Analysis

  • max time kernel
    134s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2024, 04:41

General

  • Target

    7bcd9f2c6a2709ab2cff279e2942047a_JaffaCakes118.dll

  • Size

    352KB

  • MD5

    7bcd9f2c6a2709ab2cff279e2942047a

  • SHA1

    214473ce7a0eb1cbda087f56598cb0d3998f6717

  • SHA256

    c58f710dae497c8f686c66372a5b311e9a266b3d88a7d195ee694b2517ccd2eb

  • SHA512

    4263aec369c19b21e987948e7f1aae4ffc1df92078cc1d155fe04402d2a323ffc10ecf33a19b66b32d5df7c8df2fc41b9aae1e07b977fadb97a42874000eeb5d

  • SSDEEP

    6144:LqNwDq2Po2/K2uA4MXW1wShvmZ79ylRFDwGLVEF2UW+zS317K:Igqko2i2uAbW/hvA79CCGLXb31O

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bcd9f2c6a2709ab2cff279e2942047a_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bcd9f2c6a2709ab2cff279e2942047a_JaffaCakes118.dll,#1
      2⤵
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2076
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:4060
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:560
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:3108
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 204
                6⤵
                • Program crash
                PID:744
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2684
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:17410 /prefetch:2
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2252
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              PID:5008
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3108 -ip 3108
      1⤵
        PID:2028

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              471B

              MD5

              3c368a68cd68a8dbb557088be01b35c7

              SHA1

              44d06c93fecdb6bd5dbd84e565b68d4f95be42a1

              SHA256

              6a1c84b1e2ae6a619c05fbc48f3441b0421ebab39aef41a3ebd22f0eb005143b

              SHA512

              3d19c390990bb1d1a41060a36574ec856e2cb3ddbbf226c837ba4aa75c8c32b004e27b3cea29805558fd02a84a0889df95e0b71a64c15f12621173611bab8157

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

              Filesize

              404B

              MD5

              ec7cea8a41c1fbc1b23f367bbcb26481

              SHA1

              5544f9fc33035226493a7d57decf82b00a8af852

              SHA256

              03ddb6f2782a1e62411adcef9789cc332c7d19e347b071e45d425d9d223bb75e

              SHA512

              a632d59460c12ddbcb34329b3e08b2fc8cd8a33c9227adc543721024e0219cbdcbc425bbbb454c10538bf842227ba1d0b7b4dead9da4169a406996e85466d459

            • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver5C7.tmp

              Filesize

              15KB

              MD5

              1a545d0052b581fbb2ab4c52133846bc

              SHA1

              62f3266a9b9925cd6d98658b92adec673cbe3dd3

              SHA256

              557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

              SHA512

              bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8R55UT9S\suggestions[1].en-US

              Filesize

              17KB

              MD5

              5a34cb996293fde2cb7a4ac89587393a

              SHA1

              3c96c993500690d1a77873cd62bc639b3a10653f

              SHA256

              c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

              SHA512

              e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

            • C:\Users\Admin\AppData\Local\Temp\java_install_reg.log

              Filesize

              352B

              MD5

              fa86a1c7c1862032c44f372104706097

              SHA1

              ca99939ad6c04d42ffb1efd2e9607487f7cf828f

              SHA256

              dc8225886f9b2ce03e8156ac85dcb24d1b54d0384aa1f268886f2b89369bae02

              SHA512

              ce27bb2ca46b83aed663b7d2d222b3cb1530cef9e2947aa9747eb7231dbc73364dcab9e95e97cba6be6564b430e61a75a39b20bf45f97a8774b765b5c8a54901

            • C:\Windows\SysWOW64\rundll32mgr.exe

              Filesize

              119KB

              MD5

              b313c611c4280feba76564194b05c1eb

              SHA1

              16d9cbab9fb369ddcd6f6e33cdaf977fe3d34c8c

              SHA256

              bd7b3cb1c8d032fe5dddbe74ce0cba8df770b7545e550f6bf216ab2cdd4ff87f

              SHA512

              691d9d8f27e83df242216087362f45d35e7387ec56169bd9af5b9309838be70c5c042fe6bc9c0152db870696df0a0e4f369950dd9d18c65403c72d8293f74f0b

            • memory/560-44-0x0000000000070000-0x0000000000071000-memory.dmp

              Filesize

              4KB

            • memory/560-43-0x0000000077652000-0x0000000077653000-memory.dmp

              Filesize

              4KB

            • memory/560-47-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/560-46-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/560-45-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/560-36-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/560-38-0x0000000077652000-0x0000000077653000-memory.dmp

              Filesize

              4KB

            • memory/560-37-0x0000000000060000-0x0000000000061000-memory.dmp

              Filesize

              4KB

            • memory/2076-0-0x000000006D6D0000-0x000000006D72A000-memory.dmp

              Filesize

              360KB

            • memory/3108-41-0x0000000000F70000-0x0000000000F71000-memory.dmp

              Filesize

              4KB

            • memory/3108-40-0x0000000000F90000-0x0000000000F91000-memory.dmp

              Filesize

              4KB

            • memory/4060-12-0x00000000001B0000-0x00000000001B1000-memory.dmp

              Filesize

              4KB

            • memory/4060-8-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4060-9-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4060-15-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4060-11-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4060-14-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4060-13-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4060-7-0x0000000000400000-0x0000000000421000-memory.dmp

              Filesize

              132KB

            • memory/4060-4-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB