ramnit | cda9c9aca0e268cf6fb15216892b61e490392ec76fc6217d8caf31a5243947b6

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bd30566d921700e443e9171075eb059_JaffaCakes118.html
Size

142KB
MD5

6bd30566d921700e443e9171075eb059
SHA1

0a375d032e4b14f75a3f32d45423d7cfdaaf5318
SHA256

cda9c9aca0e268cf6fb15216892b61e490392ec76fc6217d8caf31a5243947b6
SHA512

3ab9df10ad5d60e4d2cf11a59b36d3d225b8a9c4a407b0130814d0bbb4e10195ce7edf04721017434b29f664902814699452bba77828552998b0ae837f58c42c
SSDEEP

3072:S3MVCKjlgyfkMY+BES09JXAnyrZalI+YQ:S3MVC+sMYod+X3oI+YQ

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

svchost.exeDesktopLayer.exe

pid process

1936 svchost.exe
1672 DesktopLayer.exe
Loads dropped DLL 2 IoCs

Processes:

IEXPLORE.EXEsvchost.exe

pid process

2552 IEXPLORE.EXE
1936 svchost.exe

pid	process
1936	svchost.exe
1672	DesktopLayer.exe

pid	process
2552	IEXPLORE.EXE
1936	svchost.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\svchost.exe	upx
behavioral1/memory/1936-483-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1672-490-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/1672-494-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px5A41.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F00D3751-192F-11EF-B0F7-6EC840ECE01E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422649783"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

2328 iexplore.exe
2328 iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2328	iexplore.exe
2328	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2328	iexplore.exe
2328	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

iexplore.exeIEXPLORE.EXEsvchost.exe

description	pid	process	target process
PID 2328 wrote to memory of 2552	2328	iexplore.exe	IEXPLORE.EXE
PID 2328 wrote to memory of 2552	2328	iexplore.exe	IEXPLORE.EXE
PID 2328 wrote to memory of 2552	2328	iexplore.exe	IEXPLORE.EXE
PID 2328 wrote to memory of 2552	2328	iexplore.exe	IEXPLORE.EXE
PID 2552 wrote to memory of 1936	2552	IEXPLORE.EXE	svchost.exe
PID 2552 wrote to memory of 1936	2552	IEXPLORE.EXE	svchost.exe
PID 2552 wrote to memory of 1936	2552	IEXPLORE.EXE	svchost.exe
PID 2552 wrote to memory of 1936	2552	IEXPLORE.EXE	svchost.exe
PID 1936 wrote to memory of 1672	1936	svchost.exe	DesktopLayer.exe
PID 1936 wrote to memory of 1672	1936	svchost.exe	DesktopLayer.exe
PID 1936 wrote to memory of 1672	1936	svchost.exe	DesktopLayer.exe
PID 1936 wrote to memory of 1672	1936	svchost.exe	DesktopLayer.exe
PID 2328 wrote to memory of 2540	2328	iexplore.exe	IEXPLORE.EXE
PID 2328 wrote to memory of 2540	2328	iexplore.exe	IEXPLORE.EXE
PID 2328 wrote to memory of 2540	2328	iexplore.exe	IEXPLORE.EXE
PID 2328 wrote to memory of 2540	2328	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6bd30566d921700e443e9171075eb059_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
2⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1936

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
PID:1672

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1516

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:209935 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9ef92f3ced5012c54297b910a62fe2f3

SHA1
8f64ba652aca19ea780bedd8148ce22a6f938e52

SHA256
75f21570e316848e546281720b502d66ac1e0cb8b5eba3e75cd9f5b407b3baf2

SHA512
4676b510475007686a6e7f3ed1333459d27e34f881d40f09dbbc45b2e6bb11fa145f829eac4ae6e2814b5e193061acc65c8d0544f854f96b815d53314a56888b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b99ab7a0ddff19eee679d2007baf65fc

SHA1
4532ce49a74e94f38bf4f3ab7fedb9e8c6ba7da9

SHA256
18242143b20ea793d90fcd49e18a47976dce573e670bbc8ece26b908d6d330f1

SHA512
99157b174c79cd691d644a52c02006e3eb304876ab7321c8237887c0a25b35504abd333bd29bb439aa40d5f160a124d646c3b71a975eb8379a7b8112f7dee79a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ed6103e11467d40c90025031d79353c8

SHA1
392f6be10ac5a2d1180387e67bf4f60d9454c0d2

SHA256
871e6702d20b84338bebeee5a27427abee4e037314d4c2c4ae56a1ca54d54eb3

SHA512
377c8653b50c2eb379390622b8185b07effc025a5895b46bbbd3343179a0ee2293fc582b2b043394c481c3e477252b12cf6361ad477875221100424ef0c289db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
218e753c94b9b11fcf7b6851bc32589d

SHA1
074a539eb78404e6c4281f88ff0ee28dffc21065

SHA256
4748a8f5c70df41def28dbd743eeba331bfd198a6c1d6e16bad6fc91edf4bb95

SHA512
7175cc038d77383d00ae2cee088ea5000de6f502316aef439eba5db9e09c6090fe3067ce00c0fed0c7c35ab0dd43d51f1b41f756945f84acd8f46e040ab3ac65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2b8308f877672358bedb940a93c9f160

SHA1
c2c22fc73f4009e8c71b2ec0b3f2300a3c5434c4

SHA256
74571efd55f72232044059839372ac700e07497eed7a52b0948e20e907f25447

SHA512
78627f18b99ddff3406ec759266084263704409896e8401f0d782c416a74b7b74f8865f6fcfe386b3dc923e7b78c216cb49424011e9c6cdc22cc0b24291c03cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e4a2313de28ebaf90a82ca21cb490be4

SHA1
eff0c779a69993759f66612606819251024ce4a5

SHA256
45193d95d6b8e7408dd2f8ef2dc7784f6e0375ef41d09c1b1e3986e9c4f11236

SHA512
d936054ee29fc464adb99c02d16080cc374e3e6231a273997f08cd4625a5e3b055e4f6c9770d7b70dc276354f0eebfc406992da72c900bbee406d558c817cf11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8c4096f1c7529006813e53258e5a5ac6

SHA1
81fc650ab1486f96575973b43c1f8606975193dd

SHA256
2da3b9eeed26944d264a17c961ef5e2034ca2dd7a2aca3bdda0b55d38fa78be0

SHA512
75d294375b31a4ce1a5f8c825a0983148a9dc0fbf950cd190198f0620f2d70077873e983ce9de4665add4f6d3d9c737de04b503b080dbc0c785e25df40d8c037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e14942af98e32c2868650876ea319fe7

SHA1
35d4e752423945e4cd0aba0241da2aa2c9034bbb

SHA256
fb44744dd089f2c7db46d46043870b9887bb6516c16ee45b886d69ae5fe45d7f

SHA512
83f09fb0b2a3dd96f4939d08d455c1da2d5202d03753d3602b21faa57c1ceedf45ecca97ee3f24b99c57e924e7e575b29b4414a955b8d8b0973a9978ffe1146d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
19b55b4cc990a58d42e8668055f184ba

SHA1
845a9832f234775c11ad5776bfe7bc64bbf6fbd1

SHA256
978c34d17dd5408c7c12ff19de3e9de51dd712a5036c8be084bc7cbb03f434d0

SHA512
ee33d11f0fa2b90c619229b03f52faaa23d4ab7261f8187f7326b70edd936e26bcb8e6832d25039bbaa88f3f2f566ef4460327d4e2e5f20a7c0241e45a5325da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab120C.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12FE.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1672-490-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1672-494-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1672-493-0x0000000077380000-0x000000007747A000-memory.dmp

Filesize
1000KB

Download
memory/1672-492-0x0000000077480000-0x000000007759F000-memory.dmp

Filesize
1.1MB

Download
memory/1936-483-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1936-484-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download