ramnit | 95682b986bd9c25edf601ca5a25307e3ff18ed1701db0c3bb6d055ea9ab9ce01

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e799f5f93be1d375d053a630d64998a9_JaffaCakes118.html
Size

162KB
MD5

e799f5f93be1d375d053a630d64998a9
SHA1

d182cd9dbef2d31b7007700724440699d2f88cbf
SHA256

95682b986bd9c25edf601ca5a25307e3ff18ed1701db0c3bb6d055ea9ab9ce01
SHA512

ab3b1c5b4bab11a97ccce10a7a67e11e2f7ecb953a651340d72bc655ef7d973bc0c1ba3c874543b3ce50fe92798a1d4efe7bbcfd80bd2f2552707141b9dc6104
SSDEEP

1536:iMRT0O2sALfAyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:iOjALAyfkMY+BES09JXAnyrZalI+YQ

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2904	svchost.exe
568	DesktopLayer.exe

Loads dropped DLL 2 IoCs

pid	Process
2352	IEXPLORE.EXE
2904	svchost.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x003800000001938e-430.dat	upx
behavioral1/memory/2904-434-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2904-437-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2904-436-0x00000000001C0000-0x00000000001CF000-memory.dmp	upx
behavioral1/memory/2904-441-0x0000000000270000-0x000000000029E000-memory.dmp	upx
behavioral1/memory/568-445-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/568-447-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/568-450-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxAB2D.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{147148C1-B8B3-11EF-8BF0-428107983482} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440188349"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
568	DesktopLayer.exe
568	DesktopLayer.exe
568	DesktopLayer.exe
568	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1864	iexplore.exe
1864	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1864	iexplore.exe
1864	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
1864	iexplore.exe
1864	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2352	1864	iexplore.exe	30
PID 1864 wrote to memory of 2352	1864	iexplore.exe	30
PID 1864 wrote to memory of 2352	1864	iexplore.exe	30
PID 1864 wrote to memory of 2352	1864	iexplore.exe	30
PID 2352 wrote to memory of 2904	2352	IEXPLORE.EXE	35
PID 2352 wrote to memory of 2904	2352	IEXPLORE.EXE	35
PID 2352 wrote to memory of 2904	2352	IEXPLORE.EXE	35
PID 2352 wrote to memory of 2904	2352	IEXPLORE.EXE	35
PID 2904 wrote to memory of 568	2904	svchost.exe	36
PID 2904 wrote to memory of 568	2904	svchost.exe	36
PID 2904 wrote to memory of 568	2904	svchost.exe	36
PID 2904 wrote to memory of 568	2904	svchost.exe	36
PID 568 wrote to memory of 1444	568	DesktopLayer.exe	37
PID 568 wrote to memory of 1444	568	DesktopLayer.exe	37
PID 568 wrote to memory of 1444	568	DesktopLayer.exe	37
PID 568 wrote to memory of 1444	568	DesktopLayer.exe	37
PID 1864 wrote to memory of 2280	1864	iexplore.exe	38
PID 1864 wrote to memory of 2280	1864	iexplore.exe	38
PID 1864 wrote to memory of 2280	1864	iexplore.exe	38
PID 1864 wrote to memory of 2280	1864	iexplore.exe	38

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e799f5f93be1d375d053a630d64998a9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:568
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275477 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab05a61579ffc656dfa6f41675fce9be

SHA1
e71d548bfaee283b439c9f7e4dd9261839839058

SHA256
a486857c1dd12c5d4d9cbfd8cddaabe78adb176b603b7cf5371f1eb04d1f2454

SHA512
eeef35b60d5fd51ffa1324ecfefac73639471bb3936c38430ea4a7cfae62644353edee2b5b6d7b70aaf78f606cc329134b8f8199d4f736696b3f12dbe3a21345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c722b0a50234f53e7743b120864c30a9

SHA1
8f332490b9bc044fdf27df4e0aafc788a4e43f81

SHA256
009961a383bb754c723349a9f9c6b619d2ef64879fd73d0f1055f4acce8a1b83

SHA512
b152040c11dd8ace67e3e24fb2f8ff600ae64225e8669de58c531e6b5d06a46e36dd8d05107939a2f83bbc9c60ece673da33d6aae12ca9b6360e630ad77cb6ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b123bd35388339a974437376cdd886c

SHA1
eeb386098d0b1d74d7d4598b712d650b44b97e1b

SHA256
7acc26304a2ce42264be1a0494a62eee166d55b60e7babbec911c4c452f57317

SHA512
94f3c37d8dd44c053864695bca7003f690f0bbadfe286bbd5c617f247cb451337c27024ff2baca86973b56dffe2002bd3f2637088ce3ea03c5756f1c7e5b0b46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a293f10a0597a0969415bc4f148a17d2

SHA1
31ea5c18cdfe05350420e7755d3fa7113fb5801e

SHA256
04fdda05bf3c06d4f9b554bafc842c89b637851d3c4f7f2684f2b9132021bc2c

SHA512
3342c7539c9559550e28e4a6e107271fc513c3c878f4783dee3251e69814071f800edfceb578f055459be98607b95ead6f5d0de6de03ca8d47c9e392aa4300c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c239839f56ae76c9afbabf1565bfaff

SHA1
3e6f1eb821dad8f290a1f43a8a52272cc316d3c8

SHA256
e232c44c097fca9eccba586ec080f5dd1bca0c4e6f31ddc490d79dbdad22df74

SHA512
af0b97cadad2845777de1a28623375d0c8507af660ce554928168ef9ce165cbead64efbd0906dc6a8b2e46a81eeafde76197e4c3847814309bb9ef1a0461fa4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5da66106a27da365fb85c4dd25d03083

SHA1
c6f5251edf390af156dec2b8cb3db7797e695262

SHA256
c6b76176340d03965bcb4fd628881f5738c1dc56de9c840b3e741e2544f1493a

SHA512
e23b7d765699d70cdb7564f49c007f40e5fdd0cafe977c9d58d09c06dfd4fa5d560997e655cc427bba5ef2f71d13618fae6ac2726968e0df79397d4485fb547f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86ce16f0ca4b79fde409aea19197f3c1

SHA1
1e6a3e71f429023369d024b1133ac05b7dfed822

SHA256
830b7af94bf9a9a39042f374ebe7fcd3f9347b39f262495796c622fb449b3706

SHA512
7727ae9d91a487929aa389c99286fa3b6f0f48ab4c549c17ee7dca7e3b549b86cc12be256d6cfe006a879b338aab0c40153599aa70fabd0ec61b838375f3ef44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f75b0f379077573f152f9cc9a37d12e4

SHA1
dda29a7f8f83acf2c55c9a23f37cb8763c297eab

SHA256
ba481a40a6cbd43b6463731ee6908b52f738a01e534b0e543b4a02517e272b82

SHA512
d004ca10836734774f062467460609424c08926cc6905e6a3c8bb3932d7ff17ee26a3741f51ae7f36b1c09e5ca593af423802fdb016b83195da51b7de60de952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2023d34dff98a50b92207e71b839791

SHA1
a0ebb8dbbb2f3a8189ceafd7fd209575bd8f4c5b

SHA256
8882521beca61ae2a0ed56d82a92899db206616cb8acc3fce8068fd4ac63b0b6

SHA512
abbadf5911bba3643ab41fc4a2b63c5ef9485f8bcb529663c23bb564ad5d597d284ffbec592c722666a357bcf24a3718443005613afd932fd09fa84e53af0eb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5208529da96235fe3867ecb08b33afee

SHA1
9de16579d5ea3644663d7078c39ea30cbe5e5f0e

SHA256
a46dc1327d87877d313bf59a71d50d4bb84a839394ef6665806dd108948560fe

SHA512
4ae9c855e0f61c37eba40c0b3635c8507fd869771fc0554637b8bda74b3ee520e7192d74f325df95d8ba97177c5d2042da2cae09ac29828a1878dc29f07df774

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBDC5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBEA3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/568-448-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/568-450-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/568-447-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/568-445-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2904-441-0x0000000000270000-0x000000000029E000-memory.dmp

Filesize
184KB

Download
memory/2904-436-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download
memory/2904-437-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2904-434-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download