Analysis

  • max time kernel
    131s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 23:58

General

  • Target

    1562c3e1a3ee086245b7b7f5df010873_JaffaCakes118.html

  • Size

    159KB

  • MD5

    1562c3e1a3ee086245b7b7f5df010873

  • SHA1

    f13bdcac641ddf2cabea8fbd69a7b2a0092df8b4

  • SHA256

    ecdea7ba48b4e618ca4a05f5c62512e0d4d39914f8a539521f98291de8c69e4b

  • SHA512

    0b630eef88c365bdb4ab655b48ca27c13dbd118d0c64152b209f0f7ce4fa31541a9763ff038b32530e05d68f4f09c1af7218b70736faf0710af2837e74f64597

  • SSDEEP

    3072:in4EH71tSDByfkMY+BES09JXAnyrZalI+YQ:i4y71OEsMYod+X3oI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1562c3e1a3ee086245b7b7f5df010873_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1600 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1280
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:336
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1624
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:896
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1600 CREDAT:537615 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:884

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            2b969dedbd0f18b159a4af59d364e5e0

            SHA1

            28f09fca2e5b5437b1bf1ae425cef3472f2f84c6

            SHA256

            33f575880153f340836111915086a0be30b7fe119f8a2f507a259ee3a7e097ee

            SHA512

            5346024bdd39f99dd592120b390fde39e131eb7228be6c6eb76f2fe6d4b47b62a646f3e5b017797b777b4ab94474f91af03ca14363b2ca374ef33146bfbe460d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ccc200148239104787f62f1bb51c5932

            SHA1

            3132c2b5f665316453ba93c83f19cd22cccd9a1d

            SHA256

            17cac35aea854d26d6a8f385efde3e1e3be9f93637b2e16198a13737fc11826d

            SHA512

            2a5f3c49f21a3a818634ba605dc475fc3a947ba6fdcc2b693fbca74f5fdcdc54b409b4feb8a9bf60dfcb17acaf02b3e61657c7080407dd6001a34d77fb42f82e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            9d6860612f25d1970280ac1e0652df36

            SHA1

            427712700b76eccbb6d9528faac43818688f73ea

            SHA256

            bdb1ba134fd63fcf1d73f89e1d7bec830a7fb2667a37b07fedbb13ae57384bac

            SHA512

            b58c8f8a476986cd943234ada60ed27e77a9f605fc077ee2f9215b52e922bdc5658b4699a19ce9cdc6da9c50c495d96a97ab4a842ebe86f8bac88081097cfde6

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            da27aadc9a994584a0be709b04e5ce6b

            SHA1

            c25bfc7102eb5e802bed7ef439f675ebb453d394

            SHA256

            927cc5c1520bf994a276d1c6cb273904606d283a593759cfa1bb6b7daddd4b82

            SHA512

            2202d29477a853bee781f36454bb49687ea06782b80dce97e8ded86b1e6d88b90544f80c141cc343494a9b8c0c7f435009c1c61122b783e51e2ff9a7dad40f1e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            a4032fb9f1c69e95698b739b616a793e

            SHA1

            2818fc2b22dc5743ca84db37eec119414c4fbf67

            SHA256

            6f206d2f5befa0a5021a66b9ddde61c17f0c8af4cfae1572afd3bded031cdf22

            SHA512

            12ffc99d2b03449eb7b7397f46edaab211a3d9620a0f4ebdacd68a25dc57000e8d06cf1264888bc2bb278a8589741e6b7e897dd096b4bbc25c0c434d41126cd4

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b269f6b7306df1f0bd031a63de9c8766

            SHA1

            b50080d76dc16e1fa2fec248a388c4ebb3d352c1

            SHA256

            b22f11fa551f9c1947ecec170d8eba24c3bf380bcbb068255b90d3d697346df9

            SHA512

            be8019e7153e753a750bc5b38698c44ba05d268f5b9eea7fe7fbfd7425ce6a794fa0885635ae0aaabce6c479d40028dc225555ea264ef7b53548e710314dc82e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            8e902e5122e30c4293990d911ba528e5

            SHA1

            cee5a62105f260fc5c59cdc6b5bc94478ee16246

            SHA256

            aef1d0c3203429f08bcc7d226d5adf0142a0eed8d3477ab49470f75090a1da0d

            SHA512

            43a8ae837661bc1310672d5ad108bf696d479d27acf4fb8ededbea844d73315636377c38ff4d51640fa9a2916d9fe84691b51f8e0c6b9fa7b7ccc6eff1277e7c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1a567e33efcc668db7f3f5f4e6292d6a

            SHA1

            b4d6530107a73c326724975e261b66e67409d0eb

            SHA256

            31db92c50c150e5bdf7b76dd10c003d96b21019590f676c73512b2aa60fc4bd2

            SHA512

            400a847fbbe646323760f95b273f7ca1330c8e21a02de10a3b8a0ffff0a374e4b954cdb7069f55d7a8f5cd0dd12c6186e3f1b5360ff70ba1ca26e060b96ebb29

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            529dfe6eb4ae498a2e7e97b012a20bde

            SHA1

            77587b1e701ec24bc0e250f851141e1283d6323a

            SHA256

            1e789d8492728980dd57384930beafa02686d290de5d519f10e44dc19e57132e

            SHA512

            8eeb1901f135a658737d9167df18f3b82927f9a8ac15550432e0b79daba7c8587457432e65233ccab4e8e921a237ae56027e2a4b272b3a3f6f7504bbd92af948

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b5ad32d1d46da67e6691936a2c407587

            SHA1

            31d3b361dd7f5ef5c2633a351973942f51194ce0

            SHA256

            bd08dcc7d7633bc18ad990c9450322a2a4e47338d643b7d4bac5052b7db68850

            SHA512

            18788b332e6e7ea22bdd002023fe4dd06b48a8082197de1ff1087fc9edc37346959dfd3c9ebd2acc35fd5c9393b80063b9ea09ac9870d70ed8e755348e876841

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f9f54d7ed1732b175f154f7050073cfb

            SHA1

            eac84c18de24e9d251682ea55b48befe63c18dd4

            SHA256

            bea3538fcaac63b36fbd2f50ece5ec706fc9e55f0e9169bff6781fd6f53e5062

            SHA512

            209ff5928fba48ade5a2ac1f396b57cd2d128c12c4e5d3ace6dc648cbb40976971bbca02a595925f99ca4c409ee6c64232938aa11aea636cb21a7580e92f782a

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            2602797055d2a786a4607e5d927e6633

            SHA1

            a9f1eb63859cae27fbb0759be8a393e6a3005fe7

            SHA256

            648232cba3bedb7337434f328556b2867ad0dded7f573bdc2e6d6d672aa03f2c

            SHA512

            2e868394087aa9fe8b276abafb2adbe4206d7b5de78d4bf110180c9f0fbe07e0fd4c530d3bf3b7f8483aeee1e3149369cfd563bd9b8b94aff7d72ebecbc7fcae

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e2d30e198651cabd7108ac29c691f145

            SHA1

            2bcd6b88c5d1aeb02b088082fa771dd3c4ce2705

            SHA256

            908de5ee80d69cd5a34dd4ac533a7a6d04e74ef0003a3f2f925f3f80c98d7254

            SHA512

            cd7b0d23e1e45256936822bbef9e79e6124812a64a29565fd59e668b6cf79c640bc1e5267398868b8fe531f0f4727b19e2287fa0cbb64c01b7bd373080e6d822

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c4c08709dcc54cd21dd19d76a2ca8986

            SHA1

            c362f0b5365d4b4c32ce02015e8a36a6df88e472

            SHA256

            ff5a1a12a8b76beb96622e474800cadd9877cb57ff9556c19b502b1961b33e0b

            SHA512

            c83d8b868f6522012da21c7e645bd0c6659e1309e1bf2e30678e0df24f4763df854d7bf04978ce3881aac44ca0ed45d4d7c2efcfb863b0976f999241e4c361f5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1e2a6005858c43e2be5f146003d4885a

            SHA1

            39f22ec222143fefba1cc3a84789537f99248c9c

            SHA256

            fa1fea5c08dc3ed3f18ea2a5c28861cf09868fcb972222cef64ecc5e3252ef73

            SHA512

            2ad9626b316165c327883b9a099c7b8270b9f53aa309d37548679cd25608c8fc00b1d1c57ef18ed1a088c360792f84d52fffdc77ee19ad0f828c67830aa7b8ed

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            40e2dadbc2db511ecef5b019560506c9

            SHA1

            f31925bb278650e4b67d719aff5fbcf8e9c62921

            SHA256

            dcf5a8dc031c0e0465cfc5580e82e056454d64cf6f99d35b5576dc63e0dea0b1

            SHA512

            08716970cfb7aa0d2cc8e746b43bc5a9ff862104537fdd3e6574f91a3ca3269c55fbd8f74204d0a4e7a8888140414531355c6b2a6a884e7af036c2cffba8a277

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            647ea307acfe5de861aeec4d46f4f15c

            SHA1

            d5724dc4b80d85df321b261144aea49bfe10bac9

            SHA256

            48e69f89f024bb836b10b080b7f4eca3cacda02c58d9a7f1a62b4b52b5f6057d

            SHA512

            f40ffb3a3d840afabef9ec4df3ef50e2c6ce63c7ffffac4852e9a755e8828e49db38904d44c52bea19c0600af211cd31a5ececefd0a9996bb3c208e50433f6ee

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            d3fe40fe4b30537e08b60e0318ccff09

            SHA1

            f37fce510ffe45b51a81d087b9c914150c6220d2

            SHA256

            126acff92ee3ae79412e993486b7ddf3475f70181b2f0b664a19798cbabfd6e0

            SHA512

            600a5d2345ad1738617183ec9439f6134a88eb016c2fa1d921f17eb67ec0616f2b43fe33c8e19eec364849b9eeaae6259781270843f3d21e932b82aea3c75279

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            32850aa8fc4a505a163ecd61cab8c4ae

            SHA1

            88740e3649313c06127ed6f8a51ad5a06b0b0aa0

            SHA256

            028468b04637428333d7c91492fd64cc640a344939dc5ff109740cca5fafdbb6

            SHA512

            1fc7767819bcf646bf47a1a1cbf184d04a41735b3f76b6772ab1d3f952cf470977f2d4372f26a5dae312d550f605ec8b77048795b6b79a60caacb074f9a3ce8b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            207b57d302ab64fc88bbcd3bc9cb9965

            SHA1

            540300ed06f921b6504f04772a7e6ee9e1cf0b92

            SHA256

            11877be2d06a509e5da7990b7fd96950bffbf9af3facadf8a3b2f4a1cab23e2f

            SHA512

            7046689246c176a92b6aeb642a733195bdd972ee1b76ea243683c3711dfffe7f1b5f0ebafbbed64dd5d7969cf0a494378612af7871e617d92a11b114dbecbae3

          • C:\Users\Admin\AppData\Local\Temp\CabB903.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\TarB9C3.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • C:\Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/336-437-0x0000000000230000-0x000000000023F000-memory.dmp

            Filesize

            60KB

          • memory/336-438-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/336-434-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1624-447-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1624-445-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1624-444-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1624-451-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1624-448-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/1624-449-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB