Analysis

  • max time kernel
    92s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2024 17:52

General

  • Target

    414219c99524f80257ba1fe2c9f44360_JaffaCakes118.exe

  • Size

    121KB

  • MD5

    414219c99524f80257ba1fe2c9f44360

  • SHA1

    5066d2cfbd55c5a4f9613186ca44d6a0bd1155fa

  • SHA256

    0141b9a6b51d4b0fc212d9e41859818572ba240d669f0f490861467d3cae2167

  • SHA512

    83ee8e117372f374577de89575488aecac75c91d1787a59be597352c3e541117d585a20f8fe6a48f92806cc9aa8fde8197af0f596826854ae501c86f229fc753

  • SSDEEP

    3072:VR2xn3k0CdM1vabyzJYWqmrAZd9vQl8WrNkyeUVj70:VR2J0LS6VKAZ7YlpBqUe

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 5 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 10 IoCs
  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 6 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\414219c99524f80257ba1fe2c9f44360_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\414219c99524f80257ba1fe2c9f44360_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Users\Admin\AppData\Local\Temp\414219c99524f80257ba1fe2c9f44360_JaffaCakes118mgr.exe
      C:\Users\Admin\AppData\Local\Temp\414219c99524f80257ba1fe2c9f44360_JaffaCakes118mgr.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Program Files (x86)\Microsoft\WaterMark.exe
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:3084
        • C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
          "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:2100
          • C:\Program Files (x86)\Microsoft\WaterMark.exe
            "C:\Program Files (x86)\Microsoft\WaterMark.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of UnmapMainImage
            • Suspicious use of WriteProcessMemory
            PID:4324
            • C:\Windows\SysWOW64\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
                PID:2228
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 204
                  7⤵
                  • Program crash
                  PID:4632
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe"
                6⤵
                • Modifies Internet Explorer settings
                PID:1404
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe"
                6⤵
                • Modifies Internet Explorer settings
                PID:4476
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            4⤵
              PID:4344
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 204
                5⤵
                • Program crash
                PID:1388
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
              • Modifies Internet Explorer settings
              PID:3420
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              4⤵
              • Modifies Internet Explorer settings
              PID:2628
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            3⤵
              PID:2340
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 204
                4⤵
                • Program crash
                PID:5036
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              3⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3292
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3292 CREDAT:17410 /prefetch:2
                4⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:4436
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              3⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5068
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5068 CREDAT:17410 /prefetch:2
                4⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:768
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2340 -ip 2340
          1⤵
            PID:3216
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4344 -ip 4344
            1⤵
              PID:3924
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2228 -ip 2228
              1⤵
                PID:1416

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Microsoft\WaterMark.exe

                Filesize

                121KB

                MD5

                414219c99524f80257ba1fe2c9f44360

                SHA1

                5066d2cfbd55c5a4f9613186ca44d6a0bd1155fa

                SHA256

                0141b9a6b51d4b0fc212d9e41859818572ba240d669f0f490861467d3cae2167

                SHA512

                83ee8e117372f374577de89575488aecac75c91d1787a59be597352c3e541117d585a20f8fe6a48f92806cc9aa8fde8197af0f596826854ae501c86f229fc753

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E1671C7F-898B-11EF-BDBF-622000771059}.dat

                Filesize

                3KB

                MD5

                cc5de3b8c8adc6cf7ab561c220b4abf1

                SHA1

                6171e0f6827c803ad7f19f2a305bc7ab7aa43cb3

                SHA256

                c80ff26f1229a066417ab667a33f11a4810c8522fca2407fef2ae16a04e9d618

                SHA512

                1b9bf316448f325a1ace96b55da9f341768c72566c90c1c74c24b94d2e1dfcff9b60227acc1da922e7d9f78e8784011f70f3736ee6831e0e99122ecc1e2db02e

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E1697EE4-898B-11EF-BDBF-622000771059}.dat

                Filesize

                5KB

                MD5

                2d9a344fe02eab23f612db06a41015f5

                SHA1

                fb5c01ddcad80504a413f49c84953be05dfdcf9d

                SHA256

                70427f0f1710188c91eff3ff0fe6dd6b075732785c14135db5cf9169767f1330

                SHA512

                fe37277a6d4ff1de5a622f3ec66d4ac80db89a452b1d0cbba86389581ad6d1d635cdaeef3e3023927bff46b1efc78c3a9cd91d9cad307ecddfbc7c1e9f4277ba

              • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml

                Filesize

                15KB

                MD5

                1a545d0052b581fbb2ab4c52133846bc

                SHA1

                62f3266a9b9925cd6d98658b92adec673cbe3dd3

                SHA256

                557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

                SHA512

                bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\suggestions[1].en-US

                Filesize

                17KB

                MD5

                5a34cb996293fde2cb7a4ac89587393a

                SHA1

                3c96c993500690d1a77873cd62bc639b3a10653f

                SHA256

                c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                SHA512

                e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

              • C:\Users\Admin\AppData\Local\Temp\414219c99524f80257ba1fe2c9f44360_JaffaCakes118mgr.exe

                Filesize

                59KB

                MD5

                f2c8b7e238a07cce22920efb1c8645a6

                SHA1

                cd2af4b30add747e222f938206b78d7730fdf346

                SHA256

                6b20b420e84a30df810d52a9b205a3af0f46cafe82bf378867542f15eb64461e

                SHA512

                c4b9c8c3dccaa39b5ac1faea7e92b0e1d391f0943989178634992be07c40be15b8543f9c6746ab6a5a7136ea00e3c0818fc43bc2eee4e5d282c3cbf7ea279699

              • memory/1328-25-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/1328-5-0x0000000000400000-0x0000000000423000-memory.dmp

                Filesize

                140KB

              • memory/2100-68-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/2100-62-0x0000000000400000-0x0000000000423000-memory.dmp

                Filesize

                140KB

              • memory/2340-63-0x0000000001050000-0x0000000001051000-memory.dmp

                Filesize

                4KB

              • memory/2340-64-0x0000000001070000-0x0000000001071000-memory.dmp

                Filesize

                4KB

              • memory/3084-82-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/3084-88-0x0000000077E42000-0x0000000077E43000-memory.dmp

                Filesize

                4KB

              • memory/3084-60-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/3084-85-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/3084-38-0x0000000000400000-0x0000000000433000-memory.dmp

                Filesize

                204KB

              • memory/3084-87-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4324-89-0x0000000000400000-0x0000000000433000-memory.dmp

                Filesize

                204KB

              • memory/4324-78-0x0000000000060000-0x0000000000061000-memory.dmp

                Filesize

                4KB

              • memory/4324-72-0x0000000000400000-0x0000000000433000-memory.dmp

                Filesize

                204KB

              • memory/4616-41-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4616-80-0x0000000000070000-0x0000000000071000-memory.dmp

                Filesize

                4KB

              • memory/4616-71-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4616-90-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4616-44-0x0000000077E42000-0x0000000077E43000-memory.dmp

                Filesize

                4KB

              • memory/4616-43-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4616-42-0x0000000000430000-0x0000000000431000-memory.dmp

                Filesize

                4KB

              • memory/4616-31-0x0000000000400000-0x0000000000433000-memory.dmp

                Filesize

                204KB

              • memory/4916-6-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4916-8-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4916-7-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4916-11-0x0000000001650000-0x0000000001651000-memory.dmp

                Filesize

                4KB

              • memory/4916-0-0x0000000000400000-0x0000000000433000-memory.dmp

                Filesize

                204KB

              • memory/4916-14-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4916-15-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4916-20-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4916-10-0x0000000000400000-0x0000000000433000-memory.dmp

                Filesize

                204KB

              • memory/4916-12-0x0000000000400000-0x0000000000421000-memory.dmp

                Filesize

                132KB

              • memory/4916-3-0x0000000000401000-0x0000000000402000-memory.dmp

                Filesize

                4KB