Analysis

  • max time kernel
    129s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2024, 17:07

General

  • Target

    7a892fb6df573de496428779baddc5e8_JaffaCakes118.html

  • Size

    158KB

  • MD5

    7a892fb6df573de496428779baddc5e8

  • SHA1

    297a6d2f97723dfb18746304ba3eaf2404df9e78

  • SHA256

    1d5fd81b6eb16dedbe15de36fa03863846c517b3fa0de1dee0eb4c5b3b49a4fa

  • SHA512

    87138c02d55127d501f298e77a9ec9ebc6dffa8966247002a29a1d17c947188ee8398c039d105c444578463dcf255e397f9417c100889e87df081d8a27dd3d14

  • SSDEEP

    1536:iARTvy7fhZnkgyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:iqWZnkgyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a892fb6df573de496428779baddc5e8_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2704
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2936
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1980
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2288
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:668677 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1856

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            07b158d3ad32811549f6dbb55d9d4612

            SHA1

            254f313202b61e0dd8f70d6882921b8678450a96

            SHA256

            47749c21295b6d091c94482e3e88332232b0079191a2f2376bbeda066b764c1e

            SHA512

            8d9a14a4daf9d36066579b5b71013dec6f81ef565b7a697c13bb0b676fd13b3c396353d689d7ad15379ae60a430a832ac90c19822874006839363146b641c81e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            35d6245b06caca6fc355302314870e28

            SHA1

            3534ee93afa1f19c955a48ead52aec8c76f9a0be

            SHA256

            03240e23cf5fc95efc4318cd53993d15a18533d8f2344c2ee45dd2596dcff185

            SHA512

            cf74c92896baffed42635a04a1e727fe36eaad868a6317e3740f2fff6cf9ffafd4b8a9828b9cf8364333b50e7c484ec7a4ad1c145219b32c85dbe03f982c56ab

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ca31908259d70838dd35b843b7bd7b35

            SHA1

            4298b3004bbc6a68f08cb7853495f16609c6e41a

            SHA256

            2e23e7d1a9f6dc3c1e02b609533a4e1ea9bf711fb5ba2f80e81a437ad0bf97d0

            SHA512

            f14e187fcdc386c66b5fca7e7d2223b66c1207c96ffb8654be7a5af6f43879221b23fc807ea523bbf8e10ff5a2d60a2bf32e8578bf58a3875459db98532e3190

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            68014f48bd69191533abedb2b1ef50ee

            SHA1

            0b366d804b28f5a6141fb5ce6a26ad6531cce09d

            SHA256

            634d7f405506d693374b440976759eed3878d397baa8f67278b705fdcedcf400

            SHA512

            ba4858eb17ee4dc60711e89cfccc28b2b89652a25814ea079b0405f6260fad0580e7b6b14c64ed64393ca4c07c3c533797dc3c7e07ab355133e1fdc59cc0bf83

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            76035c52678426084441edb4f360d72a

            SHA1

            1b47b46e269701873ded26a72364cb14eebdd57d

            SHA256

            627a391d11bbd77d5f3ca5f001332d82ab1562ff21eee8d07e8035593d17cc98

            SHA512

            301e447f1e240ddf6d8a6c380a1074ba173a4f17b9f3de576ddbfc3c68cb72ececb1113166ded81ef2e968554ba7f5e4f408473539333a0f8dbde4b311905f99

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            4c1cab7f2ac6feef6a8815b8fdfaed47

            SHA1

            0e3a8c0baafae8cb1d3c8733d0a6a19e9fa6e96e

            SHA256

            365588e4ecddcbb8935abb0fbf69643ad033d626b843af885a2e48f8bb49e429

            SHA512

            84f2d8c8da458888cd17b39bb2f2dbfb8a16e6b910cdf7f65f4bf9dabb676f7f5f3409568df27be1c15d63e1bdf92ef5ab497c1620666c9dbee213c56b09ddfc

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            18dc9ee5e69b46b627860b86493ce209

            SHA1

            fd8e629a39f4f236ab79150ef4ff298f45e70c24

            SHA256

            86e2477975e196424ba24ff07efdeae03b537e504c23060de53147f8aea2fe65

            SHA512

            56e52caf987156b026c4d096d8fa42ef8eca3da217d2ac71a84369f2cc0ac69481e7e01beaf071bb8c00598552327d04a850a25fa7b51afb045ac63c4288516d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            0633718bf087f86d6cf8f105bdf1f706

            SHA1

            eeef0633ce89254997dcfb701f13404336f7d6e7

            SHA256

            ba8197ce1ba909a59c4c785d7de232f46ea3faec655ee05c1f4514f406340630

            SHA512

            02de94ea58dd9a614504d08748fb3492977260861f2e6e02b1963b4c79a4c728c26686aa2e46e4a3ea14d37573b8962087ac3103b831f63c258f6217aa90d235

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e00e0adb477ec4f95eb50084369d05c0

            SHA1

            fc69f4068a3f5af11c42874aab66ddade355afe9

            SHA256

            74adafa4762b55fe2224640577aeb92b57c05a08e2c01980012320a8ff62be49

            SHA512

            1113a2d8d44156212e521216f2376f9b40397cc26d772edd38e1647a7e91790c77b917eb6cb5ca9ac738bebd30af434227c683544bedb770a15090e5352078f3

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f743c14863e2bd0c62e648e5e8b5d233

            SHA1

            2c508a8ef745191c620547fa2a285f613a2eec89

            SHA256

            c443ec735020658de6917389b47d7bf71e95f2709734075ed5cd14f4a190aa6d

            SHA512

            6c9bac7b1f3e44b85e1cc33face51c02e1c69f55eeaac22211b087ded19bf5c3fc98d7ec4abf16de2594b4e12018cac9998b94e5728bbbe6c10367c358b58637

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            36f24671411a4f1e710d409251f2cb1d

            SHA1

            8dfdef29f43cffb5e534f17096caf78ef79dae93

            SHA256

            ec1ecc0c5d7c53c76585580e375dcc210822a49e24a4ce4cf754289cd71f8de8

            SHA512

            f3a9a58f8a488f438d2d5b86ae359b6ab37b33a012e1f1de1981fb8d4e637cb678f344bf01c493d800ee642faf3bd358a4abdeb49087a94069d06e6f91540a41

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            60cf10e8f07234c9199a60e7cd1d4162

            SHA1

            8e70bfff6e80d5c0b5b29d0d1948ec86ef4c3ff0

            SHA256

            56bea18dfdcb58bc0f7ebbf3b824d68d081177a35b50b24f886370663c2e89d5

            SHA512

            20fb7d0e7ac96cb9596536a56d000bd6454d387d7cbe0aa54be8dfa2f97eb1fae1b0b6e468a95cc63028b20dddc121e061d38b624b68983133c857682f757ed0

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e649dac9fae90bc9a7bb15908b9be58d

            SHA1

            0f14de48af9f022bf9e26d29cc924b6bf080bf8d

            SHA256

            714c347560c895fd8abf4024acb3c69bd810adbc1802bd30a06c0855c93d812e

            SHA512

            c325cceaca8ce64f43813f027c6cd599557e440f53c57a17beb16029fe3b18aaae3a070aad9455fa153efbe29a3e3172c84ad1de19b309d31b7d9583ea99c608

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            5c6338a44febe67a46c921b277b68be8

            SHA1

            d7c439ed091c914b977d25c39cd0b71051789cbb

            SHA256

            92f43807045155667170be1edaca3029911bf8a8db7ceb49882807c0da9f34aa

            SHA512

            614fe052c2b032bf1758fd57e862cd1592629dd90fc1473984fc8798521d4a18e9d10bcd7efb31bac7e794cae90b5f7b2326e3019a06db81cb3f65d0240c03a5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            bb0dddcc475a40156eda4bd93153127c

            SHA1

            1a542374ab65bc12903bf3f22f768984496df8b4

            SHA256

            4ee34ee46df50cd0fd998a5a7b11f1a7152f5a1a5582268460088740ded7c7b6

            SHA512

            0c035451250fe302c406e67b27d54a94d46847f540b9c2c9986f876e6315cf1427a07e6c381e9003933cff21506e01e50c903a6293e268e092be36098e67117b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f4d62f698210a08e3e678444edc1d196

            SHA1

            c64fef5408e4fc09c020d09efaf8a822cbdaa028

            SHA256

            6935f4f54d985bd6df6286b94b52225a968ee3893d60f75470ddf56cdfd9085f

            SHA512

            297fcab4641ad84be80dc9e1009e6c230df98ef8b8740abf4510cbc6021cd4f649d0fe771a27fb3cf6431fed66adf8fc1bfbb1180b3c00edd773e468ec6f4c95

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e892a7c5027a044491b1754a70857ea1

            SHA1

            4603badd22900e6c3401ca7b4e896da343c39423

            SHA256

            e9df318a7e2daf76f87fb8949f06d5d69668a7c56a9ee2ab3810893afbd8f7f1

            SHA512

            e722b190f4ea5081828654bd33eafe1ac2c9a2d452996906bcc9f5d517fca91a17f1db6480939ebf608af72a6d23f92021e1205c7445112954984f07b711ac0b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ebdc05840246af0bd5a3437d170aa182

            SHA1

            f253efa64bc20ee4933b290c7b9dd82bac92baae

            SHA256

            4732017d384a89553a88500aabf33bb4e7b1c8d21c40085102781fd4499a0cbd

            SHA512

            311f3972fee069a87e0613646ea542ba4e6f3d89205512d09c62744baeeb1a107ac5868d1578948bf3f3ecc6218e4d74a2c30219f9ad26290d39f4b049254c22

          • C:\Users\Admin\AppData\Local\Temp\CabF180.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\TarF221.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/1980-447-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/1980-450-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1980-446-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1980-448-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2936-436-0x0000000000230000-0x000000000023F000-memory.dmp

            Filesize

            60KB

          • memory/2936-444-0x0000000000240000-0x000000000026E000-memory.dmp

            Filesize

            184KB

          • memory/2936-437-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2936-434-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB