ramnit | 20cffbf1c1987b601b05a64b7134e326f376c24cd03f12273b4243b98d2f10f2

General

Target

a83ed0dc5e489bbf28ed88dcb992e929_JaffaCakes118.html
Size

186KB
MD5

a83ed0dc5e489bbf28ed88dcb992e929
SHA1

8a8afd50e7760fcfeef8eec6d928a93d90334b7a
SHA256

20cffbf1c1987b601b05a64b7134e326f376c24cd03f12273b4243b98d2f10f2
SHA512

947f82e29bfed70f11431d9268c30fb5b893f196024c307ea32d1ae9a4a7ff96afe42117f9327668f85045b3217fad523b0f6adbd7a73aaeb775d57fc983c722
SSDEEP

3072:wGyfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:UsMYod+X3oI+YS1tA8

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2732 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

IEXPLORE.EXE

pid process

632 IEXPLORE.EXE

pid	process
632	IEXPLORE.EXE

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\svchost.exe	upx
behavioral1/memory/2732-6-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral1/memory/2732-12-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\pxEDF.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4858081-2A13-11EF-8004-DAAF2542C58D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000004fe5575fb29cb1912be7205af99d9b94bcbe07df44c37c7ec2d3fc12f25838bf000000000e8000000002000020000000454f28af2eb031aa3988aa733ceb487c48c978526d3ae1eeafb0f751552e126c90000000d7efa86dd2d2a059f9cf4aa0e9ef02afe7d71a7ee2818a8758e08e7e7a77cae1471a1e69abc16964af2a6151a00fb2cd6a09a2855c30bcd6ed5d3f31fd446f7607dc33afe91acf51163ed7c6d8f69ab968b6da0917c6b044c8a368efd7282d1cc576ff059c3d8f37e7cf8a6a1cb2765710e746df84baf28dde4ace9294f5e77653f390773373506eba0a4bb0792f81d1400000001740a18a493cf1b40086e8a7705800e46777f845abcf1a27a8bf39e22aa720dd70e611539c3b8a4d32a594c1aaf6c5d3db538ff97ec13dfd43f82a7823c782d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424506849"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000f6aaf0c2a16f8036da4bda56c02f5ff942eec5305ebbbf22e267c900a8da127b000000000e8000000002000020000000bac6c10383804cffdd5835f9524531613367a5085aae550e5ac1685492ecc655200000001915371e50bf4211bc60d97d595327ba5a51b140c39f63ff6ccfe91f8e84624e40000000803a93bac7f984d6e994bed1a8a051884f14cc676df03ba10cba281bfa82fc7d08736aa35485413ca5416d8615cb8bf4ad0b52a70dca3daba3f3c7f6e6b24af5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702b898920beda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

svchost.exe

pid process

2732 svchost.exe

Suspicious behavior: MapViewOfSection 23 IoCs

Processes:

svchost.exe

pid	process
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 2732 svchost.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2288 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2288 iexplore.exe
2288 iexplore.exe
632 IEXPLORE.EXE
632 IEXPLORE.EXE
632 IEXPLORE.EXE
632 IEXPLORE.EXE

description	pid	process
Token: SeDebugPrivilege	2732	svchost.exe

pid	process
2288	iexplore.exe

pid	process
2288	iexplore.exe
2288	iexplore.exe
632	IEXPLORE.EXE
632	IEXPLORE.EXE
632	IEXPLORE.EXE
632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exeIEXPLORE.EXEsvchost.exe

description	pid	process	target process
PID 2288 wrote to memory of 632	2288	iexplore.exe	IEXPLORE.EXE
PID 2288 wrote to memory of 632	2288	iexplore.exe	IEXPLORE.EXE
PID 2288 wrote to memory of 632	2288	iexplore.exe	IEXPLORE.EXE
PID 2288 wrote to memory of 632	2288	iexplore.exe	IEXPLORE.EXE
PID 632 wrote to memory of 2732	632	IEXPLORE.EXE	svchost.exe
PID 632 wrote to memory of 2732	632	IEXPLORE.EXE	svchost.exe
PID 632 wrote to memory of 2732	632	IEXPLORE.EXE	svchost.exe
PID 632 wrote to memory of 2732	632	IEXPLORE.EXE	svchost.exe
PID 2732 wrote to memory of 384	2732	svchost.exe	wininit.exe
PID 2732 wrote to memory of 384	2732	svchost.exe	wininit.exe
PID 2732 wrote to memory of 384	2732	svchost.exe	wininit.exe
PID 2732 wrote to memory of 384	2732	svchost.exe	wininit.exe
PID 2732 wrote to memory of 384	2732	svchost.exe	wininit.exe
PID 2732 wrote to memory of 384	2732	svchost.exe	wininit.exe
PID 2732 wrote to memory of 384	2732	svchost.exe	wininit.exe
PID 2732 wrote to memory of 392	2732	svchost.exe	csrss.exe
PID 2732 wrote to memory of 392	2732	svchost.exe	csrss.exe
PID 2732 wrote to memory of 392	2732	svchost.exe	csrss.exe
PID 2732 wrote to memory of 392	2732	svchost.exe	csrss.exe
PID 2732 wrote to memory of 392	2732	svchost.exe	csrss.exe
PID 2732 wrote to memory of 392	2732	svchost.exe	csrss.exe
PID 2732 wrote to memory of 392	2732	svchost.exe	csrss.exe
PID 2732 wrote to memory of 432	2732	svchost.exe	winlogon.exe
PID 2732 wrote to memory of 432	2732	svchost.exe	winlogon.exe
PID 2732 wrote to memory of 432	2732	svchost.exe	winlogon.exe
PID 2732 wrote to memory of 432	2732	svchost.exe	winlogon.exe
PID 2732 wrote to memory of 432	2732	svchost.exe	winlogon.exe
PID 2732 wrote to memory of 432	2732	svchost.exe	winlogon.exe
PID 2732 wrote to memory of 432	2732	svchost.exe	winlogon.exe
PID 2732 wrote to memory of 476	2732	svchost.exe	services.exe
PID 2732 wrote to memory of 476	2732	svchost.exe	services.exe
PID 2732 wrote to memory of 476	2732	svchost.exe	services.exe
PID 2732 wrote to memory of 476	2732	svchost.exe	services.exe
PID 2732 wrote to memory of 476	2732	svchost.exe	services.exe
PID 2732 wrote to memory of 476	2732	svchost.exe	services.exe
PID 2732 wrote to memory of 476	2732	svchost.exe	services.exe
PID 2732 wrote to memory of 492	2732	svchost.exe	lsass.exe
PID 2732 wrote to memory of 492	2732	svchost.exe	lsass.exe
PID 2732 wrote to memory of 492	2732	svchost.exe	lsass.exe
PID 2732 wrote to memory of 492	2732	svchost.exe	lsass.exe
PID 2732 wrote to memory of 492	2732	svchost.exe	lsass.exe
PID 2732 wrote to memory of 492	2732	svchost.exe	lsass.exe
PID 2732 wrote to memory of 492	2732	svchost.exe	lsass.exe
PID 2732 wrote to memory of 500	2732	svchost.exe	lsm.exe
PID 2732 wrote to memory of 500	2732	svchost.exe	lsm.exe
PID 2732 wrote to memory of 500	2732	svchost.exe	lsm.exe
PID 2732 wrote to memory of 500	2732	svchost.exe	lsm.exe
PID 2732 wrote to memory of 500	2732	svchost.exe	lsm.exe
PID 2732 wrote to memory of 500	2732	svchost.exe	lsm.exe
PID 2732 wrote to memory of 500	2732	svchost.exe	lsm.exe
PID 2732 wrote to memory of 604	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 604	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 604	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 604	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 604	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 604	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 604	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 684	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 684	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 684	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 684	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 684	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 684	2732	svchost.exe	svchost.exe
PID 2732 wrote to memory of 684	2732	svchost.exe	svchost.exe

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:604

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
4⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:820

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:236

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1052

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:3052

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:2164

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a83ed0dc5e489bbf28ed88dcb992e929_JaffaCakes118.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
3⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
84KB

MD5
df455f0fa8fb3fa4e6699ad57ef54db6

SHA1
51a06248c251d614d3a81ac9d842ba807204d17c

SHA256
15068b86edc0473a4f96f109830318e0540af348197e2b65f2e90ff32cfb14a1

SHA512
f69dea5b68e4fc8737fc0e6ef48476d3ed0a5ebd2f9dccc9d966df137f9ffdbb51e413a0852c22399afab53ea8a2755664afdcee6897a1cf387a9a620481b2a6

Download Submit
memory/2732-6-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2732-11-0x0000000000280000-0x000000000028F000-memory.dmp

Filesize
60KB

Download
memory/2732-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2732-10-0x0000000077D40000-0x0000000077D41000-memory.dmp

Filesize
4KB

Download
memory/2732-9-0x0000000077D3F000-0x0000000077D40000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads