ramnit | a0fa9fa1221f43f64f4609e6f3da3817bfecb644f9ded0ccc239ec4922d6800e

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
Size

372KB
MD5

8b554fee73fa7ce0a45dd2cd8b70022c
SHA1

c6b6691894fe985a0bb1274f29bfd49ce1e5fc47
SHA256

a0fa9fa1221f43f64f4609e6f3da3817bfecb644f9ded0ccc239ec4922d6800e
SHA512

52a855dc7fd9b9a9a2decc7ec201c168304c60a3d0969d2eba4635272d98cf249357db20919fa24f53ed588ef20bb93aabb91eea3b42632502a2d8791fee6baf
SSDEEP

6144:QbeSUb6XgkwwovygDqn5ALmM+hHtQjSEZ5HDqn5ALmM+hHtQjSEZ5S:QbZU2X8XDFLJ+3YHDFLJ+3YS

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 1 IoCs

pid	Process
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe

Loads dropped DLL 2 IoCs

pid	Process
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000012115-3.dat	upx
behavioral1/memory/2708-21-0x0000000000400000-0x000000000045B000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe

Suspicious behavior: MapViewOfSection 48 IoCs

pid	Process
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
Token: SeRestorePrivilege	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
Token: SeBackupPrivilege	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
Token: SeDebugPrivilege	2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
Token: SeDebugPrivilege	2708	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2708	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2708	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2708	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2708	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	30
PID 2656 wrote to memory of 384	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	3
PID 2656 wrote to memory of 384	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	3
PID 2656 wrote to memory of 384	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	3
PID 2656 wrote to memory of 384	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	3
PID 2656 wrote to memory of 384	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	3
PID 2656 wrote to memory of 384	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	3
PID 2656 wrote to memory of 384	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	3
PID 2656 wrote to memory of 396	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	4
PID 2656 wrote to memory of 396	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	4
PID 2656 wrote to memory of 396	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	4
PID 2656 wrote to memory of 396	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	4
PID 2656 wrote to memory of 396	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	4
PID 2656 wrote to memory of 396	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	4
PID 2656 wrote to memory of 396	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	4
PID 2656 wrote to memory of 432	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	5
PID 2656 wrote to memory of 432	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	5
PID 2656 wrote to memory of 432	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	5
PID 2656 wrote to memory of 432	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	5
PID 2656 wrote to memory of 432	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	5
PID 2656 wrote to memory of 432	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	5
PID 2656 wrote to memory of 432	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	5
PID 2656 wrote to memory of 476	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	6
PID 2656 wrote to memory of 476	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	6
PID 2656 wrote to memory of 476	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	6
PID 2656 wrote to memory of 476	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	6
PID 2656 wrote to memory of 476	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	6
PID 2656 wrote to memory of 476	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	6
PID 2656 wrote to memory of 476	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	6
PID 2656 wrote to memory of 492	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	7
PID 2656 wrote to memory of 492	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	7
PID 2656 wrote to memory of 492	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	7
PID 2656 wrote to memory of 492	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	7
PID 2656 wrote to memory of 492	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	7
PID 2656 wrote to memory of 492	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	7
PID 2656 wrote to memory of 492	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	7
PID 2656 wrote to memory of 500	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	8
PID 2656 wrote to memory of 500	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	8
PID 2656 wrote to memory of 500	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	8
PID 2656 wrote to memory of 500	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	8
PID 2656 wrote to memory of 500	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	8
PID 2656 wrote to memory of 500	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	8
PID 2656 wrote to memory of 500	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	8
PID 2656 wrote to memory of 596	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	9
PID 2656 wrote to memory of 596	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	9
PID 2656 wrote to memory of 596	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	9
PID 2656 wrote to memory of 596	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	9
PID 2656 wrote to memory of 596	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	9
PID 2656 wrote to memory of 596	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	9
PID 2656 wrote to memory of 596	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	9
PID 2656 wrote to memory of 672	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	10
PID 2656 wrote to memory of 672	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	10
PID 2656 wrote to memory of 672	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	10
PID 2656 wrote to memory of 672	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	10
PID 2656 wrote to memory of 672	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	10
PID 2656 wrote to memory of 672	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	10
PID 2656 wrote to memory of 672	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	10
PID 2656 wrote to memory of 752	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	11
PID 2656 wrote to memory of 752	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	11
PID 2656 wrote to memory of 752	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	11
PID 2656 wrote to memory of 752	2656	8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe	11

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:2008
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1532
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:752
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:812
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1116
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:860
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:976
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:272
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1036
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1056
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1136
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1340
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2132
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2188
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1164
- C:\Users\Admin\AppData\Local\Temp\8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
    C:\Users\Admin\AppData\Local\Temp\8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\8b554fee73fa7ce0a45dd2cd8b70022c_JaffaCakes118mgr.exe

Filesize
127KB

MD5
0ef920d7712d21dda563cab92b29b216

SHA1
643c7ae3eb3e8b89cdeba3bbb15604e7f210040c

SHA256
7cfaf531184febc33eb4c3de5f9bbeb4d946020ed1ad6b7e3fccefd121dd8e86

SHA512
948d74f9b9997354b256fe2b3545a564d5a3683bf274900e92e32d374e2e708685ac1f85d710cf09514cfd9cec4323509fd9598a8620078f074182b384e33bfe

Download Submit
memory/2656-22-0x0000000001400000-0x0000000003560000-memory.dmp

Filesize
33.4MB

Download
memory/2656-27-0x0000000000280000-0x00000000002DB000-memory.dmp

Filesize
364KB

Download
memory/2656-26-0x000000007EF90000-0x000000007EF9C000-memory.dmp

Filesize
48KB

Download
memory/2656-25-0x00000000774A0000-0x00000000774A1000-memory.dmp

Filesize
4KB

Download
memory/2656-24-0x000000007749F000-0x00000000774A0000-memory.dmp

Filesize
4KB

Download
memory/2656-23-0x0000000000280000-0x00000000002DB000-memory.dmp

Filesize
364KB

Download
memory/2656-28-0x0000000001400000-0x0000000003560000-memory.dmp

Filesize
33.4MB

Download
memory/2708-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2708-19-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download