ramnit | 174b9021ef95ee3f2f5fe81c572c857a135e1fac3a42b54f73574f16db60949e

General

Target

a798090ec8ced8c51630b487ee8c3fe7_JaffaCakes118.html
Size

193KB
MD5

a798090ec8ced8c51630b487ee8c3fe7
SHA1

caaea25efaf3cb0e6b66d6ee9179088309919435
SHA256

174b9021ef95ee3f2f5fe81c572c857a135e1fac3a42b54f73574f16db60949e
SHA512

757176c2a8ba26231fbf062fcbc360677d04f87fcd25cdf19be5833c2d30b2a7bf4f93cad5abede94418f5298370d2fcf388e77ce6d703403475a9b6c8ef8957
SSDEEP

3072:Sb4ByfkMY+BES09JXAnyrZalI+Ye47uM9f7UL:SMEsMYod+X3oI+Ye4pf7UL

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2700 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2932 IEXPLORE.EXE

pid	process
2932	IEXPLORE.EXE

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\svchost.exe	upx
behavioral1/memory/2700-6-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral1/memory/2700-12-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px7B29.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424491282"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0140659fcbdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000048aad4f061f934004344d3e4c2755475b8cb49e4fe48f7a2daeb533db7dec5a9000000000e80000000020000200000002f022f7d128f63283839a83f88657c9f7d450526ab1edad78f5b113d0d5c98412000000023a25db4a3508d4945726e846aafdcd2eb38113782e4eaaa246aae96b0ff282740000000fb70f78b645891b888d8279218e7402b63297f1ecefe0d84361625fbda43b7742390cdbf00ebea65e825003ead33dacbd1d94c3aca2ef1ad68e9cd0178d4cefe	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000acc926b86a573dfc2e7d68d9658a7c3625a64f4a3da4b006831d5cffc6e1c98e000000000e800000000200002000000030c95cafd083fd67223b5e6b4d2fbeb4428dd7db402ba8cf41bc455d2925f7a7900000008aa4fdcd2f7d126bf0e2f3c9cae114e77b9fb3cd06a2bf04952389a71c473285b21b0130eb218b0389c2bccfd9bb345ea007a45330ffc921f4f8034e3a7e3b15527493d01ce552f170db6269f78cf9eeca409fc9a405ab9eaea78b7f56b99f4ac369f01d2bb539711fe6b77a05c5a7ac6c830b5447382bf7e048e2e69b39b30f146fd6b89d7b4056ba41b8432fa86b294000000002cce89363bc61bda6e3f2046df2db327bafb50ba434c7d65a493b8557fdeed6c8e86cf09bee22498efb3ec6dbd7d6f6374fc4ec816702aefb80ac3932f8a18f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75D6D9C1-29EF-11EF-ACD5-4635F953E0C8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

svchost.exe

pid process

2700 svchost.exe

Suspicious behavior: MapViewOfSection 24 IoCs

Processes:

svchost.exe

pid	process
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe
2700	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 2700 svchost.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2140 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2140 iexplore.exe
2140 iexplore.exe
2932 IEXPLORE.EXE
2932 IEXPLORE.EXE
2932 IEXPLORE.EXE
2932 IEXPLORE.EXE

description	pid	process
Token: SeDebugPrivilege	2700	svchost.exe

pid	process
2140	iexplore.exe

pid	process
2140	iexplore.exe
2140	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exeIEXPLORE.EXEsvchost.exe

