ramnit | 53b012f50264df3a5d5ba81f9db53c7e3fed433830300313631a56b1cd795e73

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MusaLLaT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	aa4b253d3237c02a17c7da57de94c434.exe

Windows security bypass 2 TTPs 2 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	aa4b253d3237c02a17c7da57de94c434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	MusaLLaT.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\system32\drivers\etc\hosts	MusaLLaT.exe
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts	MusaLLaT.exe

Executes dropped EXE 5 IoCs

pid	Process
4992	aa4b253d3237c02a17c7da57de94c434Srv.exe
5048	DesktopLayer.exe
832	MusaLLaT.exe
864	MusaLLaTSrv.exe
1416	DesktopLayer.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5052-132-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/files/0x000a000000022f67-134.dat	upx
behavioral2/files/0x000a000000022f67-136.dat	upx
behavioral2/files/0x0007000000022f6c-138.dat	upx
behavioral2/files/0x0007000000022f6c-140.dat	upx
behavioral2/memory/4992-139-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/5048-142-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/files/0x0006000000022f6e-144.dat	upx
behavioral2/files/0x0006000000022f6e-145.dat	upx
behavioral2/files/0x0006000000022f6f-147.dat	upx
behavioral2/files/0x0006000000022f6f-149.dat	upx
behavioral2/files/0x0007000000022f6c-154.dat	upx
behavioral2/memory/864-153-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/files/0x0007000000022f6c-152.dat	upx
behavioral2/memory/5052-155-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/832-156-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral2/memory/832-157-0x0000000000400000-0x00000000004AD000-memory.dmp	upx

Windows security modification 2 TTPs 2 IoCs

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	aa4b253d3237c02a17c7da57de94c434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	MusaLLaT.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	MusaLLaT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusaLLaT = "C:\\Users\\Admin\\AppData\\Roaming\\MusaLLaT.exe"	MusaLLaT.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	aa4b253d3237c02a17c7da57de94c434.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MusaLLaT.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	aa4b253d3237c02a17c7da57de94c434Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	aa4b253d3237c02a17c7da57de94c434Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxDF2A.tmp	MusaLLaTSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	MusaLLaTSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxD6CD.tmp	aa4b253d3237c02a17c7da57de94c434Srv.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "568460159"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985506"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985506"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985506"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370464894"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4C795B42-3915-11ED-AECB-D2371B4A40BE} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "601896946"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "568460159"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5048	DesktopLayer.exe
5048	DesktopLayer.exe
5048	DesktopLayer.exe
5048	DesktopLayer.exe
5048	DesktopLayer.exe
5048	DesktopLayer.exe
5048	DesktopLayer.exe
5048	DesktopLayer.exe
1416	DesktopLayer.exe
1416	DesktopLayer.exe
1416	DesktopLayer.exe
1416	DesktopLayer.exe
1416	DesktopLayer.exe
1416	DesktopLayer.exe
1416	DesktopLayer.exe
1416	DesktopLayer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	5052	aa4b253d3237c02a17c7da57de94c434.exe
Token: SeBackupPrivilege	832	MusaLLaT.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5052	aa4b253d3237c02a17c7da57de94c434.exe
832	MusaLLaT.exe
1704	iexplore.exe
1704	iexplore.exe
616	IEXPLORE.EXE
616	IEXPLORE.EXE
616	IEXPLORE.EXE
616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4992	5052	aa4b253d3237c02a17c7da57de94c434.exe	82
PID 5052 wrote to memory of 4992	5052	aa4b253d3237c02a17c7da57de94c434.exe	82
PID 5052 wrote to memory of 4992	5052	aa4b253d3237c02a17c7da57de94c434.exe	82
PID 4992 wrote to memory of 5048	4992	aa4b253d3237c02a17c7da57de94c434Srv.exe	83
PID 4992 wrote to memory of 5048	4992	aa4b253d3237c02a17c7da57de94c434Srv.exe	83
PID 4992 wrote to memory of 5048	4992	aa4b253d3237c02a17c7da57de94c434Srv.exe	83
PID 5048 wrote to memory of 1704	5048	DesktopLayer.exe	84
PID 5048 wrote to memory of 1704	5048	DesktopLayer.exe	84
PID 5052 wrote to memory of 832	5052	aa4b253d3237c02a17c7da57de94c434.exe	85
PID 5052 wrote to memory of 832	5052	aa4b253d3237c02a17c7da57de94c434.exe	85
PID 5052 wrote to memory of 832	5052	aa4b253d3237c02a17c7da57de94c434.exe	85
PID 832 wrote to memory of 864	832	MusaLLaT.exe	86
PID 832 wrote to memory of 864	832	MusaLLaT.exe	86
PID 832 wrote to memory of 864	832	MusaLLaT.exe	86
PID 864 wrote to memory of 1416	864	MusaLLaTSrv.exe	87
PID 864 wrote to memory of 1416	864	MusaLLaTSrv.exe	87
PID 864 wrote to memory of 1416	864	MusaLLaTSrv.exe	87
PID 1416 wrote to memory of 2844	1416	DesktopLayer.exe	88
PID 1416 wrote to memory of 2844	1416	DesktopLayer.exe	88
PID 1704 wrote to memory of 616	1704	iexplore.exe	89
PID 1704 wrote to memory of 616	1704	iexplore.exe	89
PID 1704 wrote to memory of 616	1704	iexplore.exe	89

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	MusaLLaT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	aa4b253d3237c02a17c7da57de94c434.exe

C:\Users\Admin\AppData\Local\Temp\aa4b253d3237c02a17c7da57de94c434.exe
"C:\Users\Admin\AppData\Local\Temp\aa4b253d3237c02a17c7da57de94c434.exe"
1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5052
- C:\Users\Admin\AppData\Local\Temp\aa4b253d3237c02a17c7da57de94c434Srv.exe
  C:\Users\Admin\AppData\Local\Temp\aa4b253d3237c02a17c7da57de94c434Srv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
    "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:616
- C:\Users\Admin\AppData\Roaming\MusaLLaT.exe
  C:\Users\Admin\AppData\Roaming\MusaLLaT.exe
  2⤵
  - UAC bypass
  - Windows security bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:832
- - C:\Users\Admin\AppData\Roaming\MusaLLaTSrv.exe
    C:\Users\Admin\AppData\Roaming\MusaLLaTSrv.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1416
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        
        PID:2844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

Modify Registry