Analysis

  • max time kernel
    135s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 16:41

General

  • Target

    0fabe2bf6b586402c1c9cb5b32c0b2d2_JaffaCakes118.html

  • Size

    158KB

  • MD5

    0fabe2bf6b586402c1c9cb5b32c0b2d2

  • SHA1

    e3308c15f00b20a30dbcebd1c4ce6511883d3482

  • SHA256

    bf17887f89e138750256ac278d54691431921512725bbe9d196159676b0e07a9

  • SHA512

    623496dbe7d4d47870bdc3a3d1e33d44136449efe1c8bda545eb00986d86fd415fa86ba378b957664b126c6c28bbf9f00ccfb55ea00a74243d9c85a25e9e6e0e

  • SSDEEP

    1536:iGRTk68us0muOOfYyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:isJOEYyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fabe2bf6b586402c1c9cb5b32c0b2d2_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1800
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1764
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1732
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:537614 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2096

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            68ea83152fba592e7717adab7e87e208

            SHA1

            39562f4726fe2c1ec9c2623fb828d43875f750c5

            SHA256

            b773616a2e95b9bda2c7e07ab82c3b984339352558792beac92825c505d492ca

            SHA512

            18b3c7d55c0d6097a84fcde78eafd9638e6547f48c8a479bf5cb4056ced4e0abee73895378d2a88364d1630e2e820397330445eb0ff9addca784d54cbeee8738

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1f3c6726b0216475c8540bc6ed568075

            SHA1

            0c0f3e3f7be4a536d8079b534c8bc25ea4b88ec8

            SHA256

            0f5c8d7694b36627667150d1b87e9ed675835d6ab7fe617136400a502d8c9d78

            SHA512

            c096966606c1ecb3815dfe36dce3c35be6eec4ef41ef876dcbccfbf56b69afb45ab03a75d94244cc1549255d64695fbc1079831e3f2b437e873818f96809c7cf

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            16468887684be58a94e01781f093a3d0

            SHA1

            e6af0b77b3457fdea6fa2c4378e0afa68970aba5

            SHA256

            49213ef2f12bba4795193639d30987a78599d1f3cd2b1c2364aa6347bde4d9d6

            SHA512

            2c85745a814b3e96fd027fd4be5f215fcd4905bab2904cba744d2453f9400b147b242bdc0ebc870dd9973f5cdb29af66da7314427db35bf952b61ae74e0f9b9e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            323763c6d1502e5d4e4c0fd03eb1754d

            SHA1

            57030f9d0013229c117536af20c119c179d89b8c

            SHA256

            79af7535ab7f051f7049da1d8b268527537ca39a95af149d518f3c688ae49f9b

            SHA512

            dc31de312b3036183ea50a7a7093b6700a7c380a9ae414826af8526477f13055c3738263ef6f6c0736941c34b99ed135136c457abac6390775c19382295fb89f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            608c53833cdd95ee1d57aee4026e85ab

            SHA1

            87a011cf1e7a236575906f9291db1924a8a63206

            SHA256

            85069c71d8d17cf23fafa5cfdfb1883f0ef29fbe4eb5f3fc27fe30c2566db81b

            SHA512

            3f21580bc3fe6093ac83a4f1d60d1acb387254680f62f7ae859b7f058c6f5e08651401469ae5e50e244071da502154e8b1c8a858ce167f19e52c79a526d87756

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            97e3fe9a5d8a594c921417e4b7daa84f

            SHA1

            6f5c0feb89fa26482d5a75ba3d067f9c863fbc01

            SHA256

            24c212f996c3f768b81043572f453909c71c31a91f318a02fecb28d46d220259

            SHA512

            a4b4e6cee118be747fbb0f4fd8b36e3c8003791c16dfc96f0f02168109c71363924115dfda19e4d678701987f068aa88e83c58499dac0229988a1e5d4eac772b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            9e0edeedd17cdb020a94daf3a5ccad4e

            SHA1

            134cbde25bf809603b05074ce6dbefafaa0e52a5

            SHA256

            2cc3488745c8ca1b20bca2ca501db642167e8f3c23e9314f63d057a7a76dc4e3

            SHA512

            ebe2e9a4f6789e4644911e926d40292095e199c4b2acb96bb87b79e0b0e4d469d8c99058659183397af7a57bbaf4ef8cf2e2692a3cf6072ce8e5fb50ec1e0e1f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            aa7ca4b28fad50030b4a6b2e10113c8c

            SHA1

            7f4d5f3a6c6b4bc0ab71580e6bdf847142b05c01

            SHA256

            229e2a95a1d4691e0cd4e2157567f4bbfa35028e3c81065599325ecf9c720629

            SHA512

            55b60eb382b7713aabd83f9c932fe8122dc7e02da3c9c0f8fdd128184b6f224b50c194c8a33e480add39b89cedf6fafdbdf17d7292b788c3a5f5a9cf577f9523

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            52a24c31455b3c7dac0cb9b94ce12a52

            SHA1

            38cee92892bc158fab694cc923dd0e20d98e68d5

            SHA256

            b94c9ec10a10553b713c86b57025664417594d549125018cdc172ab04b1f0ad5

            SHA512

            749b7d854799f082d9fc1a838f9a7ef5bd4e9843082a6cc741972f9dbb35b28a5b70007869890939dbd5b0f50d47b52f6a716a63119f99d09c33db80d5006fef

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            4d7b3f79db90cbfc599d718c53c22502

            SHA1

            f8070000b128b2f87ee70fdae8a9363b7d0f324a

            SHA256

            dd944b53a97612f9925c4bb299b68562c323a9424b515f50a16ab517b94f32a7

            SHA512

            49232d4cc704d2ddf9f5419035e55e0af3224df2b39a87c12ee93dc86e1fc30b8c78c3935ee759e0d44abe801da5182237c42350ad4fc26747e6b7780173d574

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1eeea97fca3ebaac5a6ed2123b0946b5

            SHA1

            a8d38e2eef0654949e73a0fceba55fa2a395329f

            SHA256

            efea0cf8f845fa595d53d302874975b4d6f92e4dc29a8995e7440c1207f6ffe8

            SHA512

            7af242bbd22aebd75b96a03e18e7770ef6bd6b8aafb2f03dbd5bf7e631a96feb93c52c80ad506e75a51ad75c731d2063f0fab78fcddd858eb060e40f31055683

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b8c8bcad448dfd4feb1089b9fa0cc6fd

            SHA1

            8f9fd75faf4e39ae016cce74f40d85c454ee77ae

            SHA256

            77405c5e858802fe7ce2ca3b55acfc31152af0c0481b5b1b144ef2c7b16ed3b2

            SHA512

            a6f0e91b7eacfad2343b31972dd20e72ca728f7a87e76c58882b14fd9cbe5ca0a3c665701627207bae591e5f305f9396d9b5a930c737e9d5eba8efa2e0ad2110

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            8a4c5cd500d77a47ad4687699d17d91a

            SHA1

            11c44de6598854739e78b9054672e4f7ca3ae218

            SHA256

            8a6a0a752db51fdd3a07cd98084c6223966e13625a2bd98b3782c8514c650d75

            SHA512

            3815bd25a815e85f28b79130df5810357154919dcb3019fcd60d276ea45acadda2ec210e91e4c7e0f256b9724b43c1b6921b335131a13ee3fe9983361d283ee5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            cdb95440dedbfd778c46ade214a2fdbb

            SHA1

            c31bac0e2ec9488aa5196829a1cd23090e8df080

            SHA256

            ac55871ebb80604530d9eaa66d9ac676c3b87f96938764f0ef160660dd9dc279

            SHA512

            a9579db19912f129fe5b1bf55297ad0a944abc4d50d127080a53296868789bcddf6e9c8a7a51c7785479f04e344cdcc20268aada56d88bcd0a1055b6a2c49251

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f9fb2a715412a1c2012806f1fc58b98a

            SHA1

            1d4f19f6963cfd917663d71db7aff10c3e0b6b5d

            SHA256

            ab780e355860926220d17a8411dd59ef8fb184e47af3571ae8b1dc56ad9c70ce

            SHA512

            c8e00ecad8051229f62417c6a2259e7234fef7131a5f614dba8d0ce3deb14be0867a9bed3ad9160a76366de820744c412802bccada955c14ffd865328ec5b968

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            cfb39272796c7c0d5eb477218db8d389

            SHA1

            0724902610534bc562cbfb3576e2ba6c3de6bab9

            SHA256

            9fdd4236481aec94cdae2b9d9844ef8d53a70d16ef1eca29d2d633e272240f27

            SHA512

            bb3b82924d876e8716b82dde39fdc1899779efadad1bdad32faf54f9d562c7ecfaa752f72bf1e640683c40b8b31add754c4049fb7db67e6d030bb2cc0a5aa62b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            feece8f1e62e8d7b025e2b0d2492b660

            SHA1

            a835d27bb65de945d2587e1e3a4bbccb7a8fe12e

            SHA256

            e305047823387140117e07df948d9442e22f98641e4d34bff9b96085123090cb

            SHA512

            3dabb76b9ef72c4621b3a9ca103953d3d1449227d95eb3b8dfd7fda9069f2b5093318027c656a3e3651a623426d24f171278304e925060c044df214d6a05887c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            a5b1bf441dba4a5fca5fe4b21c1424c5

            SHA1

            903fd3d9988b9eaa4836e756ab8ba69de508dbd8

            SHA256

            ab1c22e284b7140e418f88f61095796c9591fc1d6d4c4fe70f9d110bcf2c9169

            SHA512

            b6ab476fa852883734205cbcad603d35dadfb743b711d5524e934996c35aa158deec9de757dc24e3986976fb970987c91292d0babbf0d3c16cf780bb6d927dc7

          • C:\Users\Admin\AppData\Local\Temp\CabC998.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\TarC9E9.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • C:\Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/1532-437-0x0000000000230000-0x000000000023F000-memory.dmp

            Filesize

            60KB

          • memory/1532-436-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1764-444-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1764-443-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1764-450-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1764-447-0x00000000002C0000-0x00000000002C1000-memory.dmp

            Filesize

            4KB

          • memory/1764-448-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1764-446-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB