Analysis

  • max time kernel
    132s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 14:32

General

  • Target

    0f29daa309dbdf6ac5f3671832dc3723_JaffaCakes118.html

  • Size

    158KB

  • MD5

    0f29daa309dbdf6ac5f3671832dc3723

  • SHA1

    b82a40c250a1a79b020d36338348dfd37e9e4cef

  • SHA256

    4fc490cde8de868e46f5d4b91af0b21c5d39ae1b6392986b7a8ec0956ef95585

  • SHA512

    53a43520c0b762f5e573b0c9035dc327e86ebff153ad6f483beb691c09607f95c4058b9b0d2fd16b7b2db1140106e2e1de76bec7bdd8e7c5d33eac5b3bbe4919

  • SSDEEP

    1536:ioRT3sA4PnQKeKpnmBIOBlyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09M:ii8eFBNlyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f29daa309dbdf6ac5f3671832dc3723_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:588
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2320
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1776
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:472074 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2372

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            567c9cabf80b4d6f72bef589d3c7dc34

            SHA1

            2f2e1bf0f029b468ffaf9ad8e35424d3ef8117df

            SHA256

            c14100cdd39d3c0142476fb4e61d56b8044af685ec4bc1662b8ec4418bc017f9

            SHA512

            1640600376a477907a72274138b392b93be0d374266da6eafc2e78e3523e05afdabff93d4a974817ebc2f2e5c41701256666c1c518ea4b59f9e1e2b528d6e3a8

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            01784b4816cba65daececfc8f50d9491

            SHA1

            16f230844a1e6ede6f049c64d65d6a3a08e24783

            SHA256

            a5e409f3b3062b096e0985d8cf6fcdec608bc1b8e6c76854b3bf61b19208720e

            SHA512

            c34d22be5af568f93e47282cf148aa50ba421caa3f5ca877fa086a65babbf9df958a55cb6fcf0e011ebc85a68e9b44ac0c0da6c7f03528e0e6da66290cdd80cd

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            d773fe2311d6ea34be2f088a1d0eeeb3

            SHA1

            66bc910439da7b2dfc26bb8f6e340a8afe2000b9

            SHA256

            641e4afd7fcb19082c3389c6e4f8387895d6c70b4f684e2730589cb5ad4f8ecc

            SHA512

            6ccbd73befec97e7b5b4652cfc76e16872032844d4bcb367d0cc677a37ca4ec48dcad56297bbb8ce0cac4620f72ac7c8e73ff6d1afc0ba3642f014b5461d7d92

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ab6a2536c6aa5659447f1b4bd89103e9

            SHA1

            070f98eb36109b3aa39135686b3fdf3ecbe05310

            SHA256

            4bc7bf7cf0a975228259d5e094553c9130f2f0ff952245255f0113ad8c410d82

            SHA512

            8080cdd2b4d14c207f6ad58f3971a638ad13f51e076c79547b04620922d25454e991a60b465674a10a91f0dd253e643ee816e8c4ee125eb7dfadde7ec37af14e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e531bb8f4279008c2a1fda96c0fcce72

            SHA1

            eb4764d376a734d38e24a3678f2f7a37f0649c8c

            SHA256

            69cd318d3b9e2351f22c727b3d404cb73f460eaf89537a373112c1ac2db8af1c

            SHA512

            d256679ce281e9996c46b2a0026172b2b945c91886e079427aa943b81343a48aafae58d764ce740fcebc1ca59a72fabcda345acbbf7233399a1ddff37176b687

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b3c5637a9f154fc63d911c900aaf250e

            SHA1

            93a94e00a2136fd55c39d013f68ae5c8da475263

            SHA256

            d3c0a993ced24618337f9f72f419a7597dda49d800a0f5aad6cefd5c44896e96

            SHA512

            f2067a6744da13dd37fc8e815f4424f4ccf546e8357f750bb38e736c5edec5f33a1dfc85ecee277c159025e870c560e0d5007a8e668a2e448f470ab8751d6a7d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            4aba531876356e858c9d8bd3ac12da57

            SHA1

            a2191c03e7dfac8001748b78b7c98403931cc13b

            SHA256

            028091923b2b967b86ace5a037bee0b5a33f516d60194f8932cd681cc811060a

            SHA512

            7ced4922da44ff8a63a34736b0ad9fcadd63a39674f44b5b8ce5e4b2fd010a246f849f40b6862a827bbadbc212d85f1b2276ae9a437a96fb1cd3756c974ce358

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            6431ea16a6e6ccd4e473e11791c0e15d

            SHA1

            5d7bc452e7318d85fe244a1f39a7cc20d4450b0b

            SHA256

            112728c81d21567b96eb6797beb36b77e62a4f8be65bd932ecaff0c3ebe46038

            SHA512

            ade07e990038cf5702a4c613e63225a5f1a64505fe9c12c3ee76b674c77b8a92012e191855e5e3acae0f0ac1b4d3243406bc3589f81451646e469188c531567b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            2f9bc4f77af23617bf26e8f454efd8c4

            SHA1

            988cf427fa6a85d7a6149de20b7e11fd9889e98b

            SHA256

            60a7456a8c4365d37b68365c2fc8129d20b87a0581c6bb7d5ea493051e8c1a66

            SHA512

            4b00fa8d5ade420c24d05f25d73ac5064a614dea594377fd45d748998abd210b3cfce864f46f9bd4c32f96808681c96bdac9c3bab1140d1a1cdfd0edb9821282

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            7efb39b9a9ae37d708a0eb32a9b9bbbe

            SHA1

            b98724cd7042bb6c274f7f4def62e78b4dc42611

            SHA256

            ba3d1fe3b471e7f5aee23f15281f8c0c75dfc125f98443543c3a37b581fe579a

            SHA512

            1d5137c1094702ba49d6cafa3a8d4e78f61851ec9f5719efb93cc65d36199f776c868b941c2705e1066cf0eb4632e602f9ae3f375246f4446fa9207ed3c83aee

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c7203d5bcd653067ef2db002e38977fa

            SHA1

            394b67765acd76a66518e3b1fcd36c574f3780c3

            SHA256

            1ed57e72965f9cdd33d8b6b18498a9cb965b4921275345af24fbc8573a6e2f0e

            SHA512

            c13edb6b52bddc5d45e837d3a190772beb9d918d4d6d668b1b60b16fc2f92df9abbae07fd2b19ab27205922db8f7cc87c5e24d19864b781eccfb78dcfd4f37bc

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            3298f1abaef26e307b5bed7f48ae87c2

            SHA1

            6b25c302321374f70da921c5b32c770be8ebac55

            SHA256

            c1b1d3ad7bbf2b782d423afef0bc3c15cca9b8ab7078c34289eb148fc0b1e7cc

            SHA512

            1e30148e2bb918b7405a152ec9e75e1d9aba7a89b47de1683230aeef9940adfdbac6adfea1c9586756e0ef6d32edfd1c7681a3e3182de4d512dc88a8619d06ed

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            999e1f74e4855fb194b84c605073b104

            SHA1

            0094a5e26f3ddf4a708b218b60fc38bf7de1825b

            SHA256

            4ab7433616abee1f2ea7ea5622c8edb79172c1a2a9df1aa603ddaee5a49c45c7

            SHA512

            f2ebe6f14e6f4b53a4f2aa337ef78cfdcf24321502f517a94903f962c581b3820bac927e111dbf8abdb76e49d70e4768b7e3264adcf6556cc15d8e3451f69a0d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e4b8f45a26e1690ff339df3efcebe2a3

            SHA1

            639a73d257c9a9c9d1cc39c4fcf16a78072adee4

            SHA256

            fa3f0e0ac0aeac2583c126e5442a1244703936dd6bbac0dd9989ed1e4c400c00

            SHA512

            646e9daf336f38ef8abe839b08d4ebf5d67af823e04369a39f8cd81c479762feed75bdc32db79772bc0d6f99fc14504b064f17def7f805be8a1eed0d29ba9545

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            7a35c9993133dd044c297ccd7eadaeea

            SHA1

            fa11938b5d5ae9f08c27afd3b8098735cc0e0b6c

            SHA256

            14972b31eac9aaae3c549a2d042cfbd23978fa02d10fe158e8ab09ad4f0a5f82

            SHA512

            8ae92d8228da712d9629b04048ae0284d1b89fa2134ca5b968dd6554f646a09ae48c76117ad28204ffe0a940252fcf8dd81c65bbcb594c059774d042c09c8f6a

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            bb4754fa590ba46f371a6fb8741208e5

            SHA1

            22eb60a30d199f6a0d2f6de397161252832b6321

            SHA256

            18892f1da535c094b0efa243285aedc45630bb556f25441f6984bbfcd4d00a0d

            SHA512

            72798db51f072aca9486241b9cd7469de4c20c9fccd36643b2c12cb48b7de6e87ca5f931fe8883651ff989c816ec2342904c962edc3f65c97f6d10b08666056d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            a83aa9bc47c2d437104f3e7935012d6f

            SHA1

            6e0adb097a3d946007f443395d3513ef6e06afb9

            SHA256

            b0a9e5f7c03eb1505e5ec1936bf615b213b2cd74a0067fc071889d9452407fba

            SHA512

            a5621d57cef40e7e232b9fa18d6091bdbe2075b4606fc1d6d50f6620d84db5e2cb3c74c0153a19686aae23786db82a14ef8356af00537f8f4150283d49315afa

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            2765b6e89932572e150e4f014c046581

            SHA1

            03a1aedae624c48b2c428ddfacc12cf55dfb2f92

            SHA256

            108e42ddd789e9835ee14ede72c39cf8237922946009857ee4e10b13a2bbed9b

            SHA512

            f640fa91877c3dedf86d340c3ef5e6f283872699c2f7e7c5d687110eddfccfe48f5bea07c7015f5dbaea889cf67fdcc0772b5be2d55d2e15ff5c3efae4a1d1bb

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1e60b58bfacbd79a96bfa8c5d52ec322

            SHA1

            5f669f56ed95f084c0bca23ef83f51b175f24569

            SHA256

            201412f1713da52f45aa57857140f5ea835889d2f00faa7950850fc99e9a91d7

            SHA512

            f6ca118315fe95c678802feca26ff167990d99270bfc0e9a0fe7dec8606116c1345eeda4091b879a496b996b5372f76a870d2a44c9d20004a296837377eaeb75

          • C:\Users\Admin\AppData\Local\Temp\CabC46A.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\TarC4F9.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/588-436-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/588-437-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/588-440-0x0000000002230000-0x000000000225E000-memory.dmp

            Filesize

            184KB

          • memory/2320-451-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2320-448-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/2320-449-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2320-447-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2320-445-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2320-444-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB