ramnit | 79f721f74ead78e914d5566613017b71173fa4f6b0f268db0cc3c2005bbcb634

General

Target

a4e1e27c70a8154e82be358f219e6407_JaffaCakes118.html
Size

182KB
MD5

a4e1e27c70a8154e82be358f219e6407
SHA1

2b25e52ca0292bd8c4a5c146650490a73c472b1e
SHA256

79f721f74ead78e914d5566613017b71173fa4f6b0f268db0cc3c2005bbcb634
SHA512

9313558b317230acfebe1097638e4523e2ff75d0fc4e2c62eab2871fa3ebcb2c5e6794be4e0e165f93a7a934a84d6b1a0d6972815eae77181f033535205ef3de
SSDEEP

3072:S8nXXkDeryfkMY+BES09JXAnyrZalI+YFrGOiDXev:S8nXXkDeOsMYod+X3oI+YRGDev

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2576 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2360 IEXPLORE.EXE

pid	process
2360	IEXPLORE.EXE

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\svchost.exe	upx
behavioral1/memory/2576-6-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral1/memory/2576-13-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px92FC.tmp	svchost.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000be01dfe1276b6efc5a9e6ca331a9221c7880d99df613ace292efc1d082da14b9000000000e8000000002000020000000bad259de493ede48ebc33497aeebfdd57b920a815c9a28ce22c0e65460dec8619000000097e59c59ff137719854cfc6e2046457d6b8b2c554cbee5dc8ca417438fe993513db3394654f8cd4051812d4bdbbeaa152e834c7c09534cd84b96e37d8b108a50f427e80874ad74ad49c1d258ff9144fcae5cec56808262a477af74b63ab928af27bc5ee38e73312c6f3bcd4b8504ecd9169c91efb49ecd6e07d0220d802d9c938e681e517966bd2b527a07b66a01de9840000000652b3ccf2ff084ad2e4f5822d95b162c223dfa098488bc85130b0178b4ae9d55707ca458de8acb3e55f0f5e83f13adee8cf15338d48d604ef8ce867bca87ee23	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ae395f75bdda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424433306"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000facff4b3af5f60a355e424b957acd69ac1fc2e1929673851f45fa46d927e8fa9000000000e8000000002000020000000a4eb8d4840f249285914153b8f23aa792d00c7bc9236bb86a5b8e9ed59b84a0020000000d0e4996d2e0f3400777fd9bf321c6020d0fced7b4b651415e5de8f80b9582ea240000000c154ee94d623c4a140d7d09a958dba8bcac5a55ca0baafbb8ceae258a5d1a0507d9fec150c1ed406fd49f8792df3c761834cfa38eaf1279a03ef713ebbab52cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7975E5D1-2968-11EF-917C-6A2211F10352} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

svchost.exe

pid process

2576 svchost.exe

Suspicious behavior: MapViewOfSection 23 IoCs

Processes:

svchost.exe

pid	process
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe
2576	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 2576 svchost.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

308 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

308 iexplore.exe
308 iexplore.exe
2360 IEXPLORE.EXE
2360 IEXPLORE.EXE
2360 IEXPLORE.EXE
2360 IEXPLORE.EXE

description	pid	process
Token: SeDebugPrivilege	2576	svchost.exe

pid	process
308	iexplore.exe

pid	process
308	iexplore.exe
308	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exeIEXPLORE.EXEsvchost.exe

description	pid	process	target process
PID 308 wrote to memory of 2360	308	iexplore.exe	IEXPLORE.EXE
PID 308 wrote to memory of 2360	308	iexplore.exe	IEXPLORE.EXE
PID 308 wrote to memory of 2360	308	iexplore.exe	IEXPLORE.EXE
PID 308 wrote to memory of 2360	308	iexplore.exe	IEXPLORE.EXE
PID 2360 wrote to memory of 2576	2360	IEXPLORE.EXE	svchost.exe
PID 2360 wrote to memory of 2576	2360	IEXPLORE.EXE	svchost.exe
PID 2360 wrote to memory of 2576	2360	IEXPLORE.EXE	svchost.exe
PID 2360 wrote to memory of 2576	2360	IEXPLORE.EXE	svchost.exe
PID 2576 wrote to memory of 380	2576	svchost.exe	wininit.exe
PID 2576 wrote to memory of 380	2576	svchost.exe	wininit.exe
PID 2576 wrote to memory of 380	2576	svchost.exe	wininit.exe
PID 2576 wrote to memory of 380	2576	svchost.exe	wininit.exe
PID 2576 wrote to memory of 380	2576	svchost.exe	wininit.exe
PID 2576 wrote to memory of 380	2576	svchost.exe	wininit.exe
PID 2576 wrote to memory of 380	2576	svchost.exe	wininit.exe
PID 2576 wrote to memory of 392	2576	svchost.exe	csrss.exe
PID 2576 wrote to memory of 392	2576	svchost.exe	csrss.exe
PID 2576 wrote to memory of 392	2576	svchost.exe	csrss.exe
PID 2576 wrote to memory of 392	2576	svchost.exe	csrss.exe
PID 2576 wrote to memory of 392	2576	svchost.exe	csrss.exe
PID 2576 wrote to memory of 392	2576	svchost.exe	csrss.exe
PID 2576 wrote to memory of 392	2576	svchost.exe	csrss.exe
PID 2576 wrote to memory of 432	2576	svchost.exe	winlogon.exe
PID 2576 wrote to memory of 432	2576	svchost.exe	winlogon.exe
PID 2576 wrote to memory of 432	2576	svchost.exe	winlogon.exe
PID 2576 wrote to memory of 432	2576	svchost.exe	winlogon.exe
PID 2576 wrote to memory of 432	2576	svchost.exe	winlogon.exe
PID 2576 wrote to memory of 432	2576	svchost.exe	winlogon.exe
PID 2576 wrote to memory of 432	2576	svchost.exe	winlogon.exe
PID 2576 wrote to memory of 476	2576	svchost.exe	services.exe
PID 2576 wrote to memory of 476	2576	svchost.exe	services.exe
PID 2576 wrote to memory of 476	2576	svchost.exe	services.exe
PID 2576 wrote to memory of 476	2576	svchost.exe	services.exe
PID 2576 wrote to memory of 476	2576	svchost.exe	services.exe
PID 2576 wrote to memory of 476	2576	svchost.exe	services.exe
PID 2576 wrote to memory of 476	2576	svchost.exe	services.exe
PID 2576 wrote to memory of 492	2576	svchost.exe	lsass.exe
PID 2576 wrote to memory of 492	2576	svchost.exe	lsass.exe
PID 2576 wrote to memory of 492	2576	svchost.exe	lsass.exe
PID 2576 wrote to memory of 492	2576	svchost.exe	lsass.exe
PID 2576 wrote to memory of 492	2576	svchost.exe	lsass.exe
PID 2576 wrote to memory of 492	2576	svchost.exe	lsass.exe
PID 2576 wrote to memory of 492	2576	svchost.exe	lsass.exe
PID 2576 wrote to memory of 500	2576	svchost.exe	lsm.exe
PID 2576 wrote to memory of 500	2576	svchost.exe	lsm.exe
PID 2576 wrote to memory of 500	2576	svchost.exe	lsm.exe
PID 2576 wrote to memory of 500	2576	svchost.exe	lsm.exe
PID 2576 wrote to memory of 500	2576	svchost.exe	lsm.exe
PID 2576 wrote to memory of 500	2576	svchost.exe	lsm.exe
PID 2576 wrote to memory of 500	2576	svchost.exe	lsm.exe
PID 2576 wrote to memory of 596	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 596	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 596	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 596	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 596	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 596	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 596	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 676	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 676	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 676	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 676	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 676	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 676	2576	svchost.exe	svchost.exe
PID 2576 wrote to memory of 676	2576	svchost.exe	svchost.exe

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
4⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:804

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:112

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1056

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:3064

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:1292

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1236

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4e1e27c70a8154e82be358f219e6407_JaffaCakes118.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:308 CREDAT:275457 /prefetch:2
3⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
84KB

MD5
03451dfbff127a5643a1ed613796621d

SHA1
b385005e32bae7c53277783681b3b3e1ac908ec7

SHA256
60c6c49b3a025dbf26a1f4540921908a7ea88367ffc3258caab780b74a09d4fb

SHA512
db7d026781943404b59a3d766cd4c63e0fa3b2abd417c0b283c7bcd9909a8dad75501bd5a5ff8d0f8e5aa803931fc19c66dcaf7f1a5450966511bdaa75df8a89

Download Submit
memory/2576-6-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2576-13-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2576-11-0x0000000000540000-0x000000000054F000-memory.dmp

Filesize
60KB

Download
memory/2576-10-0x0000000077B30000-0x0000000077B31000-memory.dmp

Filesize
4KB

Download
memory/2576-9-0x0000000077B2F000-0x0000000077B30000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads