB

  • MD5

    0f3c5acd27eb21ee0ab09d35d99e9aca

  • SHA1

    0140d66d9b784124f83b7f33981222802b806746

  • SHA256

    45a0931c9a626e9981855f137429c435fdbafa8761a930d955ed5c4d74cc4af6

  • SHA512

    b2f679c4a1dfa07e8a226048a8372bea76d4e2b3d15a920542363954e9b80dd4773ac9fba147e824eef88c7925bbe07167297f48ba1047fd34b1a68999010fda

  • SSDEEP

    1536:iVRTepgAga9NbyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:iDmj9NbyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f3c5acd27eb21ee0ab09d35d99e9aca_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:316
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2460
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2084
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2396
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275471 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1960

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            3d511070adb8ad0d5ee27b7dad9e3f9d

            SHA1

            7e1d7895b46a92a6db297f56b596a6bd1008314c

            SHA256

            5b9d4837bdd441e9bca446774da51fe57895a77aff8c4ced81c1a2496615aabd

            SHA512

            3214932401cc8283c6bb8dcb2650b458d4b8db8bade009c6cd7c6535332693ae228720f6d463d936d785210c0a33f12d2518e00b66814a8c53d137f60c6c911d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            cc5a1adb3486f875e2e5f9e10d97133e

            SHA1

            0ef9e71145111cd0800c285039fd92acf4593a3d

            SHA256

            5988638d9e2ef3ad2325690e11cee6d9781993a25ab4e995838b188a8187a2ee

            SHA512

            01d6e01b39a543b86becf2df46f42af52ef07d025308d9d25bd7138f713eb1fbbf6da095a8d4774be5c9b67f0ea4297bbe3c27071262305e0c325b43e95c3d1f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ac9a0d4c13d68f7a4b4d47707566c3c4

            SHA1

            869be5ffe40ab70bcf04b5d95deebfac176f4a4d

            SHA256

            75a24e8114855005342acff1abc6d5e2f0d837a13393fce21213957c980875e8

            SHA512

            02f6c8dcc13a554de4d00878e6b9801fd93bd4e4f08e6455ee7e589daf235a62e22c9d522a6a3aafa441bb875c888145dbd474d9863ddcb1b0d2ac900f74cc96

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            36db2b11846950e30f75fd6bda8d6048

            SHA1

            dfe97751069c61dfe58871055b02b47b0155d3be

            SHA256

            ac4ef5f2bfdff2abd0bc5c9ed45de1a90fe9a6240242955072448cf4bccd49bc

            SHA512

            9c396dbad4c17d5a645dc64d0fd60fc85d998b938c447624b9db0f824e0b1e3f9776fcfc899cf9ef92434b6f719c654d2ad073ed07a7ccf48a2cf8ecebc5b3a4

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            680027097af199467b7ae05c95ae15da

            SHA1

            722f5d0cb761f0fe21124c0a0df5ba3c77dcc466

            SHA256

            3ad69ca6406d4aa6378ea82d8465770fba5986100edc69653c67b7dfc3d0cbd2

            SHA512

            e0053accf3e22225e17875308546b16682b5c6eca982e8ae590a14ecc50c5578661d9828a0c40e5b607e4135c2cacc214da1ca46a4e66607954868b2d6fc1f34

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e306c7adc0a31ae2a32d98dee6a6e388

            SHA1

            9f17fb0556d1dc59fe4a566ff33afd8013add74c

            SHA256

            d253dc1a6b61cb16dca8e7f1f995a139f236eb5f4466060298d315b812f2e958

            SHA512

            14e5caf0d98195e838e16500a817098d3017a99537ec10414bf6e207a69ef6dad1437aa843e08ec2e49f06a157e86f7ce431d5b002b91fc478d22167dce0827a

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1f1462fd34ed668e5b9bbd5f26eb37bc

            SHA1

            8bf7277bb87c1fc2d650c48299a1f6e6aa6838cb

            SHA256

            4be5d5fdd85f92e0ebbc5197b3bebd36f0eeaf682fbd2dfdabec0bb3cb1fb99d

            SHA512

            255272e830b9bcc12233eb2876b7883a991b90a67eadec61df2186e6985d9520615c4dcea68087d393fe72371efa5fd77487f8c50d5ed1f4ffcdc3bb6adae5c9

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ede2b326aed5e41022cc365005bf7dc2

            SHA1

            0bea299b538c63073711ae4e1c13fcbaed60960b

            SHA256

            13925ca1a3788ffd8a7d0e24f000421f776ae441406772d5db33ecf65c5d2545

            SHA512

            c82de749b2fb94c621114bdb7667b72504e7121b6e010cb826be6b811bf273aee9011f4e089b9b88d95b0b53646dd2ca379b10988a6cb334b826cff655b8ca08

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            97ddd2d07f1f8618b09f79a6cc684f74

            SHA1

            ebbd8528eea9eb4d3effeab5ab9f83145f9548a0

            SHA256

            91ed47875d824ec9f78e3c465c76c27b621bd5706447c417b3f0b33ed5070c06

            SHA512

            b8ddfa6c462e1b13a62b0e2ee66f9c8fa0730e89a7399d4d01d9eff0e3861017ddf6e5074639b90bdf2a14e9e73f7d004a13a211078eae79efc9b341043c44c3

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            9c130aa4bced084c2e55eb7b456cea27

            SHA1

            0e6d4674a4d4e6cd21e16de59ec1e3bf9d6686b8

            SHA256

            40d8742ae199abe6106d3f8bdc35859a056c05d822fc05b75935f412056211fc

            SHA512

            3b109c16d4107008ecd7bda91faa3c2e8d6bfb20cc35c68abcc0888740f6c4274eeb55d2db921030550db09a2aa611e54c20a9f424bb45b8dbe7f9368c7c91c6

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            89ef7e3eaa848d7dadf37f23c9b5f264

            SHA1

            5fcfc62971cf453b6c4a049e4abf4e6d43af17e5

            SHA256

            59f1ab65676c5315c16a653caeca5454311da6af859695e831c7b171f704b5a7

            SHA512

            ccf9ff398bfbe4046441cb4b600e120e5c2426dd56066680a4a2ff76e11264ac010754f37170535b556c7d9dbfd11a3c57dd703ba6caca3af2bab0e0701c779c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b13619b8dee578333cfda62e5343c38d

            SHA1

            62aaf6ec5cb55d63d09449a5843c3a4e4b77d558

            SHA256

            655d84a994d6d19ac79f07acc33ab2f868488a725a01f3f687a0a14b2822636a

            SHA512

            b5acf96917375d7b18b2c049a938abb1edf6f8dd5e804ed21c112a206aae02a18fdfda6ad1c9957c27caab4d15d9e15da7bcbe0d2fe7a09a5403272c7587c9a2

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            d5079468b08f0680f82264908b16baac

            SHA1

            ece4b5424ca4b8adea900c080e71a7bdd5499d91

            SHA256

            647be13a72607bd2cc0ce65277f5efcf9d028b4cf3b7ce07aa8a5d288fcc95f1

            SHA512

            33155877996d71cabbdc6a8ceb4c2710ae1221bc63b93d34bcd9889c27e7d854fb72c4d0ade8a2c2aae58026fc0c145f453d479c6e259599fe7317f4c0968433

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            15809e888ea2462e084f2e5ca48ddcf6

            SHA1

            fdd7ecb3bf61156077af9b87a4f1f7176e445d17

            SHA256

            6ae93272e029dd3bd65f93a09827025140108a871e419c831840ac4543b4cfbf

            SHA512

            0de38f86429340c9e39bc74f5bb59d22a79de9aa2e8e6b2b291294c9ccad2cd9a6e03c88f391d0ff54ca01223df60c3172853b2f32faca9618ec00be89c95b28

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b11d7b3dd2a14525c76275018fcee707

            SHA1

            1c897a68f460101fc487dc21101e791415da7b39

            SHA256

            38ffffd044dbcc136fb00eb997c2c1c2bc9100d07abf9f08ae149dedcb75c444

            SHA512

            c77c276735cc41c847c6fa46be518940b5f6e7aa3a04fb4967a49709af313c6a4a4b4ab9a1234900e4383abda1af5c7c80c23121fc115c91f0a6144a458f7d75

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            cc451bfa917bc6dce8ed06fbb9d05be6

            SHA1

            c225facb899537e43ce59630f17080d1cc27f5cb

            SHA256

            ad59317336da0352e7b40a7668922568a921cf4d52682696e0dcdc4cfbbc4907

            SHA512

            47b52020dfbc49574c359a36ed3f36ec04eb2bcae01b3861a2047f762ab98cccfecb026b7228baa2864cc3f10c06c93f8988fdfe19223977bae81e6e6bbd42a3

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            95962d9fa59a1d7b2a45028d7c163db3

            SHA1

            46acdfdd34a3f4776b6b97afa4c986355ca7e32b

            SHA256

            2458ec4227c501d254fe61f731afc71f1abbc8de9dd3a6a52cbea219953dbb53

            SHA512

            cfe4724b9e0f61ce6580e5253763fce822fd9046017f66398e834a15777510c12c9ba79932e9f5abd49dde7263e9f1015491c09dcd30bddd6c5c3de4cab28fe7

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ac57a42ec0abd62f0f893eb5ebb5cafe

            SHA1

            71a58f31da0af7d6cceafef31a5b65ada6296b5d

            SHA256

            f2225daa91bfad9daf21931c7798bc07fa0d518f7ecf7ece6dabeb879fe8ddff

            SHA512

            408a93ec01fc5bb88d1afcab37e28efc02a28c5b6bf4567a5f28aaf32cbaa89b2d265ecfef08d43e82a63895a3abbf88e6d245489e671e7ae83e63b01c48215f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            67eaf39ef3cdd4940d7df3672f774af5

            SHA1

            a4ad28468a17dec79fbec44093d1080f61ce6858

            SHA256

            e2c5d572a45907bcfa0740900eb4ece48113d1783246c3d60c02be5faf6f7b25

            SHA512

            35eed3cc8a3387308f39a0efd88c85bad5f592a41babf6d0d9239c1400633a3feff907f9988a35bb874dc1565fe844e03b4d016db849bbd24caf263d402141b5

          • C:\Users\Admin\AppData\Local\Temp\CabE562.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\TarE5C2.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/2084-448-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2084-446-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/2460-437-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2460-436-0x0000000000230000-0x000000000023F000-memory.dmp

            Filesize

            60KB

          • memory/2460-434-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2460-441-0x0000000000240000-0x000000000026E000-memory.dmp

            Filesize

            184KB