description	pid	process	target process
PID 2140 wrote to memory of 2932	2140	iexplore.exe	IEXPLORE.EXE
PID 2140 wrote to memory of 2932	2140	iexplore.exe	IEXPLORE.EXE
PID 2140 wrote to memory of 2932	2140	iexplore.exe	IEXPLORE.EXE
PID 2140 wrote to memory of 2932	2140	iexplore.exe	IEXPLORE.EXE
PID 2932 wrote to memory of 2700	2932	IEXPLORE.EXE	svchost.exe
PID 2932 wrote to memory of 2700	2932	IEXPLORE.EXE	svchost.exe
PID 2932 wrote to memory of 2700	2932	IEXPLORE.EXE	svchost.exe
PID 2932 wrote to memory of 2700	2932	IEXPLORE.EXE	svchost.exe
PID 2700 wrote to memory of 384	2700	svchost.exe	wininit.exe
PID 2700 wrote to memory of 384	2700	svchost.exe	wininit.exe
PID 2700 wrote to memory of 384	2700	svchost.exe	wininit.exe
PID 2700 wrote to memory of 384	2700	svchost.exe	wininit.exe
PID 2700 wrote to memory of 384	2700	svchost.exe	wininit.exe
PID 2700 wrote to memory of 384	2700	svchost.exe	wininit.exe
PID 2700 wrote to memory of 384	2700	svchost.exe	wininit.exe
PID 2700 wrote to memory of 392	2700	svchost.exe	csrss.exe
PID 2700 wrote to memory of 392	2700	svchost.exe	csrss.exe
PID 2700 wrote to memory of 392	2700	svchost.exe	csrss.exe
PID 2700 wrote to memory of 392	2700	svchost.exe	csrss.exe
PID 2700 wrote to memory of 392	2700	svchost.exe	csrss.exe
PID 2700 wrote to memory of 392	2700	svchost.exe	csrss.exe
PID 2700 wrote to memory of 392	2700	svchost.exe	csrss.exe
PID 2700 wrote to memory of 432	2700	svchost.exe	winlogon.exe
PID 2700 wrote to memory of 432	2700	svchost.exe	winlogon.exe
PID 2700 wrote to memory of 432	2700	svchost.exe	winlogon.exe
PID 2700 wrote to memory of 432	2700	svchost.exe	winlogon.exe
PID 2700 wrote to memory of 432	2700	svchost.exe	winlogon.exe
PID 2700 wrote to memory of 432	2700	svchost.exe	winlogon.exe
PID 2700 wrote to memory of 432	2700	svchost.exe	winlogon.exe
PID 2700 wrote to memory of 476	2700	svchost.exe	services.exe
PID 2700 wrote to memory of 476	2700	svchost.exe	services.exe
PID 2700 wrote to memory of 476	2700	svchost.exe	services.exe
PID 2700 wrote to memory of 476	2700	svchost.exe	services.exe
PID 2700 wrote to memory of 476	2700	svchost.exe	services.exe
PID 2700 wrote to memory of 476	2700	svchost.exe	services.exe
PID 2700 wrote to memory of 476	2700	svchost.exe	services.exe
PID 2700 wrote to memory of 492	2700	svchost.exe	lsass.exe
PID 2700 wrote to memory of 492	2700	svchost.exe	lsass.exe
PID 2700 wrote to memory of 492	2700	svchost.exe	lsass.exe
PID 2700 wrote to memory of 492	2700	svchost.exe	lsass.exe
PID 2700 wrote to memory of 492	2700	svchost.exe	lsass.exe
PID 2700 wrote to memory of 492	2700	svchost.exe	lsass.exe
PID 2700 wrote to memory of 492	2700	svchost.exe	lsass.exe
PID 2700 wrote to memory of 500	2700	svchost.exe	lsm.exe
PID 2700 wrote to memory of 500	2700	svchost.exe	lsm.exe
PID 2700 wrote to memory of 500	2700	svchost.exe	lsm.exe
PID 2700 wrote to memory of 500	2700	svchost.exe	lsm.exe
PID 2700 wrote to memory of 500	2700	svchost.exe	lsm.exe
PID 2700 wrote to memory of 500	2700	svchost.exe	lsm.exe
PID 2700 wrote to memory of 500	2700	svchost.exe	lsm.exe
PID 2700 wrote to memory of 592	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 592	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 592	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 592	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 592	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 592	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 592	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 672	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 672	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 672	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 672	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 672	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 672	2700	svchost.exe	svchost.exe
PID 2700 wrote to memory of 672	2700	svchost.exe	svchost.exe

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:592

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
4⤵
PID:1196

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
4⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:812

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:108

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1060

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:3032

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:2272

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a798090ec8ced8c51630b487ee8c3fe7_JaffaCakes118.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
3⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
84KB

MD5
cc9104bc71a23e14787188f3634a4d05

SHA1
0b537406933abc1738ef32b96069961d024f1b8e

SHA256
aa797033a44b0ab42e6428552b5e85bc735c84082493f63b4b3ad0843859b28c

SHA512
023b9655cef044082ceb44c6644d834e4ba9af088843674cc8e816cb4f4981bf0958b0c82002c1597c8818e57af0f80d4cf3ab771e68af5a33cff752363c7df3

Download Submit
memory/2700-6-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2700-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2700-11-0x0000000000390000-0x000000000039F000-memory.dmp

Filesize
60KB

Download
memory/2700-10-0x00000000773B0000-0x00000000773B1000-memory.dmp

Filesize
4KB

Download
memory/2700-9-0x00000000773AF000-0x00000000773B0000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads