Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    18-12-2024 06:33

General

  • Target

    fa77f1bad0b2fbe919e8b3e79d223192_JaffaCakes118.html

  • Size

    157KB

  • MD5

    fa77f1bad0b2fbe919e8b3e79d223192

  • SHA1

    bd7474dfd486366fe4a6dbe272478a5895849dac

  • SHA256

    94a8cf87515c57a31414a0a09a13e4540d7342ac9f231a97a0e0f4d939716584

  • SHA512

    0f5a434dfe1740f3f0a4989eb4cc7cd8f0ceecc3e59d791e4e79bec50ce63545f77347131f3c99e7ff665aec882247ad9e50e8d724ec1c6bfe725094a172a5ce

  • SSDEEP

    1536:i+RTtYd7Tp/fUvCyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:i0teBWCyfkMY+BES09JXAnyrZalI+YQ

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa77f1bad0b2fbe919e8b3e79d223192_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3008
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1284
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2488
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:2848
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:668677 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3012

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e1a7d0eb23b876656e49effbe714b02f

      SHA1

      7f65c5abdba4afcd3c94f797bbfdb641e17a116d

      SHA256

      ed4088a225e1760ea3d32100c8dbc0667f4b90520ff8aa2863958bb1670d6510

      SHA512

      9565e950a52b849bbc686944a9e38e3d59dad79beab67847da754183c2d9c9391a6719ef81fdc26d156c3c375bbf9fd66994800e68b1f4bd19e7abd2f0332ccd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e7fc37902a866c40ee205d7daeb0a782

      SHA1

      b6c2dfb4180816eea40b570077d061f42c8c5e3b

      SHA256

      d47f8ab56b4829e833893142526dd3edcb8bc2f43ca3619381edbfa589eff7b8

      SHA512

      0187751a09c369734443713f3923df02009680b9bf8011a7274569da1735ffc15ebbbc5b9c4cc853e1b3cef4536c5df169fc54dd7fda9321d2c90558b5c49dfe

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      89fad1eb99c9b08c75bc8756f9375d22

      SHA1

      75e84d4ef1eacf4527373859bacefa790613e95b

      SHA256

      244ccff84b078a17e5777946b3b2aa9ad4d7c6d806b11f61c0a8fd86c70450f3

      SHA512

      bd2fd805b262c64d56df6b266b648aa6dd750fad582e29b23b4cd9515e4dafdfdd82bb1beb426ebd6f112d54f47b518a27654a9f472ff6d0d3d41f465e22ec20

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f0e64807f96c9bcc80bda54e51eb4d22

      SHA1

      2c2e6f4739d9ce79a20ea47159327c50c0aaf799

      SHA256

      7385f129bc230822666b00743e8e0a121b7ec9e951650641e1e4842fe438f95b

      SHA512

      17cf3b99a605b8207e0cde2594cf6cbfeeef1eb70b95f21fbeff43444e322e46c05c2eae9f4fecb651fa2e047a6f8420f28b646c4816ddda863af02ffae48075

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8c01b2868eacb4dcf9615d83f09927e2

      SHA1

      4d9cdf4ba17c1b35fbd358f574c597ef9f0d2d0f

      SHA256

      818b2047a3d2db145f35e546cc6cde40ca12f5445d0ba19890a4899277fc9da4

      SHA512

      e5b96a12e5e28c75de21e9166db3ada30d72f5a0760c9f166218376e94ccd05c5b415809595d408b226bc1761d69771801a1eda241d579a9de2a5ac596f63687

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4c9e713040a5646ca49262e9629a9fdf

      SHA1

      e5dd36e18e69895a58799b7a728214717529ee8b

      SHA256

      3f357fef43e5f9e3e4fdabcb6d3ba1631e02f65bb07fe100881727255706c562

      SHA512

      33a6850de06726bac000620a79525f15370b5fd36d880022b42daf0c18237c31113196a647f9e3680e7a60a5854c780214595d137d168984eeb3eb935fe94959

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      ae6624109002efd85b9f2a1da8f0229c

      SHA1

      89b2b042fc1f5409f6621e8139455fb61277308d

      SHA256

      c4eef8a586a9a6599cc5b5453804e55088dcbe3b230e23b4fe68196d622cdb23

      SHA512

      cf902a3bb0bb74494e5e03374678dab7e42a79cd5da7127a4bfd761e197dec8ed89e1d1ec26ecc46fb150ca041827472f22ecc4581468a1e1bfb28b4cda06d3d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6e7e1378f7501f8708617f828c19fdaf

      SHA1

      6f7ae3b44e9a98d529e1a312c19736ad68398e1e

      SHA256

      462e59827d1b764beca7ebc2b422e396d88efcbe4af448c9d9c7794354bb6225

      SHA512

      9f67ecf655042eb77609167e0d184e60a4002ffafc5fc57c0d10e2ceec9193b210717204506bddabd96138628176a0070c7d5d875c64afee9d8ff45c297eca90

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      8006924df6e90edfe1e82ae1f6bb295d

      SHA1

      551019e3379158c08b68bcca1a7a4c641d43074e

      SHA256

      62ea15a9356563d05635c5ec37d023da3179d3edad62cb5f254593d72c48989e

      SHA512

      a66edc02f4f3ef99a9f5ea43e256ceca14b12cfaf0f0da7970b7d707e9073ddab422466103b112b8586e8ea88d70baee5328e87cc4dd5a58413b6ab0f8c345ac

    • C:\Users\Admin\AppData\Local\Temp\Cab9BB3.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar9C73.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \Users\Admin\AppData\Local\Temp\svchost.exe

      Filesize

      55KB

      MD5

      ff5e1f27193ce51eec318714ef038bef

      SHA1

      b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

      SHA256

      fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

      SHA512

      c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

    • memory/1284-440-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/1284-439-0x0000000000230000-0x000000000023F000-memory.dmp

      Filesize

      60KB

    • memory/1284-437-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2488-451-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/2488-448-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/2488-449-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB