ramnit | ad70dab9f2582652b20ff448387a5b6cc754fa9ebd3b246712988b49e75e461f

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35603761d111dd068abfb73efd2f0e63_JaffaCakes118.exe
Size

990KB
MD5

35603761d111dd068abfb73efd2f0e63
SHA1

21a3c402755cb27ae4d1f169698db9d7bf27d747
SHA256

ad70dab9f2582652b20ff448387a5b6cc754fa9ebd3b246712988b49e75e461f
SHA512

5da42b6cedc4dda910498555e7b5254569fc28716e711ee3daa7af70aa84bf98c673e44714425b275f3798e4155d401c10a90a075618d29c1623d39cafdb3609
SSDEEP

24576:SBRWq/opIR4+i1vrPLxY1tjn1t9GerRUfi9Bnx:Pq/opK4+i1vrPIz1t9GeFUfg

Score

10^/10

ramnit banker defense_evasion evasion persistence spyware stealer trojan worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\lyymyuqs\\tfqyjuwj.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tfqyjuwj.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tfqyjuwj.exe	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
2812	SRiR3bU
1328	lkowlwypqmhphuee.exe

Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	svchost.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	svchost.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	svchost.exe

Loads dropped DLL 6 IoCs

pid	Process
2276	35603761d111dd068abfb73efd2f0e63_JaffaCakes118.exe
2276	35603761d111dd068abfb73efd2f0e63_JaffaCakes118.exe
2812	SRiR3bU
2812	SRiR3bU
2812	SRiR3bU
2812	SRiR3bU

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\TfqYjuwj = "C:\\Users\\Admin\\AppData\\Local\\lyymyuqs\\tfqyjuwj.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2812	SRiR3bU
Token: SeDebugPrivilege	2812	SRiR3bU
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2668	svchost.exe
Token: SeDebugPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeSecurityPrivilege	1328	lkowlwypqmhphuee.exe
Token: SeLoadDriverPrivilege	1328	lkowlwypqmhphuee.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe
Token: SeBackupPrivilege	2668	svchost.exe
Token: SeRestorePrivilege	2668	svchost.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2812	2276	35603761d111dd068abfb73efd2f0e63_JaffaCakes118.exe	31
PID 2276 wrote to memory of 2812	2276	35603761d111dd068abfb73efd2f0e63_JaffaCakes118.exe	31
PID 2276 wrote to memory of 2812	2276	35603761d111dd068abfb73efd2f0e63_JaffaCakes118.exe	31
PID 2276 wrote to memory of 2812	2276	35603761d111dd068abfb73efd2f0e63_JaffaCakes118.exe	31
PID 2812 wrote to memory of 2688	2812	SRiR3bU	32
PID 2812 wrote to memory of 2688	2812	SRiR3bU	32
PID 2812 wrote to memory of 2688	2812	SRiR3bU	32
PID 2812 wrote to memory of 2688	2812	SRiR3bU	32
PID 2812 wrote to memory of 2688	2812	SRiR3bU	32
PID 2812 wrote to memory of 2688	2812	SRiR3bU	32
PID 2812 wrote to memory of 2688	2812	SRiR3bU	32
PID 2812 wrote to memory of 2688	2812	SRiR3bU	32
PID 2812 wrote to memory of 2688	2812	SRiR3bU	32
PID 2812 wrote to memory of 2688	2812	SRiR3bU	32
PID 2812 wrote to memory of 2668	2812	SRiR3bU	33
PID 2812 wrote to memory of 2668	2812	SRiR3bU	33
PID 2812 wrote to memory of 2668	2812	SRiR3bU	33
PID 2812 wrote to memory of 2668	2812	SRiR3bU	33
PID 2812 wrote to memory of 2668	2812	SRiR3bU	33
PID 2812 wrote to memory of 2668	2812	SRiR3bU	33
PID 2812 wrote to memory of 2668	2812	SRiR3bU	33
PID 2812 wrote to memory of 2668	2812	SRiR3bU	33
PID 2812 wrote to memory of 2668	2812	SRiR3bU	33
PID 2812 wrote to memory of 2668	2812	SRiR3bU	33
PID 2812 wrote to memory of 1328	2812	SRiR3bU	34
PID 2812 wrote to memory of 1328	2812	SRiR3bU	34
PID 2812 wrote to memory of 1328	2812	SRiR3bU	34
PID 2812 wrote to memory of 1328	2812	SRiR3bU	34

C:\Users\Admin\AppData\Local\Temp\35603761d111dd068abfb73efd2f0e63_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35603761d111dd068abfb73efd2f0e63_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\SRiR3bU
  "SRiR3bU"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Checks BIOS information in registry
    - Drops startup file
    - Impair Defenses: Safe Mode Boot
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- - C:\Users\Admin\AppData\Local\Temp\lkowlwypqmhphuee.exe
    "C:\Users\Admin\AppData\Local\Temp\lkowlwypqmhphuee.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\SRiR3bU

Filesize
95KB

MD5
47a8ed36d375f91a1b750411d92ead7f

SHA1
b46c4f789f25a704169a21b4b7e4d4ecdda62a5d

SHA256
7e1f885a67c2b64aa4549a564f1008f4e96f1a2cd351cd62b6d2b44a8dd03626

SHA512
c3f43e560d3b499ab3d0444cfc21a18eb0451aff7466760c0719feadeb4d47445af13968b108cd89fc36e619b9297240075f5a1eec6f6319a88c589a4bc872f7

Download Submit
memory/1328-97-0x0000000000400000-0x000000000043A0DC-memory.dmp

Filesize
232KB

Download
memory/1328-100-0x0000000000400000-0x000000000043A0DC-memory.dmp

Filesize
232KB

Download
memory/2276-0-0x0000000001000000-0x00000000010FC000-memory.dmp

Filesize
1008KB

Download
memory/2276-5-0x0000000000170000-0x00000000001AB000-memory.dmp

Filesize
236KB

Download
memory/2276-11-0x0000000001000000-0x00000000010FC000-memory.dmp

Filesize
1008KB

Download
memory/2668-102-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-109-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-105-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-104-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-103-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-108-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-58-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-38-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-101-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-107-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-110-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-71-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-73-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-70-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-66-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-46-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-56-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-55-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2668-62-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/2688-25-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2688-33-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2688-29-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2688-30-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/2688-32-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2688-21-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/2688-19-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2688-31-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2688-34-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/2812-83-0x0000000002A30000-0x0000000002A6B000-memory.dmp

Filesize
236KB

Download
memory/2812-91-0x0000000000400000-0x000000000043A0DC-memory.dmp

Filesize
232KB

Download
memory/2812-45-0x0000000077BAF000-0x0000000077BB0000-memory.dmp

Filesize
4KB

Download
memory/2812-92-0x0000000002A40000-0x0000000002A7B000-memory.dmp

Filesize
236KB

Download
memory/2812-93-0x0000000002A40000-0x0000000002A7B000-memory.dmp

Filesize
236KB

Download
memory/2812-84-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2812-15-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2812-64-0x0000000077BB0000-0x0000000077BB1000-memory.dmp

Filesize
4KB

Download
memory/2812-44-0x0000000077BB0000-0x0000000077BB1000-memory.dmp

Filesize
4KB

Download
memory/2812-17-0x0000000000400000-0x000000000043A0DC-memory.dmp

Filesize
232KB

Download
memory/2812-16-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2812-12-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2812-10-0x0000000000400000-0x000000000043A0DC-memory.dmp

Filesize
232KB

Download