Analysis

  • max time kernel
    132s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2024, 16:23

General

  • Target

    7a690bdc5bcc7c124964a50e262ee941_JaffaCakes118.html

  • Size

    155KB

  • MD5

    7a690bdc5bcc7c124964a50e262ee941

  • SHA1

    eb0f3472fd2897f0c9be407afec6f46214dbf3ea

  • SHA256

    3ef842afebd57c5b7a34c7a52305a5a0aaf36956f5662c5f9f0a018884cf7f86

  • SHA512

    9b2e2cdc634c42ad75c0fe7fb349e1fc46045729c3708cc55a7cb370940a61d8f68938edac43d9c7c0c070e7d15018d2393485668375383b70c4be7eb9fa4778

  • SSDEEP

    1536:iTRT21hhFx6olXYyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:i9ap5YyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a690bdc5bcc7c124964a50e262ee941_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2208
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2420
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2588
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:603146 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:912

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            aec37fe25ca780119a6bc1c55d68f88f

            SHA1

            9d8fc49316bbbd64d7146e0d947e601fb18676e4

            SHA256

            3c49d2a1b48c9db016c2123400d5d68d12781f9aba096e78c1086198fa4cd371

            SHA512

            16759f8588e49b2feed13fe55085e4f3950a41a970f07614f27d6019b40705f006c960d46e4cd5cbb6cbb6da9854ec565c39b5184af519da3ce59aa17c39438d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e883d394834728ab01b02b6ad2327d8c

            SHA1

            70e5d377bcd7815e1b091b41fc3655dcf6ace942

            SHA256

            f5573c958effc6b1f8acaad81f17a71c49b9d425dab17cef30c1aad34a1502ad

            SHA512

            5f20673d0d6d6b7b77b54719500f7d3115429456c254f316fba7d5f091188be9c85ec54093d8c73fc5162150019d5477f57d4bae39bb01f8419a1c3d822607d6

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ceb0959da7a6e64afd56091c6fb436ca

            SHA1

            7deca5ed0bc66fa64ba8417dfc8b5caf862218a5

            SHA256

            9c527cbee619c6acfb931197396738904fbbe3a77a1a7a415dce463fe0f45c9c

            SHA512

            6f715ab90a1e29db237a5476596c0f2aeead2b79a3ae1f0b446dfed4353821d0062e9ed26dd2b3f661c5b99642e480701c62edf852ef4bbb0d72e120d9fa887f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            4baf662f7337333eb117eaeef4c1fa58

            SHA1

            1ddca5f954c11041bff31490c59eb4402a6f3e16

            SHA256

            b0097ec676ac669ceed60d07c0f0f27655459ef9c3d0933f00d5831ad0b94024

            SHA512

            4ce424c93d08f1c40d82520006d0d24ca54f12e0daa1f6730d7bcabd67b34d9ceb088f06fa969ad0ba91472737f2950018b7c43e9c56f5e8e7bc2b90f9d4f376

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            d45cd05d391d160bdac33d77f06b0c45

            SHA1

            304ab1c174a2440144d86bb3ebe5f5c13a350959

            SHA256

            9c737f9e7d6d0e2be11989529147e6d7c353ba2bb852630ac2f42ed81580b300

            SHA512

            5c80cb6165c3d61c0073c71333f434ef6da0544109b9ee78e3b7def3f605188ba16ee1dd67ea6faaaf4bee623246495390fa068e6c4a38f618ee3d8e58b92b80

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ea3f73ee4b736cdab33550475d1e6dfb

            SHA1

            3a09a7ffb1cef7ce2d123fa50beffe74c33d3948

            SHA256

            523231c640b420d28f7d099c78ae58efc223a16408daa439e11295e46e6bb135

            SHA512

            5ef4d58e58b1c5a5838bec3cee7399ebf72499a10ad5ac9fd1c82ab72a47e4db85f6dea1f6a35b7b4a7d4739929901539980ad02489b0f0c6e77e36e9e992814

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f1a295b622edd0b92eb804b4e17d6b2a

            SHA1

            cd952b88582eca101d09e4b0cee4dc0b13188a60

            SHA256

            c6a6a993c5af27f91495b7e30378bc6614627060cfd68793fa7ae3fc3bcfe784

            SHA512

            98600b79056a55f9ad71d00515fab9a446c4ffb09d2081bbdb72b01050a984f1f64d968f9d646a39faaa9c56ade087ee2baeabc816f10ddfab280dd61dc1767e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b84dc614ac1c22752fb5a9156fb67367

            SHA1

            5418382353d6624e03bc294e0fb51c262b5c9ce2

            SHA256

            443a6e3cc5a2c79d424fa375bd11d95d7bb3a4e0a971424a0d4d53cf027cd16b

            SHA512

            f4853c2e4aa7dc4c4016b63241bf503b23fd6cbf68854bf6910802db6bcccfef33c548ba55bac8e29fa939c1ae6209db19df02a54d8244479c634e30078d6c53

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            6ac64af7c152a270b63a18aceb8c5eb9

            SHA1

            80e7b734e0c1d852849360b374517bd746008209

            SHA256

            2dd4e7f620e867b0a646178c0e7b79aeafdcf7e0cc61240a36e30ad4c43057de

            SHA512

            15d9dd07dafedeb8ea0e2321e49c3a4df61c8dbaa50dbfbdcd7bcdbb8842291656f3ea70086c1cbca67322111c8d349ac1998768cdd179090a2bd7c2b42ccaac

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ac11f802772d31705ee8c9a360b832ae

            SHA1

            2c310280e0dc6e560f589e730d5ef010c866d35c

            SHA256

            df09aadc18f931c06161de6554de9a09ee366639528da9bc6e6526150987cae5

            SHA512

            70ddce5aa04f2a71a5ac926bfe88ae996a173bf987feaf08ccfb52c505a68e12e036df4665e19489dc24b1aef2c46e5c13e18f6170fcf1b71519bc8b6a7d11ef

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            7316a486e25b215d8d887b4c3f157638

            SHA1

            49518a26a927b02b98cf1a161ef08397c8bdc707

            SHA256

            a2f2075a850aa331446a046c530b24496e886dea66e283e89ad371b4d2eface1

            SHA512

            2d42a48d8de8263614da1be4b2e6fa3c85f2cc43a189d833ea9bcf7031484567560d0af5acc822e7ef7014617ac92261203e9e51ef6f3290cb0e663f528156fa

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            4ca099aeee3de085db43f7c48c1ebcd7

            SHA1

            2b75946fab639b9e63ee6079944af76da64f560c

            SHA256

            a26f249cbfc7e58c7458348b17705b1bed004ca5772892060923c4ba39e64668

            SHA512

            84c1c2576194009096f83275b5d05a8e05ad514c37b37455a5a11c66624f3b4e50ae55112c96d8b810c78a75b4ed149faa47d75d1c1ce0c922ccb5f07bf80417

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            13c901815b62dd8cd6eeb9f9d69535ef

            SHA1

            8af08ae73f0c8ee27b6fe497aefebdfd27393ab7

            SHA256

            c4765aff18b894132265d0a4d78392b1c5587e71643a5167e8915530b735f114

            SHA512

            d84beb82dceccbf327fe1fe1d65cf6e9accca887d03bfa3a1ee5c524e6ff2f427c94ae6002525fd2f8c5ac495810d0c1318837b9b08ccdb92056f0c98d9db89a

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            0e23cb599fa79b8df66d91d8962fba7f

            SHA1

            2f7b423215a741b780d362966aea42b0ec1994bf

            SHA256

            051414e0a16d552d1fa7955672392bfe8b2404d96bd49cf48afbf0dec082d6a0

            SHA512

            352647251509099c29dc4f30807431ecc89952fceca062e179ebddd81329f96fbcc3634448e2c32570a8e35959bc4a00070dd3f4c630362383b3bb3f87986200

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1fde3897f8692171a6c67daf081b8e34

            SHA1

            1363f6fe1056b5fc649cc54a3b4058aeaca674b5

            SHA256

            f422b1d40de8d7096b339a8cfc7cb085b98a76f4db08492c20e71c2ba09cfb62

            SHA512

            935b1d2b796acd6017d7f842a46c2b1b421f3ff9c4b79c735add2d480bd6ac97782e94cdfa447cb380135ea988ec9509b9c0c333e3959b596510d9cca8a86ee4

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f030fa40e8107c1ecbddc3ecbd840512

            SHA1

            e5619f5e3fdd7f897ffabd5804ac8e54ffe2baf8

            SHA256

            27f432fc23197932c50882099ca996b853ad9a3d36a774215069e5edea22c856

            SHA512

            7df70503fe8edda410fb087f2b3b9c52ec06cfa5520e810fe6115d3689eb8539c70f04c8dccc56648b3c0d372f6a3dfab7ef5d405022991b2b5d9ae4b4000b73

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            29daf2414804ad029e933830f9da1835

            SHA1

            9abd0ed80fe63e355b5444a67f58627aac46580a

            SHA256

            974afca6d4cf20caf71d15d6574071695abffff181ae160586fd689c2ef81066

            SHA512

            a66fa20346d2c2221fffc5e912e5372ef4375ee260ea6380680f550cedd557e0616b19dd4806bd700ba752f56ff057ab7b61e8a56cfc8979444b5a959bb27612

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            33ecc6ecf4f486efe81aada18148ab6e

            SHA1

            c22ad9b60b24fface58ca0861e62f07961d3d05d

            SHA256

            c794b9b08dc6acf69fc23226f1bef871df4c1d57db33fbbe43523f351ffc5d02

            SHA512

            4e1a24c0d232f568b2bb0cb1b21879a350d437e88c91e211ae9d4784b1142acaef02272821f9eddd997ebb8cde7ca3aeb1cb1f1843554002cd52c3e3c5f85d36

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            78ab1943af707e00fadaa1285e51e56b

            SHA1

            4084c67dbdbbd12dac7399bf0fd1afddd7c7fff6

            SHA256

            03fd3d8d8a93a51602c5930bcba5850e01283acb4b64e74540c93ce471ba466a

            SHA512

            2b5b9f86a2fca6619544cf652b12b0c0bb1dbfdd037fc6b4a06f92d008566fee79b507f135c8e57c0f9c36113b6d27c1eb9add9d50d972cab119930d6e3e02a7

          • C:\Users\Admin\AppData\Local\Temp\CabA69B.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\TarA72D.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/2208-443-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2208-435-0x00000000003C0000-0x00000000003CF000-memory.dmp

            Filesize

            60KB

          • memory/2208-437-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2208-434-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2420-450-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2420-446-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2420-447-0x00000000002C0000-0x00000000002C1000-memory.dmp

            Filesize

            4KB

          • memory/2420-448-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB