Analysis

  • max time kernel
    133s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2024 01:54

General

  • Target

    91e96b6f71fcddb6e41537a673bb99b6_JaffaCakes118.html

  • Size

    155KB

  • MD5

    91e96b6f71fcddb6e41537a673bb99b6

  • SHA1

    fb95e58ce3366ad050bc18524081e8f833f05731

  • SHA256

    1932f397ee3ec8e97a086024865b991398cb44925ce8c42eb54ecf30bb9f9218

  • SHA512

    a69f2fc00c74370e40f291dc6e17ac670e00f4824075dbc7a715acd6efc1edb185a86da581a507edefa23e3c1681db301436138225e840d466cf79f1f6a3a44f

  • SSDEEP

    1536:iXRT42y9ti6yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:i5Qti6yfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91e96b6f71fcddb6e41537a673bb99b6_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2364
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1036
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:537613 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2760

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4799bb81d59562a5ec86554648147959

      SHA1

      4cdf5fb4b61227e2dfa948d87961683acbd88fe8

      SHA256

      52ec83b4306a0ff4cfdba5c31fe9b98363744a20cc935e14b31b5a1b5960f0b2

      SHA512

      f4045298a8c168b4944777ec27d0a6df7b732bc09e44adf9012f78647c305bd7d3461ba747cfa57751b2ba24c3b616a401ef6a2640fef8f41d3797c7281e7d05

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b4bb8401c9afab9a830ec4e697cfaa04

      SHA1

      59cc37f15fa18977712fdd2424c840b407f8ca6c

      SHA256

      f3c63950edea0639f85c5f9ea0f9ab8ddadac43a58cd739a180881778b10eaed

      SHA512

      70d0f3a7b87ab3eaef13308b7d9a3d18274d7a0033af17f7268a8d2d200b826dfc0e2ac4ab7d0391492f49f78783e598929b77b9142a25bc9801316603b78e15

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7628e8b9b827120cd33448d36ab31af1

      SHA1

      a018398ae423762ee810415db9f499378f2c782f

      SHA256

      0dcd05f78ae5d7fe685be380f4a3008aef97b098cf998e1efa2d551b0a968635

      SHA512

      409f7feba89d4c17903e24d5b7e7a301b39973a0c07b319a4c62e70705f9eeec15c4d729c5a784713b38c5128264437e5d40e35431402516a424b830b5ed6529

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      87f5d27fa9125e548dcc8b20670773c2

      SHA1

      6dd6b077f93a94feac87937fabbbaf519be8b49f

      SHA256

      b32148714764315b598aff5bc8c2419e9b5ce9a21f9775f76d1e01bdc890104c

      SHA512

      8334451b1727f5249ac36facc8a03f5b9056ee4d14a9bf9d3c6da5e531fc67c30a831b68a1612445a79c04d29a37b62af16b1fca225444a5d6be9cf447570ff8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6b3f25a78b07b6c776403e6017eb7ece

      SHA1

      a23f721e7b889f4e06c4490652cc32c55cf0b026

      SHA256

      dc3e183d5bb407e30f90135cef3ff98c36422bd66e01a3ac4b9baf748f3d9b51

      SHA512

      c2e6b863a1bcede038d7c70410e55634ea9c85fcae1955fd43b49837d2290a138851ee5b16f8992622eb4c2a318082414e50057bf5c39b8bbe274392f36f8efd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      394ecee61ac357d34d0567d49d1165c4

      SHA1

      19c2504fd556b2adb337b33b217e030177061b2d

      SHA256

      2a2f895389a29075c46545146ded58dea9e00d1569a70548b60aa5c4c2e3fbaf

      SHA512

      8df3515168698015301fdf795576312468cc0cbd2a7597ead65f535acb5668f0835b50ad3cc78520b82e89f566564be1a1f8b09626d33550759bef6c216300b2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      cd3da14b04d4c6e917bee57a3078fca1

      SHA1

      b7055a564fb5a928f85eed62448214f0e7155a86

      SHA256

      cc035972794e3b38eac8901ded82ed626c896daadb5e8d4120dcd01e05e0781e

      SHA512

      b59010592a3f3adaf123c056df29fdc4bad64b2393dffc05d1851c2aa5cbcffc3475ababed1cfc99e31ee70a4f06c3f372c38fa9cd810bbc0cdb103750f78e31

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1c6a4cc9ab7b4b0101cc1ba909113c7b

      SHA1

      4cf7d9dcb6817b99147594d691a3bdc31087593b

      SHA256

      c26c14d12570617143dee3fca3260973b37e9b8a4ce4dbe8ba3cdd56c7190e37

      SHA512

      48f5b49535b5f5e4a34d48197891693ac3c9317c31fc249fc984ad61ade565dce64dd0fbe2c002a3f52f4f85a573ae2970264aeb12b72ef6f0362c7d885ece8c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      fd3fc3d7cc4be7590d06a7d419c0dfce

      SHA1

      07da1e28f16450f0a251b7f922ef116bfcda5886

      SHA256

      b0c9feb29b379d6e6b3992fc887220843f579b0fd0aad39c5a01fff53b17dee6

      SHA512

      5f8ba898a15ddeb7bd329de16bb67b4bd441377334241e0e5b12f17f49c65d1a62dc0a499f75693a83bf09180dafe6ebd6ca702a5052231f7ba65286977e98eb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      84a8ff8ea4a473f397121eed1a58b368

      SHA1

      20b6cd5aab4fc0bdd65204ac1366b608ef0d8e81

      SHA256

      3a499b3ff27882fa0141f229b458b1fd88677903bc2f2bfec50bb7ea89c1cca0

      SHA512

      082bb0f973aa3f72805883141515445b7add5bb17086ec4e025e5c28898161dac62fb964d523bd4675229544f82fc290b6249bc9e11fad79bc2c57578c0c26c5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f6334ee915dc711f295d0dfe23779093

      SHA1

      051ab20a99004f58e35bab681eb3c762a0526880

      SHA256

      7ecf7a2a41539ccb0d5f791d9d0e2d195825c518594af32bb0cf1804db235f63

      SHA512

      885620c037d9ae2ae3031eead790532ac73d617f0be14fd150634d83c837f2aabdc472a8beec5d55f601c64431773fe4a46fa0261ab3be6e5b4827efd105ef95

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7ba135bedaa80a9bb4924e08ff3c8458

      SHA1

      9769b23c954787f97d431ae93f984e3928e1256a

      SHA256

      6d3a786cd3479c0a8b44c9c7d5259125d7888f628e1065e8f84be5080070ad6d

      SHA512

      51d2248635093313207d984f1b951bd88c478ac98afeac0222629d7ec3a75ddce32e485dc5a00146acf6d485fc81b5ee690d67c987f9c1d99421a991ddb5e1f6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      79c9a5e201cefe1177aaea675de2e025

      SHA1

      0a00e00978f1f3e87a92a3f7eb82653645a44de8

      SHA256

      6bf23516c045bc24ca251c209231845b58337f317a42f8b3ad02385cd25c79cb

      SHA512

      9d53cd1ed9491e6b5d9c5242fe1e8fc6ae0e63dab95a08ba55be93d5bd097b2740eb93d82577b0b34281588f1fc6bf493770fd702a22a9c7c6925f04cbdad738

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8083b59948744056f126a46717737a5f

      SHA1

      0a4f6e5fb14448075a5ed3fcf915a62bbbd6dd48

      SHA256

      4194b7b0d8684413dabcea94f83f12a6085d17b33c35e5827055df7c3392b592

      SHA512

      3d3b14f4d6b76286b7593032eda2bfbdec2681d2c3fb8faa77c92f17c57be5ec8a30d1f696e4084d4b984e61cc537e75ee450d5ba46b0e5a79b35e23f152fe89

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      09a445af2b62f9f23c99915f7826915e

      SHA1

      fd2d0db66093447ee93de8f3dd48122865f96739

      SHA256

      c404b964f0180a6f764d8b632c063fc6549331f07cacfa5e14f475deadc7ede5

      SHA512

      8e10200930c93d45755c354fcd0af07cc9f303cacc39862a3f65317580349f72ade36c420b9ea9761e4cabe5a5b44a32adaf44f8352294b2f132b11e4ef3450a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9bf780d6055633b472505f189d58dad6

      SHA1

      7abaee2918c91ef15e56739771163cc3cc267148

      SHA256

      881c57ba7cb500aa009690bbd801760d977bdedc8865d60b1de8b2e172474ac3

      SHA512

      e936d98e62eac953525d2459c7231f94fbb116a8b5936a59c5a472408161fab2068c08f92a8b7db172adeaa1c121b4fe6372c9993060037a5870d5321e8b5618

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1bf2d2b6701f3e7247d71da2590d9dbb

      SHA1

      0fe2ffdf285e8136f897165ce5aa8534eefde35e

      SHA256

      8d18f1abfc6af1160e6699e0ae40673cc6766500ed48ec3cbe4a92ff55d5634e

      SHA512

      e89e458d586ac386f6eb9e34697287cbd9d899c7837fc8a0eb96776e3f44a8f488754ab2a4217450292fb1e48c577b8ce8843bdbb5ecbc4458ce0e4d405eca9f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      87d12b7f048d986f4235c27eb7ecd261

      SHA1

      fc2b5c5cfa10aa53c9eff7f7a3aa141a1cc5cbe8

      SHA256

      933e5a6f49761e9d32ca2c5af51aa175415f9ade6d7da2772a8ddf7b5164484d

      SHA512

      9749c224c3cb647eed5afe3bf8dfaa01b4d425358958cf805f0c32d3885788b0173be78832be949ea58ec576fa17806ed5135d1d38da97b4a7ec4329f089ac7d

    • C:\Users\Admin\AppData\Local\Temp\Cab5D6E.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar5E2C.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/2124-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2124-435-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/2124-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2364-448-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2364-447-0x00000000002C0000-0x00000000002C1000-memory.dmp

      Filesize

      4KB

    • memory/2364-449-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2364-444-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2364-446-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB