ramnit | 442688216565b95b8fa53e1db30cec3b09030824c3ed63c9f00cc2b256832697

General

Target

1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe
Size

100KB
MD5

1d8106f4e262a3d05864165bead167e9
SHA1

d018e2d1f7eda030f121359bb5b3f4bb84a81e15
SHA256

442688216565b95b8fa53e1db30cec3b09030824c3ed63c9f00cc2b256832697
SHA512

c8af9196426792bb90d01768910fc4d3ec8978a3dcc293889b4a60e8cc6ebc2fcac74fa021a35ab3d1d3937f292cbf47ec8350aa37cf2542ae163604585f18bf
SSDEEP

3072:rtm6BGBr+nU5tkt74R7ymx5GVk8jwaaHw7Koj4rDM7GN:rtdBGcU5tJt8i

Score

10^/10

ramnit banker defense_evasion evasion persistence spyware stealer trojan worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\gqpjgugj\\owihsvvm.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

svchost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\owihsvvm.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\owihsvvm.exe	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

gcgcuxxsitijcbap.exe

pid process

2916 gcgcuxxsitijcbap.exe

pid	process
2916	gcgcuxxsitijcbap.exe

Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs

defense_evasion

Safe Mode Boot

T1562.009

Processes:

svchost.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	svchost.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	svchost.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	svchost.exe

Loads dropped DLL 5 IoCs

Processes:

1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe

pid	process
2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe
2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe
2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe
2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe
2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\OwiHsvvm = "C:\\Users\\Admin\\AppData\\Local\\gqpjgugj\\owihsvvm.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

476

pid	process
476

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exesvchost.exesvchost.exegcgcuxxsitijcbap.exe

description	pid	process
Token: SeSecurityPrivilege	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe
Token: SeDebugPrivilege	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe
Token: SeSecurityPrivilege	1284	svchost.exe
Token: SeSecurityPrivilege	2704	svchost.exe
Token: SeDebugPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeSecurityPrivilege	2916	gcgcuxxsitijcbap.exe
Token: SeLoadDriverPrivilege	2916	gcgcuxxsitijcbap.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe
Token: SeBackupPrivilege	2704	svchost.exe
Token: SeRestorePrivilege	2704	svchost.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe

description	pid	process	target process
PID 2068 wrote to memory of 1284	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 1284	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 1284	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 1284	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 1284	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 1284	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 1284	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 1284	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 1284	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 1284	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 2704	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 2704	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 2704	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 2704	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 2704	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 2704	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 2704	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 2704	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 2704	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 2704	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	svchost.exe
PID 2068 wrote to memory of 2916	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	gcgcuxxsitijcbap.exe
PID 2068 wrote to memory of 2916	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	gcgcuxxsitijcbap.exe
PID 2068 wrote to memory of 2916	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	gcgcuxxsitijcbap.exe
PID 2068 wrote to memory of 2916	2068	1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe	gcgcuxxsitijcbap.exe

C:\Users\Admin\AppData\Local\Temp\1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1d8106f4e262a3d05864165bead167e9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Checks BIOS information in registry
  - Drops startup file
  - Impair Defenses: Safe Mode Boot
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\gcgcuxxsitijcbap.exe
  "C:\Users\Admin\AppData\Local\Temp\gcgcuxxsitijcbap.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

2

T1562

Disable or Modify Tools

1

T1562.001

Safe Mode Boot

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\gqpjgugj\owihsvvm.exe

Filesize
100KB

MD5
1d8106f4e262a3d05864165bead167e9

SHA1
d018e2d1f7eda030f121359bb5b3f4bb84a81e15

SHA256
442688216565b95b8fa53e1db30cec3b09030824c3ed63c9f00cc2b256832697

SHA512
c8af9196426792bb90d01768910fc4d3ec8978a3dcc293889b4a60e8cc6ebc2fcac74fa021a35ab3d1d3937f292cbf47ec8350aa37cf2542ae163604585f18bf

Download Submit
memory/1284-15-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1284-22-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1284-23-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1284-24-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1284-19-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/1284-20-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/1284-10-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/1284-8-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1284-21-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2068-31-0x000000007739F000-0x00000000773A0000-memory.dmp

Filesize
4KB

Download
memory/2068-63-0x0000000002B90000-0x0000000002BCB000-memory.dmp

Filesize
236KB

Download
memory/2068-7-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2068-3-0x0000000000400000-0x000000000043A630-memory.dmp

Filesize
233KB

Download
memory/2068-5-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2068-6-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2068-1-0x0000000000432000-0x000000000043B000-memory.dmp

Filesize
36KB

Download
memory/2068-27-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2068-0-0x0000000000400000-0x000000000043A630-memory.dmp

Filesize
233KB

Download
memory/2068-30-0x00000000773A0000-0x00000000773A1000-memory.dmp

Filesize
4KB

Download
memory/2068-74-0x0000000002BA0000-0x0000000002BDB000-memory.dmp

Filesize
236KB

Download
memory/2068-75-0x0000000002BA0000-0x0000000002BDB000-memory.dmp

Filesize
236KB

Download
memory/2068-2-0x0000000000400000-0x000000000043A630-memory.dmp

Filesize
233KB

Download
memory/2068-14-0x0000000000400000-0x000000000043A630-memory.dmp

Filesize
233KB

Download
memory/2068-64-0x0000000002B90000-0x0000000002BCB000-memory.dmp

Filesize
236KB

Download
memory/2068-55-0x0000000000400000-0x000000000043A630-memory.dmp

Filesize
233KB

Download
memory/2068-54-0x00000000773A0000-0x00000000773A1000-memory.dmp

Filesize
4KB

Download
memory/2704-52-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2704-45-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2704-46-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2704-36-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2704-28-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2704-84-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2704-85-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2704-91-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2916-79-0x0000000000400000-0x000000000043A630-memory.dmp

Filesize
233KB

Download
memory/2916-78-0x0000000000432000-0x000000000043B000-memory.dmp

Filesize
36KB

Download
memory/2916-82-0x0000000000400000-0x000000000043A630-memory.dmp

Filesize
233KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads