Analysis

  • max time kernel
    133s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 19:10

General

  • Target

    1031a7522135743752fcdeb85cb09927_JaffaCakes118.exe

  • Size

    121KB

  • MD5

    1031a7522135743752fcdeb85cb09927

  • SHA1

    26390eb7153fa98099e19f89f3d4556ca472597c

  • SHA256

    239b147235909178af52bb8a20f20c01fe3e6d55306e0942c0e656307e573e37

  • SHA512

    4ae65497dcfb46b9dde5e3123a1d9ce891f58218befe499a02aa71d9d668afc991405f94674e6db1756bd2ce7549ae83d2a0d1ec71a0be2a5428c3ac0b147a8b

  • SSDEEP

    768:9Qxkwi8BsIqHpcrkMEYEhA7P4RhAtmaZFb79U9MKAjBEig6/1k21m3uHRdMNDj2z:98kwiWTEhU4HDa1KkjWXUa21mc/Mue9K

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1031a7522135743752fcdeb85cb09927_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1031a7522135743752fcdeb85cb09927_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4164
    • C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2200
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 204
            4⤵
            • Program crash
            PID:1680
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2008
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:17410 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:3304
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4328
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4328 CREDAT:17410 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4176
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2200 -ip 2200
      1⤵
        PID:5004
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=1044 /prefetch:8
        1⤵
          PID:1552

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Microsoft\WaterMark.exe

                Filesize

                121KB

                MD5

                1031a7522135743752fcdeb85cb09927

                SHA1

                26390eb7153fa98099e19f89f3d4556ca472597c

                SHA256

                239b147235909178af52bb8a20f20c01fe3e6d55306e0942c0e656307e573e37

                SHA512

                4ae65497dcfb46b9dde5e3123a1d9ce891f58218befe499a02aa71d9d668afc991405f94674e6db1756bd2ce7549ae83d2a0d1ec71a0be2a5428c3ac0b147a8b

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                Filesize

                471B

                MD5

                6de4427d02d49cee2c46a8fead1fafa8

                SHA1

                bee49bf0e4452ca72442face8e655bf4a8c3af17

                SHA256

                46d5cd7ff558e5c788807eb674587359c6a660cef091eb420676977e49833d53

                SHA512

                c80311bb92f9f49de96d06e9a76a3ef0310365999f00f401fd003d438b66744a88f093b5887e1723c6b8179798697ec24c4b2bda489323337f6cec6d28ef6434

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

                Filesize

                404B

                MD5

                abd416931a2d6a1970379848b45eb090

                SHA1

                8e5e8c56e1e3ba4a5739747ac0cc7a0041f990bf

                SHA256

                0e1af5c37863f396742c7997253dd37839bce63363844a290d4d548cdc87bbbe

                SHA512

                dc99917ad45f86d5feae88ac42e1295355b3722379f976fa31cb35581c3bddfdbbe719cd6fb1a7b828435a7a477e67524b710da71fafefd3b9499f3c86a096f5

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2972FC8C-81BB-11EF-A2A4-4E01FFCF908D}.dat

                Filesize

                5KB

                MD5

                1884062ce02cd5e584cb87514b5afced

                SHA1

                6b805eab6660b5a2d74786a527062082d131da04

                SHA256

                41f04662eadcf5aca48f39ab35d001e94388c8624764c44d7a479dd19061ba64

                SHA512

                4465be4bdce8e9cc8ec4a1692a4428950a245fccacae4597a9409cd28fbf73e61baf0d426af642a9afafca46b25735c3ebd6db36ec3749d465519f698a2cb154

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{29755DF7-81BB-11EF-A2A4-4E01FFCF908D}.dat

                Filesize

                3KB

                MD5

                6327e283ff3b7698bb15110947b132dc

                SHA1

                4fb8be6818675433b016d70e9fb9093463730174

                SHA256

                ac143f8063513c7fc71635d8a8ddbcce2270affc76e557f2a3e84ec149c5c47f

                SHA512

                0df55655e75ce0d24882e701552dea232a441b9a68155ac2c1277a84dbc6fe4256bb5cfddbc3dfa57ebe8c02c24b6d1ed924820b5cc33600e05222ab313815f1

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verC6A6.tmp

                Filesize

                15KB

                MD5

                1a545d0052b581fbb2ab4c52133846bc

                SHA1

                62f3266a9b9925cd6d98658b92adec673cbe3dd3

                SHA256

                557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

                SHA512

                bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NCPU4OJ5\suggestions[1].en-US

                Filesize

                17KB

                MD5

                5a34cb996293fde2cb7a4ac89587393a

                SHA1

                3c96c993500690d1a77873cd62bc639b3a10653f

                SHA256

                c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                SHA512

                e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

              • memory/2200-14-0x00000000001B0000-0x00000000001B1000-memory.dmp

                Filesize

                4KB

              • memory/2200-13-0x00000000001D0000-0x00000000001D1000-memory.dmp

                Filesize

                4KB

              • memory/4124-15-0x0000000002180000-0x0000000002181000-memory.dmp

                Filesize

                4KB

              • memory/4124-16-0x00000000770F2000-0x00000000770F3000-memory.dmp

                Filesize

                4KB

              • memory/4124-17-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/4124-11-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/4124-10-0x0000000002070000-0x0000000002071000-memory.dmp

                Filesize

                4KB

              • memory/4124-21-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/4124-9-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/4164-0-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/4164-7-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/4164-2-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/4164-1-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB