Analysis

  • max time kernel
    130s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 23:36

General

  • Target

    1553d3de6071e039a4d5c6c15452ad21_JaffaCakes118.html

  • Size

    159KB

  • MD5

    1553d3de6071e039a4d5c6c15452ad21

  • SHA1

    47e3982e9ba7d61b2373777b83d142e352ab0685

  • SHA256

    c37cc584ed708bfa5a04183fc5e0d0b88362a5b144d7aeaf6b74a8891b283092

  • SHA512

    203dfb074aaf906c3724010e0a54743828bb4da047f4e92cad1d536ce64b6c39680ce14de60615d2af79c79e4b820e6cb69447568a2cc463f2d3aeb85fb826de

  • SSDEEP

    3072:igEfDO/mg8WMFyfkMY+BES09JXAnyrZalI+YQ:inb3YMwsMYod+X3oI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1553d3de6071e039a4d5c6c15452ad21_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1460
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:556
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2092
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:406537 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1860

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            fc02c0276ae507222b52e561f0315625

            SHA1

            8f268bd2dc020e4a6e75ea511431f9aec3dd91b2

            SHA256

            26bae04d919fae949e4faf23cf95e6105611f8b4d3fe5c032aa8d9683e7fd01f

            SHA512

            35f0e90be3dd785285db68dabae4d96fc19fa46b3bb8f6b407be3164e96f36df84fead179d535f8b0391b7796e604146e44af0c719bb113a4b07b375cda4461d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1bf899147c836718b08e15637d44c08e

            SHA1

            1b6068458fa505aaab0c71a31bc70399a68d10a0

            SHA256

            cb5e1c50b13b94effd1a2bec0c93ab4a3deb5b32cb1fe7c6bdeab8d97c7cfd3e

            SHA512

            e305ad585df1c893596c44ecad7c4fc915519559b1d6d137fbada35fde71534af93da9514d792c65065a4c0b914858dfc596783a2f250b5cc7e93c1f767efb2f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            fd5d5b30fd2bd6a00e3fbdb891f2fdce

            SHA1

            f0ec4c0c1dc99274e4d4ed81cb3d39e3ed513940

            SHA256

            03cbd72e57ec3e9f701dd0a613310af4cacaaaf0e54b57bbbf1d4172536e06cd

            SHA512

            ec8af0a36f854e2d051a5d4067f578c0495cc512f7473051678a1e15cecc53a887e167164f65a560f0eb992af35f7a73c3c51ea582872fe0196ab33b6af1c094

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            49bb36b17889a2f21762e65dda0a7f02

            SHA1

            8754906b209c182883502a820ec82860e5ca387a

            SHA256

            a7dce2e062cae4f13031906c0c1f4f54d8c708545d20bf20944b69a9ae60c6e1

            SHA512

            38abd6ded81f99340c8e61ba56e999734a9ac986d99541ad6c58976c40e877b1bb42d4b558be86132201ec93020c4d3ccdaa79d8e5b4eb24c042104640711fe0

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            3879a2f3c10ef823689dc90f0ca34bfd

            SHA1

            1bf2876444f599b36e7e9f9fe662af0f755bc4fd

            SHA256

            c44af759ec9ede229f4e610f19f0eb3173a73e96a552beb5ef3007ea6df24563

            SHA512

            04553091269734b6a9c7c441db626e997b965aff8fabe422569e05e6f8e2d83239a2d8ba5bb0c9b135db3f4b144ef4c1f0f7c07da3ee5dea62c0ad4f72f78aae

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1821a24677b30cae920c10fe95a2a1c5

            SHA1

            c330fafc2b5f5e6f4b4114ece8d781d0e4b88ccd

            SHA256

            aa9f7cbd0ede867b881ff9f08f3d44aa64901b6c26b533537866bcdb5d534526

            SHA512

            726ce2d2f16e546d4d7a42df8a2a8c0d4067848363130f6f1a2bf571dcc81c08105a23bb9f05db5307374b6ce31b2d64b05c035b94de46e39a098e4a1b05a9ee

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e6fb4a14962043e1553e6d67fbf67c16

            SHA1

            45f5b500a234d085920fe14fc1c2532d02a1942f

            SHA256

            99b96a5cbcfb698bbc3f90cdc759f6a23cb5bc60d4484903534f4af361cbc5ad

            SHA512

            0c26f3b1afc0661bced4847060eccc7ef46e04d471144b64717363c98e1970a78d5618d6d73cbe4bfc39c10bc2a07596201a636c88b9aadcd2e7a63008acc4e2

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            66df699d1db18db8a83891a5a1083650

            SHA1

            5b7c63bc5fc9847599b7566701b1ab9c5165eea9

            SHA256

            1647a6b27dbe13abb2b708f4cd2b61033dfecce4488c2b50a0302c7b86df8653

            SHA512

            b7ca04fc4a8e6d231baa288474e05159d30fe8189076bb8a35922d0a133b61c4d89989f393997b23414e40961ffcdc10c07451d4b4ae574e97e782fe2c31f72f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f1ece5491aac240b1b7ff6f7b0e3422f

            SHA1

            178dbf4d8218a1a8f992274801ae23e74fee2977

            SHA256

            7342ce07c252b23fca70096e6fc4834ec91f10e035fe29469992067d385ba1fc

            SHA512

            68e481bcb2e155574b1ffad4e4f575b0e66ef6eda58dcb70d3fbf215801d93f92060413786996ed5e3b2cc885e99a5fd708c320ec3e5aa6f3d0b0154af4d1b89

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            8650be51f6043f2e8098027a18093b58

            SHA1

            181d11e3aa137fce02e854bee314ae88e85c32fd

            SHA256

            22703ca0bc1a7238b292d76097f6448d5cb935319ae014bdd66e63381ea82584

            SHA512

            cecc1428a401af7a3c32ebaa9db8683ee7373a0b8ed759602ccbd5a941a0357bec966845fba9992964af98becae68b1fbe6377ce809a767da313ddad07839ccd

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ce18279d3704a8e60b0587ab63699ad8

            SHA1

            80f0a1bfe11aab4a8f18292805e63f6d925f5e7f

            SHA256

            7518a7324bb5ef8d9d8d791d66ea279b5fc247ac6f778e214ecf00f1c3e18bea

            SHA512

            8f18dd1f62b2a4de7b8d651ed405d0463e55435e02374777f4c257d5e54465b75096ee8ea6024910ae51040a4bb3fe9d47f9ff2a74db0bc33b5dfa9b9fe4df01

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ce5cc1de21a39a148781785838cd357a

            SHA1

            2d235367b837a05a45d6051161196f6a66ec3db1

            SHA256

            85ff2287d46f7ea6f34f1ee5e5655dd3ce1dd6a3345c9ddb713d0f0aca0e4670

            SHA512

            17188bd14dbfccff9544703f65ccc1f9f9903c6711d8009ac0d378759c9761dc6bbd5e31e24b23276b6396457e283ab6e05b06cd115fdc34ccd644505e53f007

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            aecf907b353f29de21f9a7e372c7257f

            SHA1

            be12f6b36ca832583114fa8687df155e011fd19e

            SHA256

            c9307bf13330e495ba157a5afde71dd8c2850a4d26c479f409cf2cf6fd0a080b

            SHA512

            e9d1d7661b1961f38f11560fee5e674b9f2da5e79bfb14e5eb9924d330d3d62b6370ccd8c47ca8ceee097c277fe8f8015159cc9fab0315c418fa6be21fc36b7e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            4064e5984ba61064de3c981c650ee8b2

            SHA1

            d6b300d856135b25bec498e1cd080311f002241b

            SHA256

            bc66c9bed23aa61eee8f2df70bf619fe70433c5e8fabbde1f3d9973233d3f735

            SHA512

            5bb86858669bb3d859a66579ad85f2c4513ae9b4aea06b3ffc7ffccf8e51ff384785a7d58146c656608596f4348d6c36377d8c9acc5790c13c47526180f07ab0

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            2f441155cce47908b9ee970a19ae8b5a

            SHA1

            7ccf25cfb76d955cd95393b558a18750ac04a639

            SHA256

            4df37e03cc572ae7c81fcdda492babf1040ff414a6096f1951a67d34ad6d6564

            SHA512

            678f36f825278d34d0b97d3250642cf0d9790768df19f0fba4101ac88c1004cc1971770218164c9af33319cf729730e4ed1f8790a5d36445925dee538c1cc213

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ca5d1c1abc9ff3763bff8441b9266334

            SHA1

            a790f04b49bc5a98528481e619b309fa1b0d983e

            SHA256

            5b85eec93f4a7018e71155f2380df065a7f58a10f69fced98e8f5cf0c358dae4

            SHA512

            fee2832c6deb86907a3216e7fed9ab580da7a6b12c249430c7e27efb87134da9eed03e84fdafdc9b11dad1bcfc28e3e22a3bbf4fe8b7e836760d1c6bd82cccf3

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            05e45ee09d09226a0855216d03c78658

            SHA1

            b0d2a61376d9f91d3b2371955553f6c859809d69

            SHA256

            160dc9281322997291f6ae36657a7ad191e137ce29db2b9108709946271d76aa

            SHA512

            330e6975ee7999233d3c3f300c287484acbbb3b8e069f1be4ddf6533b341c8b1259e95e4cc539d13b8cf83e5973c64a86399028b94abe14934669372102baab9

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            43198eef9fa9e22d9ecc4df0c7d185b5

            SHA1

            40450028fb4f8a14f89356ac4acbf0e36f6cd098

            SHA256

            34f40a41d8a66983266c97829478cacc079ff5ed9a00341a2d8abedc11cf4051

            SHA512

            4198df80daab66ae2773b717f174e1ef2355f0bbdead6bd4194e18a9c10586a31d6eafe78ce26f559bf3f55026d849906576f7a6a2ce59fa4469d1cccff56be5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f79cef190d72310d9efa19ae2a34f2ec

            SHA1

            54278562e307b0aeaf593425b3dc0ba6e6cc8967

            SHA256

            fca56122af0b6bc8c07c5e7d8dfdd4172d559f4d11e9916f0f5c5758395c4926

            SHA512

            5a04b09d0e43b5c0bc7442c62ea56ecd2ec9d63959753eea4befbb7c94306a9819c7c89b18d0f32be949cf50932cebd347db50c4205d93d1c3031d39f551452c

          • C:\Users\Admin\AppData\Local\Temp\CabAC09.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\TarACC9.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/556-449-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/556-448-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

          • memory/556-446-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/556-447-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1460-444-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1460-437-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1460-435-0x0000000000230000-0x000000000023F000-memory.dmp

            Filesize

            60KB

          • memory/1460-434-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB