Analysis

  • max time kernel
    92s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 00:57

General

  • Target

    158ccbad9c0d11495d2a25bba0c0e984_JaffaCakes118.dll

  • Size

    220KB

  • MD5

    158ccbad9c0d11495d2a25bba0c0e984

  • SHA1

    0b07d0b91017c4f897fa5fd029eefeb5f21de6dc

  • SHA256

    90796ea3ec667c4473b2d093c3ebc4183c5c76f56b59336443c403d674ad501e

  • SHA512

    6cd7a2a4ffaa7253d013c42d322832878c5c1047454bcc034e532b44b186885b2d2ab8f84e1c643b3d1230bb417c925c99a03c6028b69855144634e75f4d16e3

  • SSDEEP

    3072:J7naa9l+SUVuhfgWTzT9r9l1RxhcoeCXqRb27jU8xbT:J7n/lKmoWTzJrtrXkQjBbT

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 55 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\158ccbad9c0d11495d2a25bba0c0e984_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\158ccbad9c0d11495d2a25bba0c0e984_JaffaCakes118.dll
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Windows\SysWOW64\regsvr32mgr.exe
        C:\Windows\SysWOW64\regsvr32mgr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:3180
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:4728
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:3036
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 88
                6⤵
                • Program crash
                PID:1968
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2100
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:17410 /prefetch:2
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:4736
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1492
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1492 CREDAT:17410 /prefetch:2
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:5008
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3036 -ip 3036
      1⤵
        PID:2740

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              471B

              MD5

              db7c83e09ebc4317f2bf2df7f66b8513

              SHA1

              29d58ef43f72ce7cf79ce6109d038a6c9b4873f0

              SHA256

              1ae4c8aa37bf433bc5b3b45e017c95bf843c7dbbe348c78c7ab6f3cad0fda4b8

              SHA512

              6eb46ae0c3e091ba13b1c0e3fb6de568882940df7968d0e1297568ea5356a4691f2a869c7c9ac9e9642bcc2e4e1388d00b15c663276143e8cb5015ab89c27867

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              404B

              MD5

              e31cdd7733aa697040a5e978b1d0760b

              SHA1

              58c7e6b126960174872607d37a1e983cf7e99cfa

              SHA256

              ffad4126b491835955c85803f69ff70ae3431401b42f91641971c5a45dc914a2

              SHA512

              f7b5cba9929d1e4f59ec54080607a0d9a69c0fcc573a056f7a0b5f37bb3663eab8ee45a1984b40fc0e7399fac1e9cb429a6a95a9b0bc50faf2877647e80a265b

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              404B

              MD5

              ca38a11172a04dad2e784eb650c2739b

              SHA1

              341720b1d0db6eb90606c67eeb756e3a03ebf3c1

              SHA256

              c71a85b5e7fae15207a96820b33f8b2d22be9b2656c4b25a1bc8ebe5039014cc

              SHA512

              2335068c2e026c43b6342de1e73bc2a75d94c66aca47883875914e26b53ae04f09a295d83ed1fb3bc7e5604e79fe5fc3eb4ced7fcdda56e9f71909d9600a571d

            • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C7927FBD-82B4-11EF-B1C5-7221D8032630}.dat

              Filesize

              5KB

              MD5

              1ccc9622e6803c442efa5db64eeaa129

              SHA1

              e2bc140856beaa1833f05e5c05052f1df396c5e2

              SHA256

              48741e07876b72a3fb508cdf1d6e3efa90d07be471aa36d19e40933ce99e0b02

              SHA512

              787e446bd76fbb4d845275ee5d7e414d8cb3031eb5250274a9c35a8da9ac5b249ad1cca3b50d9ad625101dff51ae6fc3a175712c6d3bcd81591dc0f1aaf34bda

            • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C794E179-82B4-11EF-B1C5-7221D8032630}.dat

              Filesize

              4KB

              MD5

              559616a944ab56ea82776db614ad35d3

              SHA1

              4cbc4f103affbb85259591675644fdb24b850b20

              SHA256

              ad917faa7cbf40ab0ee4f2c924639035999d3b30988d0db9481757fb80383f44

              SHA512

              9573030824c52fd936b0f26d212ac856c5b8b939e0c2915e9f6ab66a91b794f36637d4f86403c0af51a2e927f3a5bd498226cb952b74b3d294e366795b5dc35a

            • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA5B.tmp

              Filesize

              15KB

              MD5

              1a545d0052b581fbb2ab4c52133846bc

              SHA1

              62f3266a9b9925cd6d98658b92adec673cbe3dd3

              SHA256

              557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

              SHA512

              bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IFM58U6K\suggestions[1].en-US

              Filesize

              17KB

              MD5

              5a34cb996293fde2cb7a4ac89587393a

              SHA1

              3c96c993500690d1a77873cd62bc639b3a10653f

              SHA256

              c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

              SHA512

              e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

            • C:\Windows\SysWOW64\regsvr32mgr.exe

              Filesize

              92KB

              MD5

              7075add34d45c925954a76c1e17e2281

              SHA1

              966e0b9c0b07f0ba3d2f0445c7b0dde3eeffc2da

              SHA256

              4ed6f25eae75a84499c0c9152db86df27aca9e789e5974fee455c86745019df3

              SHA512

              6946290850fffbacd9295814617e1b19e93ff9bdbbf4c5570e1929652a65eaff39e3e75a4903ff6da9ed97030f9c4601b735f9e577e661aea0dd88079f3b035b

            • memory/2836-45-0x000000006D5D0000-0x000000006D609000-memory.dmp

              Filesize

              228KB

            • memory/2836-0-0x000000006D5D0000-0x000000006D609000-memory.dmp

              Filesize

              228KB

            • memory/3036-36-0x0000000000910000-0x0000000000911000-memory.dmp

              Filesize

              4KB

            • memory/3036-37-0x00000000008F0000-0x00000000008F1000-memory.dmp

              Filesize

              4KB

            • memory/3180-12-0x00000000008B0000-0x00000000008B1000-memory.dmp

              Filesize

              4KB

            • memory/3180-7-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/3180-9-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/3180-21-0x0000000000401000-0x0000000000404000-memory.dmp

              Filesize

              12KB

            • memory/3180-11-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/3180-13-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/3180-15-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/3180-14-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/3180-8-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/3180-6-0x0000000000401000-0x0000000000404000-memory.dmp

              Filesize

              12KB

            • memory/3180-4-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4728-34-0x0000000077362000-0x0000000077363000-memory.dmp

              Filesize

              4KB

            • memory/4728-42-0x0000000077362000-0x0000000077363000-memory.dmp

              Filesize

              4KB

            • memory/4728-41-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4728-39-0x0000000000070000-0x0000000000071000-memory.dmp

              Filesize

              4KB

            • memory/4728-40-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4728-38-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4728-47-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4728-30-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4728-33-0x0000000000060000-0x0000000000061000-memory.dmp

              Filesize

              4KB

            • memory/4728-31-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4728-32-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4728-27-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB