Analysis

  • max time kernel
    95s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-12-2024 05:11

General

  • Target

    f7772975a5360f3396bc2d6a1c2cb674_JaffaCakes118.dll

  • Size

    948KB

  • MD5

    f7772975a5360f3396bc2d6a1c2cb674

  • SHA1

    4d69261a02bff2339b2a7fd976808b4d20f07fdd

  • SHA256

    acc944d726c83004ade87e78f6629765eddeaee972de9b0f69bcf9a6cff1330b

  • SHA512

    1828b63ea08a1f1d2aeef3270ac1b08d6ae2d61cb163a7954ba2f5698a46e3b41b35f82102ba0bd5b8fce42d6c3442583e930c3729f85e77023530237c663d0a

  • SSDEEP

    24576:iD7xopx+JPLwUmQ9oXpnatxznRJz+9V/f0s:iZnPLwUmQ9+pwnRJ1s

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7772975a5360f3396bc2d6a1c2cb674_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f7772975a5360f3396bc2d6a1c2cb674_JaffaCakes118.dll,#1
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3312
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 10176
          4⤵
          • Program crash
          PID:3800
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3312 -ip 3312
    1⤵
      PID:2664

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\~TM8CAF.tmp

      Filesize

      1.6MB

      MD5

      4f3387277ccbd6d1f21ac5c07fe4ca68

      SHA1

      e16506f662dc92023bf82def1d621497c8ab5890

      SHA256

      767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

      SHA512

      9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

    • C:\Windows\SysWOW64\rundll32mgr.exe

      Filesize

      177KB

      MD5

      7c6cea630aa6eefcf1397099bf5711c4

      SHA1

      4d64f9f7134aa8d58cc68e7915b1cef6a022b4a2

      SHA256

      20e1b8ee76eba89db86650b0b13c9019b9f4c6d75165c5e1b9cbd1e9bd17ecbe

      SHA512

      b0136707456fd9a0fbf37e2f073f186dcc214ff75ea7ffd94dc528bed634e02d9656ae63a0f02434228bedb18982b85fcd57e8ae63c0ab466ad80c3de2a1ab4b

    • memory/1572-1-0x0000000010000000-0x00000000100EF000-memory.dmp

      Filesize

      956KB

    • memory/3312-5-0x00000000020F0000-0x000000000215C000-memory.dmp

      Filesize

      432KB

    • memory/3312-6-0x0000000000400000-0x000000000046C000-memory.dmp

      Filesize

      432KB

    • memory/3312-10-0x0000000000400000-0x000000000046C000-memory.dmp

      Filesize

      432KB

    • memory/3312-12-0x00000000020F0000-0x000000000215C000-memory.dmp

      Filesize

      432KB