ramnit | 3cd2500ce35373fa6acf8f5adf8d057af8889e9316c26cac35300f123295d18b

Analysis

max time kernel
136s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

002dfdbd5961d31a9a83688a63aa55e8_JaffaCakes118.html
Size

157KB
MD5

002dfdbd5961d31a9a83688a63aa55e8
SHA1

c1274a89a611e62407e9829a8e615f0dca0d8562
SHA256

3cd2500ce35373fa6acf8f5adf8d057af8889e9316c26cac35300f123295d18b
SHA512

f313c4032f48f653e4102341e2475454c7587b42395bb088268db77e4ac2238ac67d270b183cc6a22b511c1a1f77cb6e458bd8327c7110a0465a8d39ecb213e1
SSDEEP

1536:ihRTzA9Gl3aOBMbmhVyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:i3zPVyfkMY+BES09JXAnyrZalI+YQ

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

svchost.exeDesktopLayer.exe

pid process

2256 svchost.exe
1960 DesktopLayer.exe
Loads dropped DLL 2 IoCs

Processes:

IEXPLORE.EXEsvchost.exe

pid process

2532 IEXPLORE.EXE
2256 svchost.exe

pid	process
2256	svchost.exe
1960	DesktopLayer.exe

pid	process
2532	IEXPLORE.EXE
2256	svchost.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\svchost.exe	upx
behavioral1/memory/2256-485-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1960-493-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2256-494-0x0000000000230000-0x000000000023F000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxE7C0.tmp	svchost.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC0AB501-0395-11EF-8E71-FA8378BF1C4A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420274557"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

DesktopLayer.exe

pid process

1960 DesktopLayer.exe
1960 DesktopLayer.exe
1960 DesktopLayer.exe
1960 DesktopLayer.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

1732 iexplore.exe
1732 iexplore.exe

pid	process
1960	DesktopLayer.exe
1960	DesktopLayer.exe
1960	DesktopLayer.exe
1960	DesktopLayer.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1732	iexplore.exe
1732	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
1732	iexplore.exe
1732	iexplore.exe
1548	IEXPLORE.EXE
1548	IEXPLORE.EXE
1548	IEXPLORE.EXE
1548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

iexplore.exeIEXPLORE.EXEsvchost.exeDesktopLayer.exe

description	pid	process	target process
PID 1732 wrote to memory of 2532	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 2532	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 2532	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 2532	1732	iexplore.exe	IEXPLORE.EXE
PID 2532 wrote to memory of 2256	2532	IEXPLORE.EXE	svchost.exe
PID 2532 wrote to memory of 2256	2532	IEXPLORE.EXE	svchost.exe
PID 2532 wrote to memory of 2256	2532	IEXPLORE.EXE	svchost.exe
PID 2532 wrote to memory of 2256	2532	IEXPLORE.EXE	svchost.exe
PID 2256 wrote to memory of 1960	2256	svchost.exe	DesktopLayer.exe
PID 2256 wrote to memory of 1960	2256	svchost.exe	DesktopLayer.exe
PID 2256 wrote to memory of 1960	2256	svchost.exe	DesktopLayer.exe
PID 2256 wrote to memory of 1960	2256	svchost.exe	DesktopLayer.exe
PID 1960 wrote to memory of 1544	1960	DesktopLayer.exe	iexplore.exe
PID 1960 wrote to memory of 1544	1960	DesktopLayer.exe	iexplore.exe
PID 1960 wrote to memory of 1544	1960	DesktopLayer.exe	iexplore.exe
PID 1960 wrote to memory of 1544	1960	DesktopLayer.exe	iexplore.exe
PID 1732 wrote to memory of 1548	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1548	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1548	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1548	1732	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\002dfdbd5961d31a9a83688a63aa55e8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
2⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2256

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1544

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:472069 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
676331f1a7c04ff11ab62cc71902245e

SHA1
4ab167c0c5461656e21c4181f2e891b488c1afcf

SHA256
ccb5230bd53dc33658cd16d3a48c0ecdd488c04c95e8a376660723fb5ff69bf6

SHA512
6b0ad7063f1afe24e4aa45ed2839037f1615cca2790f8ad96f58f7cbea6e2e63fa057d4c8aaf7ab925c0bfb44b73aa2b3a5d2416a48d611c4077d60982292aec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0399c94feec80496a4be97ddcbd03b45

SHA1
8eb801c3ebc345ac89c5e2c4e8062eaadb49c567

SHA256
63cd6ee69010d3ed3757cf02cebcc2c2f44b1eb22ce12041b2706376a810597b

SHA512
bdf81bdb847f75a509f80541c855a81f82947e0c72783feb7caf40841795101f2eabbfb02ecc069376f8af9f0f4f885d84215d338ca30922342d44b7bf31c56f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
634895bf9c35144078345a08059f2f73

SHA1
a24de129780cd227f22f6de66d2af5885d06e505

SHA256
64508e5cfc50642defcba78319273d49c44648ae2468def1ea354a476e6ab825

SHA512
33ad26807cde8274bea86acbb7003279147a05e94f40e15d26c6be0a0accf3cdb6755b2d8cc3084033f704e27fffa18738c5a89089e3384f9223a740bc684b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
598c9d21b0fe477e5fb117dc73d1ad77

SHA1
11b7cbe8ab84d65ded64dc5fa30d4918fdd4e19b

SHA256
792e511259b3935a3e1a8f2277ee6c8fa732b5b23eed6986a44a80ac4cb5cd5a

SHA512
8b4ac28e7623256eb7452a28f2ace6699bc6c5d58e5804c775913414719507e5a57f58d31efbaa6b1beb2a75c160197c549ab662ab11a215f67d7f3bf47f3842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b5f28ddc0b63065704df55815c3cbf61

SHA1
886c512484a33c99b4f40909924ceef9f218199e

SHA256
9c7d6414f2ed5a3961a0c3ce21eb97dc66c022e38655def5b50ee5c8a91253e9

SHA512
cf151727e5a5f351e0aca66800bb96246303952f293cbc874dd04c161759c40b91350af4ee731c654f971ad42f232f1360908aa7c22332693c8d379acb91de36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
14ed819a1021fde6e71091a4b449621b

SHA1
06d4020cb1fc90f6b6abbb674c483751adfba231

SHA256
f9ec64a1f8aa661ab4c67ea9057a4c72507f9a61d88b5e34af29d7add373f22e

SHA512
2ecd133abba432b090a9ba14eb565e7f5b84f24221648e5f4b554184d6ca033d93687890740a1e8ddc31e7b7d1251f2a52916e80b444e5cbd8ccefc5090877ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
359b56073a588bc395a871308509d0c6

SHA1
4c928cecce8d658cdd64b3b8d40b0827733467bf

SHA256
c0ed9e7f4f66741d0841fd73218114f46c5fff5fe142a29d518c8b0522c5bcbe

SHA512
cce2701d90cf69920c4819751abcb35b188a4c4f9a23400a8e09ccde0d06cfb33bea0632398432cac97b982743909bfffacb1d94cc21ff677c5b45b60142a457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2900b1191be51530aac7cdfa8c758968

SHA1
f79934832e4798d22c74e35b01be9c6fbc3a8cc5

SHA256
924db615d182cad9adad89451d1fdeec8966089a6b33f88f30b76ad140469a64

SHA512
3cd94617116a12e656c44e5c2650f1a70a9d6daedf6e2e52cc445afc6945033c535b3c2d66240ce67f0ec0186e7729acc665f429970615eb59dd62ca1430fbac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b60319ce7d920a9ab48cf58069b158c2

SHA1
7bb1f1dded3b901cc46056317c5b87e95a48e1b4

SHA256
861f89210efd3d8cbc6098886544ad3c30ffc771bb981b049ccdfe94b939c8d2

SHA512
a1c2609f7c9bf21a131592a9dedb062228983fe3ecdb8ab6a2cdd4a10abd89bf0643ab5e92596d18f2c221f65fb251a7bff4ba2cece4bcd61ac14c165206d44b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDCD.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1960-493-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1960-492-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2256-485-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2256-494-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2256-495-0x00000000002D0000-0x00000000002FE000-memory.dmp

Filesize
184KB

Download