Analysis

  • max time kernel
    131s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-12-2024 08:28

General

  • Target

    f8277c368f0d2cfd8734e2c09804979e_JaffaCakes118.html

  • Size

    158KB

  • MD5

    f8277c368f0d2cfd8734e2c09804979e

  • SHA1

    624512e93d7951782d8b89f11692c4e30afeaaa9

  • SHA256

    28e934ff629dee2be9cb86d0780df35d3a6e0edfbd98f49fd8f9c98c4047e235

  • SHA512

    a00f2604f102f0c5d49ca9ad3ba8e3a83b0a595d1847c2f9b04c5b05dc549ebaae511aed2f8a0911f1e0976c4a9139e461c48f35c83ada550f3bdc949f69e9b1

  • SSDEEP

    1536:iSRT23rIjI0E4+jQyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:igVn6jQyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f8277c368f0d2cfd8734e2c09804979e_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2496
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2260
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1752
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:603146 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2332

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2f32d317c9528ba90dbc4a101facd46e

      SHA1

      5f5827bd8483aa0c3d753d7d547a1b6d275c049a

      SHA256

      a6adea262ecbd6cd3459b6a1ed25f0b67e2a186b450296c169f251724a64e4fe

      SHA512

      6eb9a7045f0005a90a4c29c6d8981161337fa0ba92ec32581b45d97f98836ff00055c7c4e9c11f0abbef99080157adf244eaf1eee2d0d1a9f51097b9f3e3ca2c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f0d698caddefe778889cb589ba048b86

      SHA1

      e274877eb6026242d83ae4126b1729d5e0cc283a

      SHA256

      b934f0059aedd013cee6453477b1fdd9be5f060f283e12755e386a464a57dc3e

      SHA512

      600d1d32505e0a48c962edaec95c0cec2a3607ad15d92b1e5ddb13524ea6dc599fcd62900794c3a061e7fdc7262c15ebdbadc5175585c0f363455aea5d1bd5a8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      04bb83a2a8e4e0b4c5637b733d037901

      SHA1

      6e4909b498e7a808d2545e31d4b1fb163ced7c4a

      SHA256

      92a916d56e924a5be8d609d480397e129d3d90d60136798549bed1831ea69d54

      SHA512

      e4819520639f704ad9e0e507dff657bf6c1bcf5a0df5808e2b1d84f485ad514d5cfc7dec6414ac54b7141e8eaebf3e0d4e08489fefdbc12d497f52cb0ddf79b9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      2fde448acdce361d51d67f7950c9476a

      SHA1

      27b26f997923e668aa0e37cb42465c1b8ebca02e

      SHA256

      02768ee34ba670d4a1fb2f3a24afb206c4e1bf181e89e80a5366f428f7622cc8

      SHA512

      f5445b1421a3cccb9cb4a01bbb14480bd67e353d953c063eb5f46be0bb6622d707a672975ddd79c4bc18d54f32a677ec55e88bef308e05023f5fe5db3a992d8f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3c74a6fdd6812d0dbb48bdc3edcb5a83

      SHA1

      ca5c5d77e0549f89259ce8f0622bd73a69cf09df

      SHA256

      65bc5b29998634ae79f5177e73b585e083a1b122f8508bbad0e7e18114384375

      SHA512

      5e89b94683e18c81453bbf3fff3276804f3341f249ba292c032ba0852aa7c82d45c65cbedab8820c3ddc11b5eb889455bcd60f4c69b78a3238c2526d1700d6f4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      153b421b484bea68850ad3f1e6415e33

      SHA1

      71ee371a1e626da9a4d61c8f33d9291e04d26ab4

      SHA256

      59a16b5bcbe763b8e8ca01dccfe588fd682f95f6a3274bf1c4379d748274d6e7

      SHA512

      b7afd7dba0b3c0a4e21b6e07d4458032c04c150f2c21c76a8872cb604bfe2606778ec2fc213fd1b4b9c19711b4e1615185d91675aa8406d0b9c166a0a9b06583

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      d545de82ae4d198c5184bef8778eeec4

      SHA1

      24496387e96f4f397051d68fe0f2258c053005ec

      SHA256

      bad9b5375890d18441c9d35f8df36b3e554933cd927eb9dab824ae224090700b

      SHA512

      e3710c57f950139b2398b0ee7e9bc4b37029012c757613b84574682681ce93798a0530c7d0012bd653f1bfcf1313fe11a5ffd3e4e34aac933ce4b52d95e280b7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      40f59df5883c768d1719394c43ac004b

      SHA1

      e9b7a6929754e80f909dbf2a14dcb77e90541f04

      SHA256

      ecf8d7069747bab2cb2a6d18863ad72d0d9be93a1cdb8adf5bbd5c0ea247d1fa

      SHA512

      fab9e45b0d856a8d56f0b76a96931aa65b0ec824fc0c91f4eb0afcbe5c19f231845bbde196e3b6a6ed120e7a4c7fb26f27dbd4a276e84c5bb4abb500add9b9e7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c52f9903e4ec901dd04c1e6eeb64e3f6

      SHA1

      510562dccaecbbcd808602c0ae9c11fa6d099cef

      SHA256

      2f20b977f0281847fdac30df31ec70095d7b12a6fadcd4a7916f1fb80a0d9fc3

      SHA512

      3e38808e950a2a6368825677917ac6f968c3f6ee36004596c66b051306af1ff8115eda5d0fda2c1d44bfb7a0ac5a550a00ff8b15acb030805260db12a2cf49e9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3f1d6bbfd64c4bcfeb47bfef17871eff

      SHA1

      a1831a93a2c28076c0bade9531ea8f040d9b61df

      SHA256

      e4c9281815620d62a7bccb408ef1e606fcde299a9807ec69b16598060c7c1135

      SHA512

      f19000122a048cd3504aea194e3c04a5764b74925c792d6734e0422697be4da9bff59508e25cd8b0acacf008fe3d1a0e35a57b86e20eb128cf8c2df833d7c1c3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4c655f372a15a4f85c97eff785131563

      SHA1

      d9a26930fdefa88f34591f570432e40f1b262c88

      SHA256

      5f4f0d337242d2caeb5937f85a4d17f953ca7e4e361314c9ecc4d13f9e80fd77

      SHA512

      1d8a50f63696ba3c57d72df75d894aae469634087322fed0a34b2453a513a146a43c98a660ec0ec7d198d805a08dbaf822e2d5cbb097689832d7b976bb13d682

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      36a402df385319f800469a8b1b5db7f2

      SHA1

      40e0055587b14e23fdd5ed4c3df5216f1afe51a9

      SHA256

      32ecda3d82867c203721c0346a8f18fc8fc852cf2fe9d94bd22eb8599fbe77a0

      SHA512

      9de2b27ebb5990f5030373af5234e271f29cc2d2c539ecaee35815e6a71dcdf8370fcaf2a4b7ff847d79136253f7b185f3c28c9b88d9c11faf372780a9ca4d8d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      04779879c25e3638d906583656aa7efb

      SHA1

      9e4e5eb3b88cbc15474992900c4dabb6c45dd323

      SHA256

      e08c917014c3a814027d2bd7558ad6db8bc767212cc5ec2dda69ed52fdd90564

      SHA512

      7b17efe4684773992743ca1194a09cbe5e1eb3c761207ca3d192daffb4717189955a2db4731e86de96770a257163ea03125ba3ee0257a1d22dc4b419cadc2c11

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      1da5103af4c52d517cb8739e6ec53080

      SHA1

      490c46a534937012489ae49c2b11c9541ac20d30

      SHA256

      aaf1fed91c88ab79e21c7fd55426e5bcd734f3937c9e6a5b374f92f4b9c50fd4

      SHA512

      29e79eabbc8e311ddb82fc0885c36e48ff5d45b859b89749ba6ab224e6f3b49ace9ed3c3e58b446c381dc528c06df27ab84284a30d9634f25a601ed4603dd826

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      0e479fcc61653610dc9746a2c7d9e59c

      SHA1

      7a54a396036e5d7ac4c555a824e97c68de5fb36c

      SHA256

      76209a6d37e05f125b33de60e95ae10c9ba003c486c4f8575b98fbe329799803

      SHA512

      6b7ad015fb5467ab84252dbb27a47197264e9e2d08d59d87c0279887cddb20e2807a4c151393b8327747caac2a8b672126aa9c36bde5b5a8bb20fcdf44d30f4a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      bba9ae1da7c2552b592bc38665a5b1cc

      SHA1

      f964ad3a8b29ea3a334ff496dea9481ecf341b8b

      SHA256

      535bef2de92f73b4abda68233d36a5313f61518426b858b282c803827105c7af

      SHA512

      7ea716de49bdfc28bffe192d5a017435ad070127d6053e95597c140a88094e0b6078aaec72247dacf2f62928606ab1984aa565388a43ff432181c643c47e50f4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f126c55c9f1fa820e7c71cf741540a87

      SHA1

      3446429bdb9eb37c5180ad869c886ed40ac526ad

      SHA256

      b3ab642a66edc2f15be4b9ce33bd0ee758d9533276018fb1da83de06775daebe

      SHA512

      6a7101ffa68bfbb65f61a218b79ce34f7bbad6674550797ab34d00a1b8f87e1e2df49b1bb2b3cb296b091426d97519d5c3789e41c99eef9488e789e907501bf5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3b3dfb5aafa0e711fa0abe1385bd8df8

      SHA1

      203e6aebcda876c36eba677a5846ac12bdb13911

      SHA256

      3ccb17a0044063fbcc9f1abd603ee43c940dba07a86930b671da9d7318c7f3fe

      SHA512

      dbf8a4cdb2914ded181dc3c1fffa869152cc44e050d819e13fe5e65e9115de7b5d9e988133c04563affa69f62c2b6cb1e02c910ac94b495af15c4f8386843fc7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b23f9e1ed2a59bbc4fc092041895a354

      SHA1

      d69a609ac8f2528a79f959a627ff713f2180cf9a

      SHA256

      6c23ac73e9da3a8c0be0ac07bb0186819003359d64eb67719a82bd8505d25cac

      SHA512

      e2b62bf10b2fe8dcc669ac70a38d1caeef53cbd3915799f18dda7e431e5bf41d569ae76488cdd6e4b85c20b5de9c6043749c9818e2f33232817c351c33cd7479

    • C:\Users\Admin\AppData\Local\Temp\CabC110.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarC180.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/2260-445-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2260-443-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/2496-435-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2496-436-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB