Analysis

  • max time kernel
    135s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2024, 20:22

General

  • Target

    7ab3808939d2f298e7733b8047188d24_JaffaCakes118.html

  • Size

    158KB

  • MD5

    7ab3808939d2f298e7733b8047188d24

  • SHA1

    746ea0a518165d466ed09205f8dff4908ce9cc03

  • SHA256

    45a6c3dbb7e3fff7b6267ee50bb0254a68f4685da9095971d05f004a21b8d3cc

  • SHA512

    98b6ce35505c14e38c0c57f4f41a2f87ebafc6da94cf4a871df89b83ffc040346f2478ee435472cefcdc733bc12603663237a257b04f916874c79b87ccefc1f5

  • SSDEEP

    1536:iGRTdTtcy7DLg+oocXryLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:isfwZXryfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ab3808939d2f298e7733b8047188d24_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:892
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:532
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2500
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:668677 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2324

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            675728fe62594bf6f1d145a10cf22d04

            SHA1

            6bb19379fea266c5d30004abeb6616573902cc8a

            SHA256

            84d39169b08c2e36769aa21738df2b9dd66c1c9cbe19902c1a280df2b806e34e

            SHA512

            329a944bcd468c26b3ad3d066f978c28ec0bf2728c9429b08c8b87d018bebe42d2a9b4cea1c376e1ae9628870919a1fe266894bfa766474c4ebd1f217653a1d8

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b8a1b3b42d18ba7c5009bb94eb5fd74f

            SHA1

            fba51e89c4681fedf6bee436b8bcf97ba85c4619

            SHA256

            103af602c261383bfe46c5fd219e978bff25cf42c21c5db822c00b352febc00c

            SHA512

            fe13a2d3667caf565775f1ab0df98658f2889a9ead441210feb1ea473623758e96bfcffc5e3865d8809aa66ffff1653cacf36b3f50f4119a94da16436a4c9d99

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            eaab5bf1e01c5d665da01e93f30d1326

            SHA1

            cb8bb21b94d4ac83b97d4c88396b8dac38caa963

            SHA256

            b8813ffa616a7630ebd201149df59e04f52817442c736cfd6dd5afad16a94136

            SHA512

            0ab515d79a74028397a1e8c41168bc0d5914f22bb24391c170cde47b6610fbae41407d09319e5789510c3975915e780793556a55c2351032864adbc81e47a405

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            5af86082f7f1bc14a4ade8c4cf30ba4c

            SHA1

            98ae4cfbcf764e19dcbf561eb5496a7b04ffc1b9

            SHA256

            63f286afed8387e423026af92030ec628380d26d64ded41f183a1da354699603

            SHA512

            24b5cab11d1325671b424f5cc3401648138bf0a3898941467bc38ae04ddac8d5b9ee51a64a338e50f5749114ef93c5e78c94143610643239f25c566565412b09

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            4717bb583ac8164f018fee2578366759

            SHA1

            6a0fe90e57ead93e7a3fc4045329f00144e58d7d

            SHA256

            312369cbb58c33061a550224abf906b0441a5bd358dee442aa78cfacc15b31aa

            SHA512

            0ef8c7914c32f75199db94e17e57f1a39f1d853a803225cd93377129d15180c823ae673925528af86a5c8653d27012fb8c3802553856e6f4a66a73ddab2b97d4

          • C:\Users\Admin\AppData\Local\Temp\Cab8596.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\Tar85B8.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/532-451-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/532-446-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/532-450-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/532-448-0x00000000002C0000-0x00000000002C1000-memory.dmp

            Filesize

            4KB

          • memory/892-438-0x00000000001C0000-0x00000000001CF000-memory.dmp

            Filesize

            60KB

          • memory/892-439-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/892-436-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB