Analysis

  • max time kernel
    132s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 07:28

General

  • Target

    16bb7a7b2328c36ccaa6923a85796280_JaffaCakes118.html

  • Size

    156KB

  • MD5

    16bb7a7b2328c36ccaa6923a85796280

  • SHA1

    5cfb63a555b8460f1362641876df4594a1dbcddb

  • SHA256

    b4ef4b2032b203fdaf1ea2ba400d55f2e49846432abe3412fbc134292a0459bc

  • SHA512

    6b716026f9d11392610c6a8444a435228a27779dca6fc8c3cd0c1da4be523acbf2a21c928dd0196fc9ac75df66f8fd41c4f74fdb44867d84b96722d499b1293f

  • SSDEEP

    1536:iBRT0/8Zj9/L1b66yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:iXzpL166yfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16bb7a7b2328c36ccaa6923a85796280_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2256
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2528
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1732
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:603146 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1956

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            437f2ee8728c9bfc08e3800e14e79140

            SHA1

            1f4867874b96fa155339b3a26eb4b1641ce3db20

            SHA256

            e93a5e7a8290d3b217d2ab8fbf9c81071ae5d83ecba5b9ef1dad4bf3962cf497

            SHA512

            0bf830b0b78e39abf7e942117aa8dae23ab38a91c80bbf9d9942c2e2c64f381fbf41d2c7bcf1909c94ee1ba5371ae06010559f7b1fcd64351556e1135662da1c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            17cdd36e1a11c82d6fabd2f899e5f051

            SHA1

            75d9a10392c0c4fe926351f1eb1198975b68153f

            SHA256

            c393c6161b2a632b2eafb74a7e03c54374b26a402ea7e620b7dba1ee222cefac

            SHA512

            942c88a9bb443f2cd21c886f79abc930063af18c4d9d453174e44dce69e90027900210ce0df32c7372138ea49338b856e77ed1861073a0e80877a7df84042b65

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c09664e881bf753b916ea71b7310f2b2

            SHA1

            7ae01d22c4f4d41fddb6efe1569f8b1dd57d3044

            SHA256

            96c35084c69a7d86fd547e6599087891fb6fb58c059d23261bf8097345ce0255

            SHA512

            4da7048af487e716d1e1afe6d5611dd74937b980c35f4415a0a5fdd8d58fd97c8da897ec162e5c059461c0d25df86901d6eb8c88f463797fb15933670920016a

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            0a64af078f04bfa2541ba87a70167c87

            SHA1

            9c072b8764115ecadd96f3d24b9da0fe054555b4

            SHA256

            c5dc710a8780b4ab2705a5cf9a899064aac14443e17a6f5fc061178bb77e54a4

            SHA512

            34441840559f244efcf0d158b4c69527f4dcd468085ae233447701e2bb11dee3809bfdecb86a3c36780814c08ef54b1dbf3cdeb8f5d8ee6dd01cf43b60fe9836

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            255841582bee277dfb6f5d853de314d3

            SHA1

            9ea3447e1b19fbd75212bd5a7fa8b31306f0d7a8

            SHA256

            72d8895ef5f0c7179335d500e8fea8f6bab5c8d81cf29dba57594a268db9e3a1

            SHA512

            6f29950f1b4f651fc6316ab5c0006c6f15c84c1edcb1b4bb0a1cd9590cd82938f98af8a5419e38dd7a12337f25f64e00fd4f5c9b6a33006985e2ce0e3ce975f9

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f581114061c357605f1851814cc0772a

            SHA1

            51645f66e55676fcaa1ae1538bd6c5ad4edf4545

            SHA256

            4502a441d0072dedcefb31f6cdba1dc9d764dbb3488ded5083ec76a4efd6eed9

            SHA512

            c019107caa5b09fa7b38d0d4bd5d6bf6e325c029fe19dfc2eb475d3610adeeb4c40dc012543b076b1cd8c4395e5046640cea08621b7300cd6f2c6a0d0b7ab057

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            cc0b9cb0c65ee18986f74867cbdc2a05

            SHA1

            6ead7728db37e0f0e304bc33de9fc753866bbda5

            SHA256

            38b27ed2ee7efbef8bb46e04000c9a0f717ff56e03ba65992186ae361c373836

            SHA512

            bdb576d578a3916d5d3bc488e8b3ed4fd6826f173b65bd9ba494d5e11eeb649bdbb4d7de7df17ba27562a05b97efe63aff0bb66eeec5e08f5b4bdadca0b7d50d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            6b0933c32c7cbc9233c1c6d772b9ccd7

            SHA1

            7274d07816848a79c2f906b20aa0d1f01f531265

            SHA256

            d651410e726566430f88546f64c1177f6785e6d8419c095c5a7e5c425b06ae20

            SHA512

            a290b162b188b2dc06bdb99a541163b990f4bd75f58246af58e3981acfcdfa46f6ba1856c82005bdb3afff80b0ee1f13fa246129ea63ff09e101c185252dff47

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            535ee61a1c054c3c032dcee7c08287c3

            SHA1

            e536aeabe4c5690f998937bf7b5941c0012a54d3

            SHA256

            20a6d5645577f682c57bfe92dd29427833c4b2b914cd2c1f70d5a8c47162bc77

            SHA512

            72cf5063a0580e16d06489147f1e256116736ea92d0b2beba1d818f213ee64e38987cb192991d80bffa80a8515349ab254432402199f9bb0834135bc5517589b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1dbf32afe0b4b2ed3c57fb7913584046

            SHA1

            3fa4e8757cc1d37350a527d445e90b071d352e53

            SHA256

            5ec1fe31a0d310a4ee9c4d6a6c6e11e41b0e67181bf1671d2eedea540937d908

            SHA512

            e1a7df5cdb09817d6b748209dd9bff1ac6eb0fb0f381ab055db32108e8c0ec36e5d234a9028ed3782b7bf2a32dceb1c4d0b2d2f91952d4de090551a4deb0b7d1

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            d75ae9f48b473102b662e0872ac0f54f

            SHA1

            063212b0a922f0ea4139dd00f008edefd5caaec9

            SHA256

            18728a16a080029956b864437c1f805faa4aecc26807710393a33f7877de383d

            SHA512

            8fdbb5545714a44061e1c3bf46683d7fd892db5463d7ca5baf1a4f5537c916319a1186bfd1d426fad224263258b3347e63e5ec3493be22406eaf7ff99c6d5a88

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            69eed0bc5cf86e1e3f043613e4357156

            SHA1

            bd6f75fa5478cefe4aa112cf6786292ca3ccb952

            SHA256

            f3c4d1820ead540514a8c0707489e380ba7af417c5cb8f7b87e837bfb947bc56

            SHA512

            b675a5b2bd1a7a41869a8db1477bed82541d9287bc67af5fb6c69e27914bf4fe284ab88e810eff7da8a98751abbc4f6b49e69cf3d400e2096690fb73d90f2209

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            5bf107b49e7124fb439b10308922981e

            SHA1

            b5a73686df622354dc56b6115b25e507c6b9c679

            SHA256

            08354390f7475f445e54070c14d0d2763ddf76ae4c14ca5258fdd0ec1147d0e0

            SHA512

            f8038275bf52f3da899a941f464a0b970c19e3d116cc0dffd2894c98bfdbe011ff8d86ff166dbc1257cfc097aa919d2204abb1ae878658a1d858dbcd9899d5b7

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1f1af6aa3790c0a748f83193d62e2130

            SHA1

            30eb367767c32ee9748383557e6d5f5b027c57d5

            SHA256

            739d9419e45cec763d982309f8d28ca993e45b6c72c3b59b4978d32cb28426b4

            SHA512

            07701682b8885dbecbcce455ceb0185351a3f235484f0cd94353d9f97721e97703dfc757ba7a4256edb32bd366e70d2bc861e06285a81e056281eb0bf2643efa

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            5887378127216f97942bd1b0410c1ef8

            SHA1

            3c96a9ec81073c8d3f8b4d9d57f52d3cbd970c99

            SHA256

            57f690501bdfdf308793fa4a2bb7b7edf4f31a34ad37d30aa0c6223a3e543636

            SHA512

            2f854fbfa687ca1a1c3de5e4921aaf729a8e780956f8830cbdb6095a364c56c6eda24d3247c25ca5475406193a4ca3f35d3766630114df8065ed2fec2c287e5b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            64a945cdcabd3c1616c0f19872faa96d

            SHA1

            752692615d0ee3a681baea0acf7f8c7e7442702d

            SHA256

            1c494b22f52e57470b5bbcc3fcbed4c940fbbec020616f2dba85efc2c7d17d28

            SHA512

            c94bafa69d0a36a6ab3444fcb62ac6148b31c60f77a29561c5897151d8cd31e4d75d328f2da2964a6a8108ad09e72da160984c873fe58650445bca2428f3b5bf

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            4776f15d299d701e3de9111196e1e94e

            SHA1

            c0e22110ef1be59bec8f496b60942d46ca72d610

            SHA256

            f5a7fd0dc0690581e8b328f57bc0d9c3dfde3088196542c2aee55957d127a8ed

            SHA512

            c976fcafa440212167af9ceef9f334e755d28ab03f3199404937d9ae27cf522a2b2b7dd9515cdae8e73d1c79f83990b7cb179136eba10028737d674117b94544

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            7e985e3d1046948ba1ed33fd7232dc05

            SHA1

            5824c16e5f079ff5ce69d86668e20d3f212afe3b

            SHA256

            ed0057aa3d8178ae110abc91c0a84a71495eb3aa85570c629e36006b64f2fd9b

            SHA512

            477b2ce850719aabde14be75e9bc59aa0f529b50c6105b67cc9283527a52371d53d6566eebf8fc1c5e1a271c6d7e00d6af6eadfe75a9bb70240ec6e804ebf40b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            0f011f2b25f0f78408ead6c01bd69f26

            SHA1

            531b48c16b4f77102fd71cbbbcadf6306230a895

            SHA256

            72549803695b99954b98dcaa1b1ef6d87b360aa3a968e9dcfbabe94a1fbeb664

            SHA512

            d4ec7385c94bc77797d7aa9fdc973225f5ae8533fe113dbdcfa77d8fac805393c52c8f21440f6c557f01054c8e2d2c4d560804f93d43d100482354a2ef7a64b5

          • C:\Users\Admin\AppData\Local\Temp\Cab8D92.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\Tar8E31.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/2256-438-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2256-435-0x00000000001C0000-0x00000000001CF000-memory.dmp

            Filesize

            60KB

          • memory/2256-434-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2528-444-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2528-450-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2528-446-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2528-447-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/2528-448-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB