Analysis

  • max time kernel
    129s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2024, 20:42

General

  • Target

    7ac771c5ec29976c9a44938981458d82_JaffaCakes118.html

  • Size

    157KB

  • MD5

    7ac771c5ec29976c9a44938981458d82

  • SHA1

    03deee49c506c826a3d68e71fd1258afdd795ab4

  • SHA256

    73a7731f8a2af0e532516f3fe50c02cae1b3d6884475c9fe331b2cf8dec77ec6

  • SHA512

    5c04d49c0a1a18946df391be47ad99828e8a516ab3949fd04542d24807e6274d67722f85b1785ed6d7072d900bcdcc2174b029c548e7e40c952e67484bac218c

  • SSDEEP

    1536:ihRT3OqUeslaLsVXdyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:i3selLIdyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ac771c5ec29976c9a44938981458d82_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2440
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:756
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1680
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:603146 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2988

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f89669292dbcad3e990769b59d1f1287

            SHA1

            0427846a67cc66036e43a906a2b3fa89b30fe694

            SHA256

            73e64fff52c9eb60bfee6c3e362cde2ba362acc357dee241b21b0da79f5853a8

            SHA512

            89f1e2ac1b1b21ccb79b4ad7ff4d79b55bb32d760f3c1b61f971f92787051091b25fdf5c661eb9bffc13d9ed8160441885b65d3d1f78b7cbbe96e6278278ae80

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            ff33ae7388fd685fcb7d17c80656dc6b

            SHA1

            64ecebc16f331e7d0b8594d42da2d2354fd6dd81

            SHA256

            0d0a51d42089bcfccbda064f7d8801f891ee278e31dcd0afb06a7e6daa1149e2

            SHA512

            05aa0b9907683eb041c3f96ac9b2f1afd2d93fb152d13a19318f958fa3907866b0aac436072b7df3a91f91b9d0072c895687c8c52292d04755b09a037b2a1400

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            63f41ad7a1699f1667b74288ebac270f

            SHA1

            5c5d11be230e809ccd81f66f353889a9ba971096

            SHA256

            569179c82b22ac72dc8e78654724bb8012226e7037c1de37696238958139ab8b

            SHA512

            8c232e7a103d90f31710850d8a6e036689a6397c83daa9ad1774fa5502100efd8f16b29939156cf9d26b8d5e9ee910e967c1d3f8b0845d719ee6e4d056aad2a9

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            a4ddea6c7804ecab9e87bfabb1b8bd1b

            SHA1

            6bcd4d56b2ee19452b097e1c7e28dc8ebaafaf8e

            SHA256

            09650edb9627c44d6a7c2e6bfc11ef39f663ede869a4e35c9c19341e13ac59b8

            SHA512

            02de362d33fec14ce5fd9d746f86d7864e821731e373bc32ce0493dcf870bd3e929192540d18f236e4789758927c92276c455399003fd564817c16d7bb39d15c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            cbec37f7b551d2e2162bb637a396bacf

            SHA1

            a9e5e073f82da147a9faa16385d8eb41db2783a9

            SHA256

            02ab4e4c18ae4e3e8214882ca97acd429b0011953aa8d26b6e706304b606b4a2

            SHA512

            a50eb3d74bcd244135e27623a33db7448646cf0b61f1f87ad37f52ff3030fb06d052affc99cc508a2dbfabe31adf5705ebae08070aaae8bd74e80ab7e5341077

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            7e38cb315c8e8e0473af764f9d496eb6

            SHA1

            4d6a961d299ed00c6c9c6c7fe887b973c930188e

            SHA256

            7d21034f6ea68477ea59a181c977d160646f5c2fa9359f7c99ca35e96021aae0

            SHA512

            8e2099c54a7415e60b986944ec130f77b4af9aaac725f9feee7358644f5351863f49192b505d5a34380fb01613abedb1a769f5d28602543f16de9402f351f5cf

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            cec685b148aca598e0dee1a2992704ed

            SHA1

            b537dd039a6c2710fc5a567e3d4f155c56ed778f

            SHA256

            6d1543c1b4f87097f60fa6170f87533dd4655d7de43ab68347abb32730ee6889

            SHA512

            b2c5017b2fdb8a04e98ecd0ac3852fc1e97506c514a256af835bf44a924c28884508e8fd107301e0868b68f9b3267505063e071010bac7af708fbe75c5dc9dd2

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c4e80fd164f58c944ae6a5e80a1c913c

            SHA1

            d2c25491f7f4e1bc8b8aa1618fd59b4b0045b4ba

            SHA256

            64797c50be85ffdb5541ec1c37b506b8f52c3a34394f6780601c978d3144a302

            SHA512

            75b3123e32e6bd9cf6c5a12894182748699a5d3c7a40691eabb4b6bc8827c86bf704a1d1f18f4fc8b0b47d2a7109f7a5cbb514595ea76166e793557df2897338

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            3075b58093573cee16b9a7d920f11e12

            SHA1

            2745801036e6af2a75ad39448891fca35de51049

            SHA256

            fec2aecde50b6527e48e3c6387b0f39c52a9a7dbb47e31437a09a3622e13d9d0

            SHA512

            7fbdbd64c26d9f3b231843f9a20be78bd95291a2a73900999eaf868e3176b1461a15d1abb4f740bf6184f1963a597c30ad5d2fa996ce58354d1690b568d28749

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e1f646c2c773ad33098f65b8073b5e43

            SHA1

            578d4f7a73be380ccfcf651bb70c5c35d7ece85b

            SHA256

            2df5323a75aa52051a337b1c55c2f3950cee3a428009aa9a073419d86fab0fc9

            SHA512

            82099ef98482e4fd022913c58032e66c89cc687ae925e362ad0ed2ebdf95f224db7df6beec28514f47430cd02b3ee8755778485df58d2f50df5e824742e8b08c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            5663f0df2030cdd29646f6e6a23bb503

            SHA1

            8bbfde63e2b71f6bd7ad7e57c1e5ef9e012c51fb

            SHA256

            5330d32c88e8fbed2e2a8ebde50df2d0b86d7ffc872117980ada55623ed7983e

            SHA512

            d35f3b8de4e243928f1934e61e104da398ceea8deb00d9df4c53cf62a194824bf7b65d4814897b92b68d884452928468f50a9e1d294e0979399f8908b75dc4d6

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            35c74b2cecc5908ef6552a75b2312213

            SHA1

            2d75d4a06d53e675a61faa1a45586874701dc869

            SHA256

            147e75c4c70fbe9ac8d450cbddc5bdc2e9056d9f6d1c8c1a4ea899e8515056bb

            SHA512

            686420190adf5e27bf39097cb86343db68579646d719d6a70210376491afb454ce1d0522732ee08dd101a2db4a13fe8f618ad97bbc479e10ae12b32a32b8ab07

          • C:\Users\Admin\AppData\Local\Temp\Cab2A2.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\Tar498.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \Users\Admin\AppData\Local\Temp\svchost.exe

            Filesize

            55KB

            MD5

            ff5e1f27193ce51eec318714ef038bef

            SHA1

            b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

            SHA256

            fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

            SHA512

            c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

          • memory/756-445-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/756-452-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/756-446-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/756-448-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/756-449-0x0000000000250000-0x0000000000251000-memory.dmp

            Filesize

            4KB

          • memory/756-450-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2440-444-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2440-437-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB

          • memory/2440-435-0x0000000000230000-0x000000000023F000-memory.dmp

            Filesize

            60KB

          • memory/2440-434-0x0000000000400000-0x000000000042E000-memory.dmp

            Filesize

            184KB