Analysis

  • max time kernel
    129s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11-12-2024 12:08

General

  • Target

    e163decac2ff89c3201d10c13efb2d6b_JaffaCakes118.html

  • Size

    159KB

  • MD5

    e163decac2ff89c3201d10c13efb2d6b

  • SHA1

    b325300c1ab76a21e553a597add45ed71f3adf55

  • SHA256

    d65167388f9f59416843c325444a6758a948d42af8125434f501ee38f4be7d19

  • SHA512

    ca9e0e58676925c47675fb0580fff1ca41080320188abd6a3ab570592b71a70aa2e60bd68f42e953113e6e5376421c155fc6ae63457dfb48af3cac533d4e3404

  • SSDEEP

    1536:ipRTgfh3J09gM5ZmyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:iPoJ0zmyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e163decac2ff89c3201d10c13efb2d6b_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1876
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1908
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:760
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275471 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1680

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8a116c544cfd70ebef552bce18439e1b

      SHA1

      38cb54159b506f94f82a3b108f4bf9e91d18244d

      SHA256

      a982ff90459a12f544a80b22c6cbd165455daea7915fdafb95ec1ef81da38f4d

      SHA512

      834a818a1a5dffecf4b911840b1fafcb482f2514c93117468ba3206f3ac36cdb3e234660ac6564faedcb28c7fe97baa0f0e9784250d191b9790e2e99409f54b5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      578c4dd4b4adb643c7cc94a59ec7d7c6

      SHA1

      47d3712d97d4f886831196f97f1e3c73293d2df3

      SHA256

      5c82adc62bb07c926d9a26b6762f5bbdc7732e14c5ca5aff29f3bdfebad0359e

      SHA512

      e6b9aa8cbe560de2572ea58614148de2b664ef7b732221ccdc414194b50d1f4e69e18a7dd1f03a58e02077efce1068d3885585d5d680f04ea0e43e9a83615706

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a9378190bb3d3dd88cdb5ce38ad16de0

      SHA1

      01720c7099533a25b4fc70dca3c7fcccac2beec6

      SHA256

      0e5fc900ef869d806b41e9287b219727a2a53f6fced25e4c4570144e7a65b61c

      SHA512

      c20048db6c4ee8c24688a12fadda24ce8cd5a59fe1516d6002c862fda8d098d9971a404b5f5055dd4542322fdcd255d2358f5fd42e89385ad31a118b77c0188a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f6c88b3171e0e2f4cbad2672c9c5331d

      SHA1

      4f6595c22f97b6e3b088d5b472f90c225b256d0e

      SHA256

      a5941744103d13cd383ef0f0c35d0ecac6e0fe1cc67871c5274f306c387194c4

      SHA512

      72b8a19edf97508b0616790072b34ff1298d5cd9e88c2ea9e7e46bb33fb8bdee72ef5e7701767bfcf1cfba83e446b9c47037f6a9b2659dbb6af6a6aa0d7eae5a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      0cf317eb0ebebfb53321a7b3e817f463

      SHA1

      d2eeb731bb5ed8886254a0a170fd0ac54ab4db7e

      SHA256

      dc3e5a5b4b2e163c5bdfb2f3f1a17df2b1f7144e2b8c56150010f5521399528a

      SHA512

      2156b8530d5701026015369d491fb646252b5c483b778c7b50f0947bd09a4ac07222c58ffd172710c6afd0b0cdc359cbffa80e0bb3aa43443cdc1b3ba01a1bfd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      998c846091b9fbc772df2db3d5d4c222

      SHA1

      1af91341473408050ca7ede475334089b0d47e50

      SHA256

      06785ad4e317b4b7cc628da1679e399f3a2e8f82ca9396e1a9aa47e89d27b231

      SHA512

      153008da7a5ebd9af86fe69be58138fe877fd8800f6244697b9ee65a9f0c741927e2c821d4140036c5d160c75c18c77e455c176c4f44e1bf7b565a7bd8e3274c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      37f695e3b19c0c590a08ef544b2f1a2b

      SHA1

      ceb757f168b0455318100463b4e068171933cc8a

      SHA256

      b8ead42e172b782a03ed72bfd08a76c83fd71779b6289c591b29107bf5736240

      SHA512

      38fdde1fd961bb9e1c983a04b942a237d93f2bb4b6c46af1c3a2fdd53df2f3dcdb812f0afdf5b2a70235dc473a66fe6802d6c121cdc855f7e38c593bdd235c41

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bd8a0d84d9f0d26144bd6da4def78f58

      SHA1

      190e65012f6dfe860ebc31ec2de81a37c6b9d295

      SHA256

      50c6e6a9f224b4be741464845c480158382363a17a070f9e58c8d38ff37d3203

      SHA512

      a128a91a8fc5bd440a96746ea667a4f0581d40571adee7baae7d105456527e7204443813db6408bc2cadb809dda10ea5dc5d6c334ec57e7910d3e5d6f8f8b306

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      01d4cea9792895b972c32747cea34b47

      SHA1

      832bd5424a64d5040e139cef4433416b49fa5942

      SHA256

      6027eae1791908cf95de962088378f12f2258afc09a912efc738519a93522cd4

      SHA512

      ea704ded08582e0f3d1b043dd13eca52f9b728306cc4e9df150af1bcc0dad30081b7c6957f08505128ad2658ff27257f262fc8c6a05574029b26a3288a7ef594

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8ab8ad95ce848ccfaf7ba2dbaf5dcf26

      SHA1

      a6c519e00360cf531718d170fcb88c6fde7a12bc

      SHA256

      c5e91b3aa072d472b36ff816a4e3ef07e7331d0c0a18981485e9074c1c8f0148

      SHA512

      34d324cdc7b22bac9f7661ab53c2bf4a4de21804019defbfffb8a8096d06d672e8cebda20fbc866785ef534aef0f1ce5892add03edad31e15f8a1636c9ea8e4a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      804707ed3f6f13dd390f23360f637cef

      SHA1

      0d7cc083dfb91d49835d4f1f17f6401d26ae67fb

      SHA256

      be45389df3c023b4bcde7db9b5c5346f0b991509779a40414bc8970f54faf0a1

      SHA512

      80266700f60f6eee0353c243b48bf2c75aef3f699d870bd85480d20585fb5fef28dcbf2612866d52906d2e3176b8a212e507d88cf0daf73c875b4c9c3351d35d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d30b132c53b0dfdef8922a03b8c84b24

      SHA1

      6ac8e85be262af7780afc192df0313a2a866bd6f

      SHA256

      14348feb498ee7b1bce834e37dda08a098b309dc9c80a77a5daeb4ee631ce967

      SHA512

      d2dabb29793424fdd898caaf3da286294bce58daa973dc2e0a8dab4321de68cca24f174330ae8084ece5e342ea1c3931b8cf9dea1a8b717062b0fe028f50aa2c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      552056a6289658b5c295bcb7d319761b

      SHA1

      d8949927694d184d7ea14d8634d8c3c21bd5c743

      SHA256

      21dd91882eadd2ad8fa655bbe6c7c00de5f662b91045f493a1c1e46dd3b8014b

      SHA512

      d81ce138276ed3c272b712078845af3692cba1d0d41cd430c401b066bd1910200d0bd5f942590bea6654fa003b83509726e4d39f185f084380ffbb18ce9a9efc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      de02172d9f0ec44d47f9ce8bfd89a795

      SHA1

      9a2929dbd549473759a9a55a19247241644ccdb2

      SHA256

      d37d74850878e7df7786b7a7ff2d1d4342e60ed0735f475a37fd562236ff5bf6

      SHA512

      85551d152a034f0c5a5e5f7427d2b91128b9c00266bffd06e54714c41f1653658b43a55b54d4ac8d740540c824bffa3e05b3c42efcf708b5f05e40df69ffe493

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      830a1f35a66a470d82943d5dc2317f91

      SHA1

      a9c2edb2beecc5223f0e023bd8e31ce70f2fd10a

      SHA256

      18d0fd843e961e4b2a087af2eff6d752d9a99af2f23a7086c16ebc7d3fce91d4

      SHA512

      d41e430b908919e722724ea7c2e37ac1b4fd9127c139307098473be5b20bad9f58a10db3a47b216f5b7539165e8682d5998e033a297df046f02d01fdb5b7306e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      958e8a915f8482c522bea81925c88820

      SHA1

      691a6bfda220fdf07f13432479947ff372ff3eee

      SHA256

      6bf91230f35bcbad73ec294856d9971d1d3813881c52c84a128979bcb7e98af1

      SHA512

      9722340954dbddc53e775c50e8a6cfcba205d0c6307f392fce3d22e53c12b5279237ef0a9591f3af908af9cf0df4fe26e5b5bb50df73307b02ad5d042baf1a45

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      da53b524c114f6dcd47ae9a76ad7f6ca

      SHA1

      770ba6c42e92752cee2be1aa8d4cb06ba5393738

      SHA256

      4b1750a77cdbc20403822b018d4286bc2c5f9f54d639ce47fbfd471646aeb188

      SHA512

      6daef8beb122bc440b69eb57e5876d1de390560cd6e72642c1fab2b2d2ee7a8decfb74e9612028342d587f7af4366d91787fb867ef331a999c98edbd6971080f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9bc84e531e9b38e537550d8fb5be06fd

      SHA1

      1edee705a4104f8a43c7e650ba86e4ff0e97ddf8

      SHA256

      6b4eafaba5d2196ae7f39f1f978882e7d40e948b27b96c4d91b502716a4b2667

      SHA512

      2d2340d136f3b62367f47b5ae7ebc2de37f78ed91bfdc07463c8b5d47cec4e927c108a6d3f9ffc59ce87bcb154d0df5f257c7fa0b8b122e22c21997358efdddb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      62ee256afe21fe9d161322ec924dcf98

      SHA1

      3de72b289e49cec324b895eb3bd34b6d98621edd

      SHA256

      2bcceb56165481265e3d311646d705f0c3868e177157fbc878a07b36c496b939

      SHA512

      ed3e02e33371f00594a6e9e2e65d95e21711044347e5adbeeb61cb2e6f75c52ecd25206db3f347bcc326158f428654314b80b23115f2b3855c85ce565145db0a

    • C:\Users\Admin\AppData\Local\Temp\Cab6D65.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar6E14.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1876-444-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1876-441-0x00000000005C0000-0x00000000005EE000-memory.dmp

      Filesize

      184KB

    • memory/1876-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1876-435-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/1876-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1908-449-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1908-450-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1908-447-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB