ramnit | 5c5c580de78b4ccfe59e48079b1453d5bb06e47ec91b08379e285be9f1181e05

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f825c4601b5a0926d0c355d237aa06c1_JaffaCakes118.html
Size

159KB
MD5

f825c4601b5a0926d0c355d237aa06c1
SHA1

63449f8b840ab205dd7c63c3102555184a5637f0
SHA256

5c5c580de78b4ccfe59e48079b1453d5bb06e47ec91b08379e285be9f1181e05
SHA512

de61ee8aef1beb75f9fd4911342650efd5599344073bd22cb450379c241d793c8c5c37d85edd679ae162b16413fdff1934173148088cc2e1064a69210b12e656
SSDEEP

1536:ioRT/NNUsnrJA9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:iissK9yfkMY+BES09JXAnyrZalI+YQ

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2004	svchost.exe
2544	DesktopLayer.exe

Loads dropped DLL 2 IoCs

pid	Process
1648	IEXPLORE.EXE
2004	svchost.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00340000000186fd-433.dat	upx
behavioral1/memory/2544-445-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2004-437-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2004-436-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/2544-447-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxE3AB.tmp	svchost.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DesktopLayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440499464"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{770610C1-BB87-11EF-AF60-7ED3796B1EC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2544	DesktopLayer.exe
2544	DesktopLayer.exe
2544	DesktopLayer.exe
2544	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
2420	iexplore.exe
2420	iexplore.exe
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1648	2420	iexplore.exe	30
PID 2420 wrote to memory of 1648	2420	iexplore.exe	30
PID 2420 wrote to memory of 1648	2420	iexplore.exe	30
PID 2420 wrote to memory of 1648	2420	iexplore.exe	30
PID 1648 wrote to memory of 2004	1648	IEXPLORE.EXE	35
PID 1648 wrote to memory of 2004	1648	IEXPLORE.EXE	35
PID 1648 wrote to memory of 2004	1648	IEXPLORE.EXE	35
PID 1648 wrote to memory of 2004	1648	IEXPLORE.EXE	35
PID 2004 wrote to memory of 2544	2004	svchost.exe	36
PID 2004 wrote to memory of 2544	2004	svchost.exe	36
PID 2004 wrote to memory of 2544	2004	svchost.exe	36
PID 2004 wrote to memory of 2544	2004	svchost.exe	36
PID 2544 wrote to memory of 2052	2544	DesktopLayer.exe	37
PID 2544 wrote to memory of 2052	2544	DesktopLayer.exe	37
PID 2544 wrote to memory of 2052	2544	DesktopLayer.exe	37
PID 2544 wrote to memory of 2052	2544	DesktopLayer.exe	37
PID 2420 wrote to memory of 1748	2420	iexplore.exe	38
PID 2420 wrote to memory of 1748	2420	iexplore.exe	38
PID 2420 wrote to memory of 1748	2420	iexplore.exe	38
PID 2420 wrote to memory of 1748	2420	iexplore.exe	38

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f825c4601b5a0926d0c355d237aa06c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:209933 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb0e729ee85c848f1e54e00f80d99fd9

SHA1
7b3a8a3b7863db4a770b8149f7afe26a9c2caccd

SHA256
00d1383d01fe67fca77876fa170f09977e7bab155b1de39287d8e1a8db880bf9

SHA512
9dcd63da1ab6339af84a1991e0f74bd8b41750589f27cffac641594085027ffe8c5fe5830a10bfd253febd0a369fe38b49b953deb791587d662d3e04e2775dc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61ddccba7bd92a0845b59f0fe53edad2

SHA1
8a097c257713911cac4df254082068cd6fdbe7a4

SHA256
3c1b434e982435e179058baf553779b82c1b1b90c33c9a5339a6f8e3084abecb

SHA512
b134b389fe585b4221ddb7c567881dd4e7ac6830fea4fb4c7095d64db1ffed76cb56f4871172c10337aa2701e945c9a75f35b8903e07e41819f7bc7e2329f2d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07deba2743c5c943f7bd3f0115f2cde5

SHA1
419f2bc8429eb25dbe40b380ec296652c087e76a

SHA256
818db7ac5f5b48511fa46eff0d3555fa17ade755d172c32e1645b220295e8cf2

SHA512
51ea5b5d8052b1d3c2f4c2763ed401a59c8c408af34913d60f74307399d22a5543b75c8a0eba609f791b6d57d16c244baed473ec993dbfc421db6b6ace46319c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1889a66bb757e19c6be843d14ae8d5f

SHA1
bf2b1a1ba7fca0e1bb01366d9e59daa8d14df714

SHA256
532df0fbe83810d9edbaac1218bc76ca74ca38db1a43a70b14231ca206cf1297

SHA512
7b0c62d0420e1a4b6bb88adcbeecf65771f27c3e65fd202e79c30294811308efe5326eac9386b0899550ba48114540541b66d752c52d4720018b50dc7f6c8c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
990db8f54f8a2c8e79e70d398ed7e74a

SHA1
460a50122d13ba993ba71a5e84c2ce4945130ef0

SHA256
255f493f653624edc49e7aa6140cb6333efc328506db51419577dc45780d3507

SHA512
01c99b3c2800cb438fabb311e74e5d265d76605f6d67ecb48180d1daeb107cd60705757d6b73c13188c7f968566684af619797a2d56ad90b1538cc3d09cebaf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4243a9b5369c072dc89b7aacc8c7365

SHA1
2317874a4e80b1e17609052e7cd0c3c0bd9a8df8

SHA256
c40a204ef7069d59483ca3af48907947b306c9d3e41668d6bdaf7378360fdacb

SHA512
2139fdef242d7013eca8b1a9879a631a117136091e4dcbb76c105f0ab48b8dd3c4697757511080b1dda60eb014fc2cf1543131e79797496c2878e0d70be57221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc309d64566e14cd4a6e4325484a7ca4

SHA1
1d65073416ba16a908d766258e1004bc5cc679f1

SHA256
e1cbf018f7e30fc0c832cbe89cf717fb87783a3bfcc4aa1f1e293ebd1a0032b7

SHA512
ab6e7b262f7f2270abeec8efa3023f3ee3d99357c3a5963bc1e5d132378e6b23254c6af37089f3c7fe2f7c09a140f37a0b3d44df132cbfc59b4d632b34e81286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95fd8d7ec4722530fed06797039b2c02

SHA1
f1cf27aecca09387dd1e291015436cea16f0c5ef

SHA256
aa6af11d69b7877edd5cb5127ec67dc4906d8c9f90990062a5337caa238eeeb8

SHA512
678f034212a6d6616270cec9be3814fa2c3c4bdcf4ee105817254a82de4ae6abe9565479f937f856966d477b6dac6281b9787eab8438a8eee4c1a9e8e0a58418

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/2004-437-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2004-436-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2544-444-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2544-445-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2544-447-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download