Analysis

  • max time kernel
    126s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 03:47

General

  • Target

    1609f5492980bac880b95786358baf95_JaffaCakes118.html

  • Size

    159KB

  • MD5

    1609f5492980bac880b95786358baf95

  • SHA1

    cbcba3e2f7db1808fafc9f904df8a7b649a0089b

  • SHA256

    798616be02fc8ee49f0c8b4b26992d01a79086ca1fba0d80a4b824f4b9d0a843

  • SHA512

    d708b34e26c53c4b0d6e69103d43142e7f36bdf331431909998085c7353ef81dc76c03d70af688bcf971b656b8026cc87c38d573d51acd80aee73ff8da3613cc

  • SSDEEP

    3072:ic4vRG8Cmu3fByfkMY+BES09JXAnyrZalI+YQ:idvA8Cmu3fEsMYod+X3oI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1609f5492980bac880b95786358baf95_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2968
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1552
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1884
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:799749 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1784

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            94ee01954205f29ab9ab39a7777cedb8

            SHA1

            df15fb479e2981c160f62792e267a82f2cae81da

            SHA256

            8f9c06f391df7a16d88eb71a34bc606201ccb761a3a60d239e38c4365e873c57

            SHA512

            9bd9166512da62c66fb61f8d1638c2c2370cb7ab4ce68d2781d83730322cf94ab730d4ef878e2694ffca8d006a58f54a52c1dce33076ce51cb41092abcfeaf2f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f3b3b5961de962593afd12b2b9275032

            SHA1

            5a6eea6604b002f529dc95bb97169cee12ce282e

            SHA256

            0edf6d06521680571d011288eceadb8dfe3f30127f98ebc45d901f20ddb58424

            SHA512

            dc2ce53f64921510dd1381d8f62325e5e18c3889e81d553b855cfdb88f441f25109f89eaed42f61e07bc75d8bd7c17f7e911c8c0c91ca5ef14a47a43cd0c5966

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ff291f37535ecec751e708886f173654

            SHA1

            19deaf9cb421b1c5b1c949dd40eb535467652143

            SHA256

            3ac0aa29ef447cca397cd5b3a5c8e5fff16ff833f86a4bf9b3e70fef96313258

            SHA512

            50bf44f189dbc7b991a18f9b55a05d353ac5e9dd9935b56c3add1acb25b182ee391e53fd4d027aef6c12ed7e46eb3c974835c9f0d4179621673a000eac679590

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            56f6765e8e28c410e50b2e3fea3f1449

            SHA1

            e05244d59370b7f587a5503c4eaccc4426fd0103

            SHA256

            da24895fdb49b7afdf45f22631752530a8d8614b4c902aa3222e4b595baf6424

            SHA512

            5dbc7f4882a648c66acc15bc51047f06ff2be8c9b00f3da0c3917d0984493a995f9875e8ea5cf57c9555b13f3aee9fedad68ea410e427d125d5e593adf6ea937

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            6bb2e2d00b1ab6ad01572f1b47a30817

            SHA1

            09514dd720eebe21cad0068c039c04ee7c7ca9be

            SHA256

            2b2cd583fc7fe0cc1eec674217baaf3f8dac1ba01806526270eb861bdd635b47

            SHA512

            c92fc4b559df28d41a159f9b3c85d7d05750a14b5a7cad4977cab3cc968967ff6c2b00431f633345d2c13e248e8d5349c972dd7645b11431b9dc7f95d6baa926

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            2eadee235a5347387b6d21f28704e60f

            SHA1

            0642cb92b966b610a2d3516b22917f999f95e05e

            SHA256

            54e979b6667578a0674cf4747d878eb79e0675e82d52ec9222be046f5e90187f

            SHA512

            8b586737ca31575b9ffce43e0b5ec8709032baa8ec0f2b867a1d8036d394287951d6d411263d7a5d43d4e6941483ad694d77b37e725554b8eacd970102e21d40

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            02840fbb81bdf1e2d4c1921596cc312b

            SHA1

            9e9b4ec0300e242c36de4f1d4c4683d3b38b842c

            SHA256

            674ccd06cb80dea270601c2f8990e1f5138df3de4f2103aa9dd98c1f82a62afa

            SHA512

            a28cbaf8451ed3e164183ceb7bae2861c9d0de01d06c37d61a1f199c2331c399bb448f4cb7a44ee758dce9b69420d01279a90eb0b169acd5b7ff2513c7631d6c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            9976ef1c4850679ce8616c971d709a93

            SHA1

            7607bd44235c218a8953f5199239150b9ff2b3c1

            SHA256

            992cc1d7d3fe71746b78c5c73e114c09deeb0038001492aca5aa655e05446c21

            SHA512

            6938615473e0135b067705a2ac37216460493c16dcba858ed018a0025efbb5d9ff42e1241d6be47e5938504f55b514d6f796d397c4565632dd0f74e04209325b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            741c3a83669fee5c59027c5e609de1a9

            SHA1

            60e6c73ff0fb5e5a1badbfe6e4fc9931a52a4ccc

            SHA256

            5b170c36e5f2e682dbd80ad90cdf5e1045adedab9b1284d29d8aa81376e818b0

            SHA512

            7999d8dc77f39d9ea615d9a3057570ce9dea511e20c6d200b186932d8199fa04aa18078c7b43117153b31a2c87badc50839dd1aa8c7d1ff27408f201508b7443

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            67d912ef2bdd7e5611e921ae25bca213

            SHA1

            a6c4a697786c6e7edfd099bb7d90ed99c1e49927

            SHA256

            33c6e06515ff2b59ba8954d080c18e0a58e1a1d8f5c881c5b1c0438b0e53d062

            SHA512

            6f585160c05b340e5945756a4a2281015e01a4fa6ccbae4f7e42070dd98e139412ca6547057232b9be692aa01dc36a5d8aba69b6d3df2894717b3d026436ff09

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            a389f94c3d7c05d2602ba4a9e4364d6a

            SHA1

            3221ecebfdadc05dc0c4150f9daf1c2c10b9e14a

            SHA256

            34c10d5171e6a0f66b24b35d2a5ac15f83feff5809144536673e298031a89f39

            SHA512

            731aff8be3a2b82608802e56f4a60c9aa1806210ac0db808aa2d8b3b47e78dacca7fd242e8b32b70f2e4b6c3c4abf23d464ec784463b4b67d5505bd6823ab866

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            55788804fd26d4e112ba47180676d814

            SHA1

            774f8812785554c352e1d1a761233556102080bd

            SHA256

            6d61236fb85debcf1ea2fa446609bc86e2b369376130b919e31d8df6e00c151a

            SHA512

            14ec176fddab18790a17b24343842b94e4e604aa1e47b765e2d9159f7b54c82bc097afb9b14716f78f01a3342d630247b723abba82f366f02f531844cbe4edbf

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1d26948086e33def14b2a0ea57b08e52

            SHA1

            64e96646202a73555255b2ffd17fcf3795875eed

            SHA256

            0c5a94283d367f2da6c5ad61e6075388a51d002b82c74c484ffc705cf9f6ede4

            SHA512

            e392c909730fc011d8ad263a255324b37cd6d8a01150692f6ae5ef71b687880c272109e6141ee007dce3652f21f0c32704e14e1da37e4ad1495bb3ffc0d9c7be

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            10487a3b5b42d44001db01bb890e1ab2

            SHA1

            588de8dcced2d4b7dbc61b767607c95d7331dcc8

            SHA256

            66e49c8d919bd9cad921ddcfa73d842d3c8a99748f7f9e9c41821bfd50e148f4

            SHA512

            fd41c3f392f58e83a88b6182fa652a0c31fa7019d4b67f8f63a536362bb02c2064fa4e0dc8b4f47f7edbeecda7102767fd38fc290b335dd0a3a49b330c58d037

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            27a891bbdb3b391797fbb73095bc4916

            SHA1

            ecfbc4eeb0b45e42ac05a099c010e34bb6c007cf

            SHA256

            abcfb8224a18ff58e135a273ef847c724738a9705f062ad87f183c1e465c0341

            SHA512

            688b43b2d816cbbc66a0426fda29ae39d70c466eef929acc4607b0be3fe01d1e5396b946fc77ea1a7ee53364380c2cb07defa3184633ee138e3f0f044662c7e5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            68fe023b4f3f9c07a0af864e76ba7cd8

            SHA1

            301acb975e0968b67e3094dcb525fbb4dfc60d2b

            SHA256

            0c200ec09a4ab96d7733b7bc224f84b7b27f500fa8013579d195c7ce4f17d09c

            SHA512

            e0fd47dfea4d01181ce8bc11210be86a73b0631461405f2702256e58549d5bde891aec5c9f9f813c8acce19eca90dade9d0a06a322580d429f7a86ea8971f217

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f8ccb113495321e260a723422157128e

            SHA1

            4eff8a158ff1d7e6705a025cc338f618b1d9aec6

            SHA256

            215b572783d2e93e5bebbe082f6be8d5d69a4f1f47d9151ab4ba6d9ec4b6328c

            SHA512

            e17642b5e607cbc6d49352087707e7003cdb342e684465af6a4de22345aebbc611ab89aeb559682e7b5a2daf35d98d981cd6c579b6a0046a3349d11856b9a1cf

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            03b056908c69a9257042f08b0cbe2bdb

            SHA1

            38f4e54df4bfeb723fc3204367ddd5279e959284

            SHA256

            6f67be2e29353ea2a602431719a6d00af2cd27ea00c205c23cc4839ec0d054e7

            SHA512

            77db4e8300d37b848b679ec9fa28f9f6f71ba4c762a0a3a5d45132888957f94ff147fb843bd345337669e92c0725300582b91b1c655d560cd037015b8fb34125

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            d03c6c630e4e0470c1ead9dbb6d7b810

            SHA1

            d7c91094eb473d4df2b9ff4904858639733f8396

            SHA256

            18376812565fb2a25991f924fa0a38ed83e4e6c156a95fbb238be162dda04894

            SHA512

            80a2b901a278b73801406ed27fbec20d2f654c1bfed62c71b72d66eacb270cf6145c0f0e429e63cbf8f0cad153ecc4edf0cd26ac6377b5fd0ac84fcd25ff3eb4

          • C:\Users\Admin\AppData\Local\Temp\CabA601.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\TarA6B0.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/1552-445-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1552-443-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1552-448-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1552-446-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/1552-447-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2968-436-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2968-437-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB