Analysis

  • max time kernel
    138s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-12-2024 01:18

General

  • Target

    f6a0daa96bb44141a679b73ee5caa8a4_JaffaCakes118.html

  • Size

    155KB

  • MD5

    f6a0daa96bb44141a679b73ee5caa8a4

  • SHA1

    d1133748b2373156afa005426a1ba3d45cde3030

  • SHA256

    c9d85ec40f8917b2c60c371154b2d7780fa5c023e51fc3401e5836b0724f4279

  • SHA512

    53db909ed0edf3eca15edf3a5e1d8a3762b4c2f3e8051fa9773e66e9dc509f8a2c3a4ecb0530ab97c5555ab70b90b29aab4ec3cf1031b458db5168d0f58485dc

  • SSDEEP

    1536:iART8Fd+IbwJdkcyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:iqPYcyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f6a0daa96bb44141a679b73ee5caa8a4_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:840
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:992
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275471 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2356

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4d82dc799d1144212503380a2444e44f

      SHA1

      de2a5de8518288d8f1240dd3ec223eab7976b6a6

      SHA256

      2f7737f3c45a8d71a64beb14de89065cc0961429744a9401ebc89744a2eb9455

      SHA512

      7945e2e8a5d3dd1dd030c6ad17901cf0d629a5b20a0d6ee32a1ee22a729c304a2fc869a87cce75412dfc108910bdead5aeba04bdd2f9a19d61569732e510efe9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      961666bf879f35f4c849b80e525d07df

      SHA1

      e1f85b7aca6f1b2dc4899bcc5be769ac034d22c2

      SHA256

      32628fb0b2ca0ee868c6ba4943a4ba555352013b6a6c1c930b7b004d1e442dd8

      SHA512

      bc7a93386dbaf397cb4ae3e5ae5af4e7d453c6c0af7fc5739a72d42c41dd422bd5537b1de79f1c20f4a1993aae8178c88bbcab1e0bde87c053d2cc5e4ffad314

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c04f5c9445e94b56e03b82b5d45e18ec

      SHA1

      259cbcd06bedce59db13313ade75a80b17372ea8

      SHA256

      6d405532837a958e646fe178ef6e8cdc4b95bf829dcd944366fdff6c3b0c83b9

      SHA512

      fd650568cc8d31dd9e8c3c60c03cf6a8e77ac69480ca0fe4b88d6f5bfbdfedae66a7aa67e499ce8ef95acc9dc5e8328571488d2bf19573b7a5c711442cb0976e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      89c0560e1452fcf83dd4b06cd4ad5286

      SHA1

      550b87c149f19884799db1f360560f24d8af6746

      SHA256

      4970dc0fd1468112b823d3f0552ba7fba98cdbc6b4039b3ddb93f86bfeef0d8b

      SHA512

      80d0f22a71e34e915ea68c9dd93c1da1bdb4092359b2c34119e8ad4928bcc27962f1c1c3b1a1620347095ec9164409ffd0ce80611169f16052d10e547d5c1ce8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d601158ebbdc2a45635beb9796113db3

      SHA1

      501b97cea2c7461bf68c911640e09bbbb7c71083

      SHA256

      70c7c58df489a7ba1444c427bc22cbd9e04b366ec863551c2116832c5373debe

      SHA512

      7219e76fca241c737eda3253fc9ff274bf6f52acaf3c380cbc06821d5b78f5c8ed45dd8a0b70cda39388b5d453a04a222a8ef0b358d70d985db3af66d0670677

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1839c9793c371fa21124fe6f67691152

      SHA1

      c577a1ec848a8e094ad38025836cbaa85ff25adc

      SHA256

      910c57630795e4a55c7a4ce08d1efce73207c3818c411f477290c7b7b58fda4c

      SHA512

      9bdbdce1adf97a5ab976d7fc6193335e423b7b8b46105121262eb0f88b6345b3f1206ff6e7dc7ece4aefce790ef694090d563087a099c77d2f6e7c6840cd974b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e32e90152964d0dc4004941310d05241

      SHA1

      413e9164e1ab2fc379950450613fe28dd4c7e6de

      SHA256

      e255e28c3938d4895f60239cbc84d16c72cb672020db4758c6b0f264a4b490ae

      SHA512

      af7770dae2b5233b3f60701f5c357ec78897f5ec5a8e0b1c7f5a7dd60433c368b3be86f4cc7f767581c2a1fa9af4dc471ad5cf5f64fd951a9c86430150e3c478

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6af88b168dde570dcccafbb7b5220beb

      SHA1

      f3c6997691dbbb8cc30e0e2a9449ce3f8df2ecea

      SHA256

      3dff94a20365acc3d6052512364573113a7cf1aafa876f28ff1d842ed5c758ff

      SHA512

      3af0bca3189eb65c85fa0bc83893389b724a21441ebf6a3f584d0eba95cf468dda71b42bc967b51f0689870fd7356dd1f953f000bb27fe967de32a5031b690ea

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3fcf6dbabe4d4df3a97a870b2f2d55fa

      SHA1

      eedb461c7dd45e23ba00545405305923d4a50ecb

      SHA256

      b872819e87c482df635d01c266dc670e6a0aba70ceb4a9434cb26842f622e149

      SHA512

      835c73fac3b047d8061720e7198f03ef2af3bd3fef6d98139725109f072d6da0be06c14fcbc52e9f1fd59b84b678a0412b93535fde968c61fa91e6c112703906

    • C:\Users\Admin\AppData\Local\Temp\CabD29B.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarD399.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/840-434-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/840-436-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/840-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2068-444-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2068-446-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2068-448-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2068-447-0x00000000002C0000-0x00000000002C1000-memory.dmp

      Filesize

      4KB

    • memory/2068-450-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB