Analysis

  • max time kernel
    130s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2024, 15:57

General

  • Target

    7a54871795b936f18307ae0ccd8a5b9c_JaffaCakes118.html

  • Size

    159KB

  • MD5

    7a54871795b936f18307ae0ccd8a5b9c

  • SHA1

    f24b27e552ca5b210ca20eee2047dae6f93cffbf

  • SHA256

    1e538033e74d7b2466519979c535f02889033f22a9e8a2103a8bc066155daa8c

  • SHA512

    73fef6a7cfd38788e546bcc24c8c7b116594b6b96b88eba39208ae524c7251772d155aca5ff6e57b85cdb9f11ae09f501d7d82ce0fe8af55b6813174125bfe61

  • SSDEEP

    1536:iiRT98OFUjn5WHw9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:iwxy5Cw9yfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a54871795b936f18307ae0ccd8a5b9c_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1288
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2416
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275471 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2652

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            2a8ef4edad02d2d15b2c85ecac54e8c5

            SHA1

            e336689ebe6507db5788463d08ad37a7a04ab409

            SHA256

            96fcca4ef33468fbeb8c4f55ba66ed2b890c94ebc2c63619359d030c2d45e6db

            SHA512

            885b4aea91428d844030346f5485ff280826833a6ea9d32a0ec110b5f5c4cac2ff8672e3b124c12247402cc5e180ca9a2f358069005d5811e56079120f42f2f6

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            0dece9a678f1e27e129e19055f915a59

            SHA1

            f1dfdc8bda66134c7ad399b50fa8c5034612edc7

            SHA256

            5fe83621cd5649905ca63d48e7c0bd229a97fa1565947d6bd298b165b4e8da41

            SHA512

            f68c6c1f9c42288b375601dd8d8bd5034ccf61d699ad6acfad552189d94004c776b6024d205fa7b8cdddf97c737b39964cd748a38ef13c1412535518b946218c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ea98d9516be7426b4c8755fb6d1d5044

            SHA1

            ba2fc6890af6f5cd81f199ef4540fbba29b76dce

            SHA256

            d3f26931b8ca8781cbb82798a12d479cb81042d411b7fcedc1ccc691989e1a4f

            SHA512

            9aa9a4574f8adb34c1115158eb67224d3a870f5fe8226a814d52e0ae270f40776d1c1e68fbc75334ba41f5c2c1f27755f2c16eb3cd4285edca4b62a13bb3c69a

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            7b11997458dcc4945ec8221717a86b33

            SHA1

            520c2d3140d4153037c8a811010ba657d27c6e8f

            SHA256

            96edcaa15f68c7f57afbffe3bc7acdd49c7cc03ae78a7395a45c769f56f0e314

            SHA512

            4d68cfefa8392ad1e987367b1734ba0c43dfb2677cdf18a48c0e45598986fe31041a963d62ab66e6f9464392cfbb052ec6dcf680116baf42e14ef1b839c0c411

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c99d0974fc5633ba576264799fbcb8c7

            SHA1

            d0160ffae8d34965e9c8ecbd0e339e3bc878305f

            SHA256

            7a59d39c672aea596d91a8eceff2737efaffcd5576f2bed897b5193b39098394

            SHA512

            cbfa3b4b9f4ed45515ebfaf0c6ff2e4b9e578bd46bfa5f71c834b21cf8dc797580595a631500c566f8a56e04399111f6a7f8514cd488257f458b973e632881bb

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            416116261a4937772c64e49a363fd067

            SHA1

            8f0f6bba98d858f3f0e18a0fccebf3f66f305f2f

            SHA256

            c3f52c0c5662d754a652d24e45ab4acf8131c77a7b93c0cb980db31c7a06c03d

            SHA512

            10c34abd2b6ef9c70a4814c29fffa3be7c5f11466e7f4ed8a78fbc658bbfcacbc97ce91d15a7f5eb6c7aeaefd25c6ca7be923b9b547ece570ab6940d7ce41029

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1c0f1a729f4230199c377aee974d750c

            SHA1

            92e5552ad4a8473aee4ee4070855271b0bd1fd40

            SHA256

            48a45cf7129457cef78cddb806995ad2a93ed477b425e0eecb2902167864e4af

            SHA512

            572b93e09b50b9011f39e876e438b1f82bbae2516d898c829ee2d85c95a3ffe8a2461538fbf9e7bcba004e397f4f88aa3d345a895f025d3f1198e88223cd1b6e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ad5607dec407d68edcc04afa29feb88a

            SHA1

            53c65b803373edc8cd98b52447e7893fe40aa831

            SHA256

            229008346f050c47d2419c47962d54c6887f93fffe4ef3a1ed6cf16f17db070a

            SHA512

            1d6c116c3f627c58c930fd6b902b0d8e2989a68dbcb793d8fdaa26e9dff14d805a088830be7fc34855eee97382362b2b59a27a23bceec5ffb26a467d3f8393e5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            8a683d6a3c77c115309bc4cde48cba14

            SHA1

            960212f7393e8799ee8b1db8830464a2786745e7

            SHA256

            7acc8a1ae8536ebccac30d6d90ecf4cc073941e131d3757262c37b3a13076e65

            SHA512

            abb06a74817ad913e122b67810df9714fefaf17d823fd0444878fc53cdff0d4c04b2b430cf4af39f3b6fd0748bd32bc1c30d6d7036d5c6c1fbec3075931412a6

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            62e5cb04d11180929c079a87650f20b6

            SHA1

            5bbe5654ec9b77e4a18180c938e45a589db30f88

            SHA256

            cc0511c670b8e6147769c7ed7018ed80126142aecc96641b2ad8d046e2d6bbdf

            SHA512

            49600627464c839a962b006a4ee8a300c4ae2bb72726fb79201a7048f3a51e8eae3577bb4e661b84bfed193ed12cfe23e21327b9ec664a3037f6f57a768a942d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ab53f8dd8a2579e08f7ec264490a51e5

            SHA1

            4cb8f96a21ac61c48c9110c072e326504acec449

            SHA256

            aef9d83bfa439b378d5e374a12b3d6be4139174770a2f93cf9c393cc0facf574

            SHA512

            974d14aa180bca7632e9f35e9cc9361f477879bee3b518ea6df49ea290b7d2751f30a88dbcc03b88b288bf63987498491ad605a2096135f67730c397405bb207

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            03fa6e408c341c9cd6decf6f77c02769

            SHA1

            18fac9ea03b56d000c2b9c9085aad6e68cd3f489

            SHA256

            893c152089198a6ccafbd8124baeae8c0552da78c4d9e7b5546e20125d0e6e55

            SHA512

            23cc9a215620287d287dda4bef192e447f758bb9291d07d224f748d55e6383ee99cdc727dc425fc608593591e9bb21b1af87db60f09a57122b0eccfdf9c0de31

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            25a499e6399828d3bfe19a851493e676

            SHA1

            3f5cc6066289da866bfa1b266f5652a2c61d2371

            SHA256

            cb674fe31edcc89173c050d3f911a082e12f9c7a65f84079de5010bb97d4b388

            SHA512

            52d8ba0dfce9c3fcc44ad3d0f0add4cadca7f69e1a3a67b6c03e8e7de23b8af77ef2a6154474cce600f46dbfc059cd851d47c8023e43977d474180ce7fda390a

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            d8667e18f5d7637f41329fc033120d8b

            SHA1

            08b7456e14da66a42ab66c6d6c2bc12333d1b496

            SHA256

            e860c9033480b7281e4a90835be4cfda8fb8746a86bf35073ec3c6f810124ba2

            SHA512

            ec4054e9d1028f8fae302d5dc1fdb0827a52a6b4d71123eed2ef9764379b5cc5c29e121ee35e06186d8e38a4f847b2219c2023306326267d0f1febee7e927d88

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            6fec3de42aae58d17b53d5c4f97ddd2b

            SHA1

            2d6e8d2dbc48bee3e6ae740f1cd8cdba611715b0

            SHA256

            2f16ac9b3f3d94f2b3071f898f1b85674066c0537e6930b9db65162c4b3bf723

            SHA512

            d9a260f0b4816924ba6d020dae111bb36e61acd18a414ae50cd55909ffb22a2e0a47cf24a93eca21c33aa3b40441527c347aa839b925a35029d7d6e602894555

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            16db2d77c149bcf25a3e20da68d91069

            SHA1

            671b296bf617105fd313960d1ba5031eda81917e

            SHA256

            7db3b0bde300eb690816f4ec1af66101a7c5d0bac7ac33c9cac06ab5ca311f78

            SHA512

            de55316e19718fb25ef22b6e8f71700c0aa2c0f630504cb17d03bee43019824007669a5ebacd92b4cf107d9b8128756c13b1c9d0a292f1346118a2705be8a4ae

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            0ba5f21a5dc5890c73137d862180c8f5

            SHA1

            1d28a79d195042f4606bb96886778ccd8fd40d65

            SHA256

            f560920e5865f761f4ddd263a48b5cd2ba2be3c27e1f95714ef02ff4e5b62455

            SHA512

            f4171ba08643e0bb220ed43ec31003502c4b436c373ca8a00ba8b6bd9e543568f904d8ccd192cf41ce1312571db65850cc801fad4d16995d75a12a9ef6a8397c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c59ef7577a4102885d870a323cdb1c0a

            SHA1

            08e8d46c032c1c0c7132b55994d801808fa836d6

            SHA256

            38bef15ab45098e1e052c52078bafa27a0900510f3c022d599c06b30a7579b02

            SHA512

            5eda1a4ef4d40e06740103b2802c981f0c1d8cf2b8ec8ccefd35d341e9b81440f7b5e591d90ac4d77ca99573c695b7839b6a20adbb4fc6f44f906c5e035be4a0

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            2b13706658a27098bc3b8cd690f9ac37

            SHA1

            d01ab0c51b00018b0369dab2ad55cf2702f07cb4

            SHA256

            8f7f236853544c2f10c702fc4fcfc7923ea58e1eb8a0ccc1251d0de79d78c004

            SHA512

            dbb7bde82af260e909faedfef2e89828c4da364debe8f100d3b1b2cfdc696bd4aafec2f453f361caf4be98fa66617fc10716897ee11390b5d051a6e364c3d158

          • C:\Users\Admin\AppData\Local\Temp\Cab606A.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\Tar6109.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/1288-447-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/1288-449-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1288-446-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1772-434-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1772-437-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1772-435-0x00000000001C0000-0x00000000001CF000-memory.dmp

            Filesize

            60KB

          • memory/1772-444-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB