Analysis

  • max time kernel
    129s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2024, 17:03

General

  • Target

    7a86f755e2d18bb4e5095c1f38f39bde_JaffaCakes118.html

  • Size

    158KB

  • MD5

    7a86f755e2d18bb4e5095c1f38f39bde

  • SHA1

    08db2d49b3ae17b312d72959e0d4be32cfe34892

  • SHA256

    11303ecd79c177cee9e5e485d80d450521382861ec4ee312c350fcb5a517c77a

  • SHA512

    c7cfd172cc2338e5ea26fd4a5c0ef1adf3c5630ae7742b9c38c859f502108dc3739e6c291561a6be2e82094fa5844f6503a480e9a40bbb574484f90de48c3447

  • SSDEEP

    1536:iuRTadOL0c3Wwn0yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:ikpT0yfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a86f755e2d18bb4e5095c1f38f39bde_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2888
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1372
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1828
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275477 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1412

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            8a13436793dfebe36970ffc5355ef3a8

            SHA1

            b2a0c74faced86b2b06c3bde6a8974f06db9fa48

            SHA256

            2f1d03bd7f5e3b8c02314cfebc96362cac9de9f9f68b21dad98472c8dbd9dcc0

            SHA512

            91e982d2d059c3dcf7c85025ea877ad3447a2c0b2b83b828348aac26064ceee69eb68b9ded7a8dd4696310d283f19920c42b4e6e4b305627ce75dbeb0ff589f1

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            3248872fd0092aa70808bc1638478148

            SHA1

            a335c7861bb4bf69cf2b4b59cc2e88868abeeb4b

            SHA256

            6416ab1a7ef42ea66b3e6effe22d29b62bbfbdcf1636c99f77719acfca8dca29

            SHA512

            dbfbd1954bd3c84656a4cd028a0a691ac588c91e1dfcb7ad1ad588c27d32a7776ec1d258d9f5b368abd2dc88527fb4ba4478d680272f16c3e74a7b1667db23be

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            588c4b0d5088ef256659ee4134744fad

            SHA1

            4df9fa956ff34f5062ab85b183428d9269c4b648

            SHA256

            d80ef280cb1d5675db170138fe0e89b5f3a0122d2ebd73c3734c5f64789a7cf0

            SHA512

            974646b692511b1d22b9e62af506d5916fec3a1bdb80dfdf81c83d6f936f4b170cc9e24eb6401995a8a47c9189d87a6bd232e4a15dd5039cd658c07dd58ad73a

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            4d3e96aac98bd75c7d327ef42bcbedfc

            SHA1

            4bd33361f4c89378e7c42d05f56f9ea7fcc43758

            SHA256

            6a9a615def9cd6721b37aaa56cb9cb3a59e1ad9170be42fd6026f7d915b93704

            SHA512

            498dd7b9eabf949727297324d3f7de7e28915914e644cc90822002075feb429eb93e1daf32a9e243aee8c3335416806ee0d423b0162dc7ad712c42472f89108b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            acbbee2757796645b47d72843d486179

            SHA1

            0338b1ff5fc671eb81be847eebadd00b169eaf93

            SHA256

            12dc34affb239aeb41f22327fa9e9666d94fde178df658ed0b988b400561121f

            SHA512

            cab0ac5caf6dca5cef3887e19722d47665e6ce963e59c0682e3cab2ebc6eff756870cb683494f1ac36b55199189ad4d98f0d1a55e6970de51065acb0b54cb28f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ffad86f77e6175d1789595ed572f2108

            SHA1

            7764a670516212172193dc913b54af38ab457edd

            SHA256

            da778aa96af0fff2640d304883bb3b866eb57417798d1c89cb49e9cd26866808

            SHA512

            8943282c2fd7ba226fd7ad07ce09df651b71e76e7c1c00efbda50f98ac0ffcb7b2640f6391dd82e210a35999edc2f6dcfca2311f7441695a8c298c9f26921913

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            0145114c2ef0af6e798ca6523723ba10

            SHA1

            fa2cfcb821989fb95b7541e3b72353293653db3c

            SHA256

            05ce8902e8d15a60fa2904e50787a832ff23a5312c33a65dc5fc5369a3823eb7

            SHA512

            944f831f2f06f07c83ee8153a26e4153cd495b1048e20b278980d4696beaffe7d94fe75c712e8e0269b97e7ec75578eb2219537a87ca61f54083fdb66c6e517e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            69841b12834b771807bc05477642708e

            SHA1

            e2599a409a6bfe07e8df05c8610afef1adaecb86

            SHA256

            cf074e202c996d41c516fa9ba2d56ce724fea577b958e82bce9eab14c5b241da

            SHA512

            357f5c0fc9ca0b13f423ff412a7e04b7f2076b8827aff06483cad89acf0e50bab006119f266f9c17bd41ac314afb9abc0370710271e9e4a99ce1b33bae0d674f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e6540d9bf19d2ac4eb2b768f140c40e1

            SHA1

            5143c74a5e019219dc01328e22ebc578511435ad

            SHA256

            1b32f23b0d88b216c5d6932775f6b31e99e60f64792578e584e6e5230914ba25

            SHA512

            77cd12db78dd54ce77fd15fae888988aeb626f43dd2ff5c914051b45400158f9d0647e598928be201ee84806971bde3677cbebc70bf608d8acdced7a35b6764e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c254e491612477346eaee91bec095ba0

            SHA1

            f53532b355a8499ad7dd5a6ce751b448cd65e631

            SHA256

            d587113d20d3df60f1abfd767a2d7b4f91c0290a7ec24e8fb582d365cf7ec766

            SHA512

            3a20821325d08bc48fb46685d83a88642c06627ae7d2e67f00d4ad6e6e2d78908d89954ace38b19b613f8ecf68e4c036f85f6955bb049b9bbdbc53eedb67e95d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            05958dc465d5eb04a9681f40f5dbe0ba

            SHA1

            9eac97707b2993c191f42559b75474c74e0b85b8

            SHA256

            009b5cf250e3856bc24507af9fc36628c0f7d9264d488541c843a09cbacf881a

            SHA512

            2048dd4bbec9eb334fa1bbed679e8e01a62d1d00a890a06abb64b190a7870744dcbeee6f8d6eb52367f716314f3a59986061bf9c22d1a19dc6d61eea1fd13321

          • C:\Users\Admin\AppData\Local\Temp\CabEFFC.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\TarF04D.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/1372-447-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1372-446-0x00000000002C0000-0x00000000002C1000-memory.dmp

            Filesize

            4KB

          • memory/1372-445-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2888-435-0x0000000000230000-0x000000000023F000-memory.dmp

            Filesize

            60KB

          • memory/2888-434-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2888-438-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB