Analysis

  • max time kernel
    103s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2025, 17:40

General

  • Target

    JaffaCakes118_1c72367957ae0f222df760a6dc3dd540.dll

  • Size

    239KB

  • MD5

    1c72367957ae0f222df760a6dc3dd540

  • SHA1

    348efcfdfc50737007890d89be7bb7819b1a727e

  • SHA256

    37b2f911915b4612170cd6d0e60a6c82ec6cb375c4e309f5f788531d724a1470

  • SHA512

    dc966cee81dbaee76708abb21ea91889066fc8fd9c2b3ee0527110ba8c870fce6606727b2bf445ca5464cc9baf47933fc04a32e88e325a8e19009889ca23742b

  • SSDEEP

    6144:7gmoADlSUSWIlbuks3mGvnDpNohzjCULspwAz06:7BoADl+lbuk492ha8sq6

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c72367957ae0f222df760a6dc3dd540.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c72367957ae0f222df760a6dc3dd540.dll,#1
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:5384
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:116
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:116 CREDAT:17410 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4188

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0

          Filesize

          471B

          MD5

          db3f2e41632254f91f7e5e41942d8ff0

          SHA1

          7da106440ca2f41c46abf0c425b49bbce80a1cfb

          SHA256

          601e2bdca83d313ce5087a94b902e3a8237c1255e1221deeb40b3ae5c3a9d9d3

          SHA512

          0cb09d9c84a09722a83150f24caf27cd72f873f77e765b45ac00b177c895f095d9126aafbba60aa3c54b2d3acbee104aa5d0ad1942aca4038586a2242528fbfe

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9F6005AF34C7906F717D420F892FD6D0

          Filesize

          400B

          MD5

          5a41de996b6770373fe9dddae43ef472

          SHA1

          4b93ccb262fb0cee8b56fe050a404d2fd8ad6b1a

          SHA256

          c4454c3760d61bde8d4d97944a906555a8c380b642c8f35b39faebca84dbdce0

          SHA512

          196efd3752fbdb73a43b7f095f008680edf4a022a65dac37ad38fd7be29ece2a742b4ff21bd40e1424f7ca9394a5171d61bcbf76d59138d91571729cf693731c

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y7YZJB1D\suggestions[1].en-US

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • C:\Windows\SysWOW64\rundll32mgr.exe

          Filesize

          88KB

          MD5

          a61ea5f2325332c52bff5bce3d161336

          SHA1

          3a883b8241f5f2efaa76367240db800d78a0209c

          SHA256

          e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b

          SHA512

          fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5

        • memory/3052-1-0x0000000010000000-0x0000000010044000-memory.dmp

          Filesize

          272KB

        • memory/5384-12-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/5384-15-0x0000000000840000-0x0000000000841000-memory.dmp

          Filesize

          4KB

        • memory/5384-14-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/5384-16-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/5384-11-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/5384-9-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/5384-8-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/5384-7-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/5384-6-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/5384-13-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/5384-10-0x0000000000820000-0x0000000000821000-memory.dmp

          Filesize

          4KB

        • memory/5384-4-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB