Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/10/2022, 20:09

General

  • Target

    9a2da43c31770737e087aa5d89375ad38edfb5d1ccf36d7f8e4adee543ae7b74.dll

  • Size

    451KB

  • MD5

    0cc2459d49e98fba1523fd625dadc7d0

  • SHA1

    6aa7d7b5795de1e8d88deb12e4f7074194ddefc6

  • SHA256

    9a2da43c31770737e087aa5d89375ad38edfb5d1ccf36d7f8e4adee543ae7b74

  • SHA512

    c19ff9f461a34f0b66aaa988db4b3f555f9a62eeef256aef2db570c5aafb7be027e5d0567e881706e5d0447dbb6a61061905d9b8be834ebd72da58e0e10705c9

  • SSDEEP

    6144:IxlKdRE3WBmv8QdDHViAsl5FRu56zQwmSkY2G5L8v1kcRv4Dyg32+LOpqOQXFTyP:iWBohJVi/KyzfMGt8uJn4I1y

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9a2da43c31770737e087aa5d89375ad38edfb5d1ccf36d7f8e4adee543ae7b74.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\9a2da43c31770737e087aa5d89375ad38edfb5d1ccf36d7f8e4adee543ae7b74.dll
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2468
      • C:\Windows\SysWOW64\regsvr32mgr.exe
        C:\Windows\SysWOW64\regsvr32mgr.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4836
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 520
          4⤵
          • Program crash
          PID:4736
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 668
        3⤵
        • Program crash
        PID:1532
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2468 -ip 2468
    1⤵
      PID:440
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4836 -ip 4836
      1⤵
        PID:2892

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\~TMBCDC.tmp

        Filesize

        1.6MB

        MD5

        4f3387277ccbd6d1f21ac5c07fe4ca68

        SHA1

        e16506f662dc92023bf82def1d621497c8ab5890

        SHA256

        767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

        SHA512

        9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

      • C:\Windows\SysWOW64\regsvr32mgr.exe

        Filesize

        106KB

        MD5

        fe36fb1073e6f8fa14d7250501a29aaf

        SHA1

        6c7e01278362797dabcff3e666b68227cb9af10f

        SHA256

        f34e5af97ccb3574f7d5343246138daf979bfd1f9c37590e9a41f6420ddb3bb6

        SHA512

        8584c008c5780352f634c37b7f46543a26280b57577b675f6e72185bfc1d95f771d210d799d704eceaba509ebfd2796fb43829495d5b2a568c741ad2d44f882f

      • C:\Windows\SysWOW64\regsvr32mgr.exe

        Filesize

        106KB

        MD5

        fe36fb1073e6f8fa14d7250501a29aaf

        SHA1

        6c7e01278362797dabcff3e666b68227cb9af10f

        SHA256

        f34e5af97ccb3574f7d5343246138daf979bfd1f9c37590e9a41f6420ddb3bb6

        SHA512

        8584c008c5780352f634c37b7f46543a26280b57577b675f6e72185bfc1d95f771d210d799d704eceaba509ebfd2796fb43829495d5b2a568c741ad2d44f882f

      • memory/2468-137-0x0000000000AD0000-0x0000000000BC9000-memory.dmp

        Filesize

        996KB

      • memory/4836-138-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/4836-139-0x0000000002020000-0x000000000204A000-memory.dmp

        Filesize

        168KB

      • memory/4836-140-0x0000000077BD0000-0x0000000077D73000-memory.dmp

        Filesize

        1.6MB