Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 17:12

General

  • Target

    0fcaa1dc9bf5a5c11f469d5d65676591_JaffaCakes118.html

  • Size

    158KB

  • MD5

    0fcaa1dc9bf5a5c11f469d5d65676591

  • SHA1

    de650deca20e4cc32f99f987106fcaac9386c799

  • SHA256

    6ef5036ab4b86ff4ae429a9859408b52c22088488073af24f7413841e0fb55b6

  • SHA512

    3b43fb590618cf9996bf9c840f335588f6477322fd76f362a54a710168b6a5eccc8f410a1ab232a7fb6c252bf8a0180ff1bc71d0ad80f48fc42ec50888c672e8

  • SSDEEP

    1536:ibRTNWLCKHiBx++MByLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:i1OHU+bByfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fcaa1dc9bf5a5c11f469d5d65676591_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1540
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1028
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2308
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:4011024 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1656

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            d2c98b9455f41bee60ac8fad0459ab09

            SHA1

            0b2c4dd04ffe4909132739bbe76fb6aab47fd9f7

            SHA256

            8072131fcd7e2a519e345929af9ec9163ba5ab923e210b338903d86b11ddc687

            SHA512

            fbc134b8b60db8183072545a4f34f7c60b3045b4457bdec5a2053ce24d1adfc17f9773fbb09079c452bbc67e5f58897717963c40f47a6e27a38bcbd478184eae

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b0e60b1db3bc346809ed55dd95f00e7c

            SHA1

            2916c305eed022a64eb022bf1f18b5380fce2e67

            SHA256

            21546ba2dcd905344ec4219c581c6ae008e5a19e1833b6aa54f93cc807c0e204

            SHA512

            f369b777eb0cf407111a990180969e8c0a25c2a23d8da6de8519fe088953111a20654f16b40aa939326fd45d59c2f2c3eec87b26afc3c980e4e86b1ee2d0a662

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ca10e0b7af202a07771e3cd3f7ddf209

            SHA1

            3fe7ade14e2ba2858b8ba69ec0e12de2dac0c450

            SHA256

            52d87236a8f9de920b6233b0c263235cda750a285d95975120f4d9b2bf8213e8

            SHA512

            0ac7796535d597cacd741d16ab4a7b2ac00766a0281df389862459a4863545c2b7e737c9b567cac67eea82bc4822f1747f5721bf0e99973ccfa8cbee1c68e246

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            8c6e607d79e7d79f5cb050dd5dc8e490

            SHA1

            592c5a37dc78110c8eccf8ea4f0390442586955a

            SHA256

            de54fd6e3c064ca6809c13d2e3e6d58c014ace9b3a7685dd06e55f4d5447c580

            SHA512

            1ce3b5ef43cf87707ce1c1fee63627f4bb434eb7594e7efaa35d9def14a64a39e5b240be455c3c7fa92eec9281739060fd7bab509ff178d07147df8130ba0558

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            fd3451f7e01ebc9defa135ee3aedd39b

            SHA1

            40a059efed3a02bcb345339cab0961db3f5ab967

            SHA256

            5d636a10275a57f0c4c9facc370306502edcebf82f756c211d86a4666c562403

            SHA512

            0eb7c4d29681833df2413062e52d586b487359d0252845ff8b7beabfda0576b1c53949324927d84d34d9ae28aa7a5d881de6073a89f13a20ed28c644a1660d8a

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c79f92c498a5e4d1a5f87a01aa470966

            SHA1

            0f84da06d28def0e5a9c88b00ad782a6ef500a11

            SHA256

            bce5b39d2d25cf552e06a84522e1afc8ccacfdef6a16d1f7d6eca161a70c4e80

            SHA512

            2ab7ce4aa33ef676d8350e7f2e9fe2e058ef486e81a73b5086220903a98766046f984b84d0e6a69295ae021dfb9cc7476964f84dddd51c0464f4bd71636f0995

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            a7b3094c0d94047b37b8db15e703ba2d

            SHA1

            bcc941e1c65c6501f21e3821718b5f60434dc43a

            SHA256

            482574870b56690bb8504aefce0d7605efea6e3589f2b80fe60f7b02132fceb1

            SHA512

            c41766fbcf57f571da63d80d3d7818a8c05233096faa3d5063e3ff472fedf02e0743ac5de6118a9788bb49d83a41e8ae0b7f36e086c3d2176741dea9d1a6b2fb

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            88b170b6755fe1dcfb52103edf39253e

            SHA1

            a68099d004d5ba8455a162862e0150bbf3671605

            SHA256

            b6b05355eecdf473c64a3efde92ee22a970a7c059ecbcba9f1ae573e5b974c67

            SHA512

            ca0a26130d45b0f0e8c91ce88516a25eeb3d87b0326d34810b62e2f218b81eeb59f36f6bc38a2173843364e3b2df0471f88b681f3a3dccb72d1e00b1459c7500

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e82e8dcfbfc89ce96af78d266d658cde

            SHA1

            56232cc3139d6c2654d46a16a157ac4cb6342aa4

            SHA256

            b6564110b80ddf1ff89bb489a46b82f1cd1a58e85984156792ae69635fb462f4

            SHA512

            b2f6595fefa894b853e4fd1326ec5cf833720620302a45529d1c2eccf0fc789726a3bc0c73728215c361c9af5f8a4ec72505a3edbb2c34edf8f4ce82c4f16fdf

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            aeb2b1c8821ced9242f547ebb59fc732

            SHA1

            93bbdbcbf502f19f5243fe14ab17051441db7c08

            SHA256

            7b69b816357ee39f0ea719f7eb84b2881bd2fa1cdf11f9fe8324b92ef27e1641

            SHA512

            72874edce799e95e09d66668bd1560e603a8b2a1115e06095bf4f85b463c72c6df69a415da0eaac3db0b6ee2df0a84628260b988d63970a25fb340fc3368ed86

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            cdb61e51b0300a4a1831ed88b5c6744a

            SHA1

            471432c41184c7bcb6d8e546d3f5482a1bbd8d82

            SHA256

            0fa72b8460e4144937b3f3b41bbd2660baed43e93788b32722788c2abe3842e3

            SHA512

            88ea45b5f3ebaaee5dd9fe9aa217f33ee9f108547abff5edd6ec8740c1bd5c1aca702619e7b8e81c074445a99b55a205f3158e036d5b8c825c4526e6b0b6fd3f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ab5138f81571ccc461a9780e80594cc6

            SHA1

            a3c4278be92bf311e2ae9c48aab02d893195d43d

            SHA256

            3de7918cdd7030b34826854bc30bf867ba18a135d67612abccdcedf064187885

            SHA512

            d970bdc4e4199d9f53562ce7b2f15e76822cc1e567630b32889221c3a52b0c28ac13997adf70778648a4ef04fa55cefa01557e20017ee121a90b44be4dcbcd51

          • C:\Users\Admin\AppData\Local\Temp\Cab9E62.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\Tar9EC4.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/1028-448-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1028-446-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

          • memory/1540-441-0x0000000000240000-0x000000000026E000-memory.dmp

            Filesize

            184KB

          • memory/1540-435-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1540-436-0x0000000000230000-0x000000000023F000-memory.dmp

            Filesize

            60KB

          • memory/1540-437-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB