Analysis

  • max time kernel
    135s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2024, 20:04

General

  • Target

    7aa135b2f0cf495bb31234e8a989c5af_JaffaCakes118.html

  • Size

    157KB

  • MD5

    7aa135b2f0cf495bb31234e8a989c5af

  • SHA1

    720119fc127c35eef613baf79964e780f36db0e1

  • SHA256

    79a844c0ddad7b0d3983739ba3e65065dc9fce55fed4c83581e6ad3b83eb0f0e

  • SHA512

    a4431c928fdd03f85d8c99dc2f176165c0ae06466adc34ad13378d30bb50cf3f997d13209adaa0bda091f278616fddeca3d4c9563b387058fa1705eb02b33d4e

  • SSDEEP

    3072:irXF9AGd+9yfkMY+BES09JXAnyrZalI+YQ:izZ+IsMYod+X3oI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7aa135b2f0cf495bb31234e8a989c5af_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1692
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2468
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:472074 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1768

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            a52894908b3e5c448c5cd0d031b577ef

            SHA1

            f416e41cd7b5b80661d68fd3de917bad804c9792

            SHA256

            d357ad37dd6d9fd4ac38a0f064e424f82c983844217188ac221ab53e3fb814a9

            SHA512

            4b1b1a0df6a537d80089a4aeb3ae9a7c4c2eba2fe7eef7beb0b32fc343858aa1d24a9c8d344b4df33bc042114ade51e4bfd440745414445492dac6dc985dd0d7

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c6efeb1bd0b7736550ec4d194f209f82

            SHA1

            f0ad4f7bce8e99286ce63b3e2708346f2f2d6595

            SHA256

            449eda0596b4803d71a67e8c91d42da7c97f30eac4d59f03e28241d8bb5d3572

            SHA512

            0c7298c9fdb15f5c1c7852c211122e6089333ba642b52c36813e24ef3e49ea5d43a3e1d3df3e9c57c0b20e895e54bf1581e8079ab61a9312fd2d93140f97c307

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e5e0b6cbe8ab300fca33b2b5061418e1

            SHA1

            a8123f7a3cc67a252a53b8d78319e9a2ffdafe60

            SHA256

            a41a604689df9c2e52a29320ab46f8037f7d5eb48fbeff3b7fe0f199a93ee08a

            SHA512

            a883dcb4cbc40c4eb24928e261d72576a410c027e6adca9bd23987f5801cca532367e8dcb22e484923863a2b467a683f82920f730d02da2beb8b158de4c5cb6e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e23e6699483c65da59bca697d7b7b0ac

            SHA1

            6fb0bad4283531a2143758db925d7575d306b9d9

            SHA256

            297014ada52de5c28a223ebb7e7bc20ae3fb02f066a6c206bde95d82a4ad8fae

            SHA512

            5dfda79e8f1330240132dabefd9acb13876ad4344190d1932f2816e638629b4e9ccc10b3ffaea6df41dbfe04fd20181d0fbbfae45328f8c017805ddcab82d4b6

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            690813f03256bf7654d6e2d9acf40012

            SHA1

            cd6d61baa6ff95ea080087e5354f37ba9d3990ff

            SHA256

            25c58c1c61932969d1e253e395b8aa79252f6225c3af17ad1094b66a9e686c48

            SHA512

            b96697dca1dbc83b57416097a0f49b583fb8df5c40ec2df814d6699d0bb9c6d7c9ca31a03c95f7fa0050676c8269aa2fbf2b4f246a754c172a55c67b49e61123

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            3ab99eecb1a90bdead8f030b3bc7d021

            SHA1

            fcb3fdd33798d6d5106eb185e56d2a97e089b3e2

            SHA256

            7aa700851e0e178f736fe55d0921fe2ef4995756a9f76c751b1d0f04eac6b39a

            SHA512

            2818482d616f31b9459068a468c87bbfa6fddcf63442c3554e37e3f23384e93e7e0f88b6ac181c0d40907e09b499d278eab62b8d3341b84d5d09f31a6512790f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            a4de620e93a82ca12e6705c9191d5041

            SHA1

            ca2de025ef495df87d95f489de0498a5c0356c09

            SHA256

            de87813ca99f4db3749fae140e47d8e40b247c2d3d5327ab0aad92d59d399d46

            SHA512

            929ce3a280359b09c9d3954b233846d7ab6e9a66b916c4c04f0a6db0841a62b83a013d3ddcb98a334c92d663b5be28cc938611dd41ec4f77270e1303a073ebd0

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f3b27ea3559e0997b437e36096b19620

            SHA1

            fb1aeb5a45236cceee99757a1fb5d383486e06cb

            SHA256

            bdb05499058d1c6ff84dfde1fce6a499980329a3ec434b39013957227cd6973c

            SHA512

            bc0fd2e7990f6175323fc6400cf6029dfed0205e401ee3f795077a5d87a5a188876a08669b1ca966e8eaa61354f9b883cc8fa1463571476764c8efb614d979cc

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            26b8e81e68edf89a8ae1f3544eba5b2e

            SHA1

            226e2d9334273add39ba4393be97f5cdcec19058

            SHA256

            615a0f71cf736d63f996626969696267ee206626d020ffa7766d08fa14e30b2e

            SHA512

            25a1d4769618988a2720f1455e7eb9704bd1dc804a07b95d0bcc72124b93af40609a8de1274b2f9eba418d198c69cef724e3cf97fad66e9e5d755ae1b95dc70e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            2ce668e98f1d354d497b4d6cf0e3dd43

            SHA1

            bb23ef3aec6525fcdef26793b4713d30841aaef7

            SHA256

            8a3aa1e17317295f86829af528a73f0ee89bf1ffbadb180b63c43c8734f3c535

            SHA512

            1d3d30446901ddd4553a824911cd47e517f1968987ad56ddbaba0f51758771035c848499fb3f5b1573d4fea677894834f1132b4ffd920a54f337d373909db297

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            92b17edcfe809cac779d5e479da40534

            SHA1

            3feb88178a06d543e3002f84c56aa9b4e9e59b35

            SHA256

            78b08885476529e424979fa415434533df857fa75477d0402466e0f5f809684f

            SHA512

            f7db217fa2d6833c8495f6048dc60e3acd9de74a60e579ab6f8159975e18a68d56888e1f465ca87e9482afea4ec972bb6d2222f5e91ab4545f28dfbf3745f198

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            59f61d8e3ad77f397404d09fb06d8b0e

            SHA1

            660f63e0d70ec4554e84f366700beb05a1bfd842

            SHA256

            f1b9eb7897cbe0e8f6a7617c9b45f8766b3bc74d6c3cf7f349e483494dcaddef

            SHA512

            0af728e837c009ddb5a874d4660e0436fe5093fd1854f4de4e2e33229cd46f2db77cab715856c1a777375a7ca4372c680425ba71e2b2d1af8461cf1882b62116

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            64e83e7e6be02b73752a80aa630a7a0b

            SHA1

            34ce10b4c5abc259a59a804ed593256824b33b7e

            SHA256

            2b7efba6514e60b539994a77b60079fd5709bd2de64accca30fd820e83554060

            SHA512

            73e4084de671294b4636a08c7a0b6ce380590bf1ecf332019e30487424c1e01082b68cf3e4be6b8c46f76633b03105f1e6d988c7ad37546d2f3b8e00065861b0

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            43c5cf9cca9bf11018ac0a2a10d0a8b5

            SHA1

            122ed8abf48e60dd03c281b4fd38acf39ce771a7

            SHA256

            f2d36c2bcf6e03af342083497c1fb181c4746212740a9f822ce5755a7425790a

            SHA512

            226b0c180424dd50a7f263fd760c62e7c6818fb02a2ddb6448faaad686678969b4570f8eb5a7ece0eabe6ecd1bba28c849fc95596331ab411d41d7d5ad65615d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            020ea3b9c31ec4bbff4326b585c06063

            SHA1

            129810117bb7fb66f0a4460f7e3a62824c409f54

            SHA256

            626d1ba465c0e1b8000a603612cb3a792b06c60324fc0c03f3189c8f755157ad

            SHA512

            596d7c09514ffb8a5f340e941ca72fa643ad7aee12b2aae1e6868027cc0a8c329209d28042f6d5aef1e2db9c12218f471d089e10fe3dc8ccba50ba1deabdd8e2

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            344f5177b0b557eb7812adb0e3ee2816

            SHA1

            a30de745934261174a790cac31fdeb09f8384119

            SHA256

            25ff6de391c5979664caedc21d71c5afbcf86f51192e49e3a6a43bd379cc286a

            SHA512

            8dd02fd9294df387d33d2552e8486fdf2148daa5469feeb32a521f5f12862672a540a9d62aed8df128a7e9dfffc57464e80e010c23ad512d8ef116bf33487823

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            a7c685be94b89ba4f869bbf2f38c622f

            SHA1

            fa5111a4ea5687590e7caa7b3576d8cda6d4e840

            SHA256

            432bee20ca238908aea72f3e0468904eb47bbad26bbf3be47a6e7abfe7df051f

            SHA512

            1a5782f8cceec05cb8233dd697cd91f5b5dd912f901adbe1d898fa270e86d6b5b941728e65e358715611ee0a82aba7d0958d284000882f26a4026bf692607595

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            0fb47347b66167d9d0d6a60f0bb468cd

            SHA1

            a23976856914bb98c5dabebfa83298bf1051feb9

            SHA256

            80f89d846d70aa6e617c6a39774def64a09d1b2959a762662fc1e0227c5c5e61

            SHA512

            13f1014accec588e9360ba968b8d9fe8b05c53ca8fed2197d72ccde9454751e803042f1cd70de4b6bf12367014c600d2bd6d1661877be2e9f9a5495339d4fccd

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            2338852d5b4d4feeab36a0d125e48fed

            SHA1

            616e6899ad08c060713471803743288826530c9b

            SHA256

            c8b2e300be25bc14e78290345408a8419607147859a078430d0ff7d53fb02faf

            SHA512

            2cb202cdc3162e47e7c17b78e842c179bad268b1b891aa464aa02628ec4c2edf2be84244fbd93dc8e8f910eca2e7415f426d755ca922d398b96292ca8e80870d

          • C:\Users\Admin\AppData\Local\Temp\Cab5821.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\Tar593C.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/1692-445-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1692-444-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1692-451-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1692-449-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1692-447-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/1692-448-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

          • memory/2312-437-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2312-436-0x0000000000230000-0x000000000023F000-memory.dmp

            Filesize

            60KB

          • memory/2312-434-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB