Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 21:46
General
-
Target
90d44862fd7a2e05f2511988ff360d5f_JaffaCakes118.dll
-
Size
316KB
-
MD5
90d44862fd7a2e05f2511988ff360d5f
-
SHA1
168ef5a541e3a90233bc896a8910d760e47f82e7
-
SHA256
a5dda4343a9c554dfedc734a79229d37288a850ef1217051069572162ed4d7c9
-
SHA512
f20cf7257a152e9f821ee0c2b73f10ac9cc9d4db868f51ac7604296b7cd8df232d521fd8df1614f741e368867d5e8d83b0fcb5b379c884b7f5ae384c21e13ef8
-
SSDEEP
6144:O5+QAs8Yqz+CLetk43n6JEaWeuk1i9QsjbWN1e6SKT:ZQAs8YJtksn6J3W5k1iPY1bSKT
Malware Config
Signatures
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Ramnit family
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 50 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\90d44862fd7a2e05f2511988ff360d5f_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\90d44862fd7a2e05f2511988ff360d5f_JaffaCakes118.dll2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 2046⤵
- Program crash
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3860 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3960 -ip 39601⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD57fecd001d472e28495336306d3e0b570
SHA17dabf5687a11d1d8f92f8ffd348fb73bf077e960
SHA256d3b1b54dfa02ea5cf017cd692023d382defa55e40749816bbddcc3e8ef5e9bff
SHA5125255e2e7897f3abc246464dacea7d32b54a8bdb88806e9d0f54a3d23e76074e2a88adaa35789c32b68d0ca8d6f67726c9ceec31597f3b05628b29cd52af613db
-
Filesize
404B
MD5f2f60849a7654d06f39f8fe17dac2704
SHA161f4ff55fab840d3ca2fecd26d07dd47a2703dcc
SHA25685344a3f411ddb77c0f89f4c958480f2d174b0cfb912c773c1d206cb27cc24b0
SHA512a3818cc4c2b3a34b0efa8106936ca832bbf2a294841910ba87d7acba6184322493dfa520d1985361dcea7f06daa6828625673eda3301ea498fb825a2e344d0ed
-
Filesize
404B
MD57e86c4dbc2f0670062e979da08bdcfcb
SHA18abee19aa1d4f2894239afedf82edfa061bf740f
SHA256c645fd284db9e8d2020a6ee14507cd7467fd4956bc8a3a4c4088f57b350f434a
SHA512c99eae873bc0dbd0fdbb22c6fb287a9fc74db25f913eb62e52cf82c0c36b6433d31a4e6ec6ee32fa1da916c94b08c7e5e42c2f1021b6418ea4dc03113f8c80b3
-
Filesize
3KB
MD523ab2cc5656d325eecc9e4d70055d5b4
SHA19e1d8d549d955a2bd2ba8b15e0821ead3b93a2b4
SHA2563327fe9e792a29ad30d9f30c076b79fd539736f767bb56cbfe4cacb9726c0e10
SHA512bac6034cadcc5904da2694f2ae3a04b854d81dab7e67172401876deea262d0af4aa432b5721e084979475a02b0d66f2ce805193973e49a61144a75a24539a60f
-
Filesize
5KB
MD52fbbc006b3c88980f164cd4696766a52
SHA1a7b3758135bd6a0a4d569733ac6973b7c6b44c62
SHA256019ff4dbff20be1ad85a8a035985159ea65292e561599aaf66b897b962ed2d62
SHA512141e3ebc0dc60b1fec55803996f2fa59e419994cfacf393df03fd63489ddc71ee37e59c5cc388442c9b61e4239199df8f78dd233080e0296ebade33f6a5ac925
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
59KB
MD50e0f0ae845d89c22bb6385f64a6b85fd
SHA10f3f1e7f18ab81572c5ce938d3880d4a5d7100ac
SHA2565a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd
SHA512baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
4KB