Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 19:35

General

  • Target

    aba55ba555f43f1fccb63b640c87a347bbca236bf19107dd1f33412cefb03baa.dll

  • Size

    156KB

  • MD5

    be04cb75888afe3e1076f03ea7437d81

  • SHA1

    69048dd422408cdb8537f6dbd0cdee6a90f70e93

  • SHA256

    aba55ba555f43f1fccb63b640c87a347bbca236bf19107dd1f33412cefb03baa

  • SHA512

    e31eaf8e958d153e7c2c3ee1f4962a908ac6256fd217a440fb58f1522d09f53b056606aef43f5621be5a34298b7d519069c9ae65e15c98ff27c17df310a98dab

  • SSDEEP

    3072:3vY2M8wRBjnPWMowyrR1PFOH4jI/PGYMFMQ1iK9LhBttAXOeIZQoXT3V:TiPWMowyrDC4jI/PGr1i+hBRqo

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 2 TTPs 6 IoCs
  • Modifies security service 2 TTPs 8 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aba55ba555f43f1fccb63b640c87a347bbca236bf19107dd1f33412cefb03baa.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\aba55ba555f43f1fccb63b640c87a347bbca236bf19107dd1f33412cefb03baa.dll
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Users\Admin\AppData\Local\Temp\oJfxHI1K
        "oJfxHI1K"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:804
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1496
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies firewall policy service
          • Modifies security service
          • UAC bypass
          • Windows security bypass
          • Drops startup file
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1136
        • C:\Users\Admin\AppData\Local\Temp\ddbjiefi.exe
          "C:\Users\Admin\AppData\Local\Temp\ddbjiefi.exe" elevate
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:456
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\ddbjiefi.exe"" admin
            5⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:396
            • C:\Users\Admin\AppData\Local\Temp\ddbjiefi.exe
              "C:\Users\Admin\AppData\Local\Temp\ddbjiefi.exe" admin
              6⤵
              • Modifies firewall policy service
              • Modifies security service
              • UAC bypass
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Checks whether UAC is enabled
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • System policy modification
              PID:2024

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ddbjiefi.exe

    Filesize

    99KB

    MD5

    2f5964aefc23c144312263bcde6f4c29

    SHA1

    7235402d08be134c24289c202b21437cfdee6a44

    SHA256

    9c04fadd4b513f6d221d903e513bc6ce07b9a564db88cbce174db6d9e9a75831

    SHA512

    afe0a089537669cb1de2ab4ed9575665d9837e84cad5acceba5fc22adbc086b51cdadbab8348f940c6908179fc4509d6d0954cba459f9248ae00a9b708803869

  • C:\Users\Admin\AppData\Local\Temp\ddbjiefi.exe

    Filesize

    99KB

    MD5

    2f5964aefc23c144312263bcde6f4c29

    SHA1

    7235402d08be134c24289c202b21437cfdee6a44

    SHA256

    9c04fadd4b513f6d221d903e513bc6ce07b9a564db88cbce174db6d9e9a75831

    SHA512

    afe0a089537669cb1de2ab4ed9575665d9837e84cad5acceba5fc22adbc086b51cdadbab8348f940c6908179fc4509d6d0954cba459f9248ae00a9b708803869

  • C:\Users\Admin\AppData\Local\Temp\ddbjiefi.exe

    Filesize

    99KB

    MD5

    2f5964aefc23c144312263bcde6f4c29

    SHA1

    7235402d08be134c24289c202b21437cfdee6a44

    SHA256

    9c04fadd4b513f6d221d903e513bc6ce07b9a564db88cbce174db6d9e9a75831

    SHA512

    afe0a089537669cb1de2ab4ed9575665d9837e84cad5acceba5fc22adbc086b51cdadbab8348f940c6908179fc4509d6d0954cba459f9248ae00a9b708803869

  • C:\Users\Admin\AppData\Local\Temp\oJfxHI1K

    Filesize

    99KB

    MD5

    2f5964aefc23c144312263bcde6f4c29

    SHA1

    7235402d08be134c24289c202b21437cfdee6a44

    SHA256

    9c04fadd4b513f6d221d903e513bc6ce07b9a564db88cbce174db6d9e9a75831

    SHA512

    afe0a089537669cb1de2ab4ed9575665d9837e84cad5acceba5fc22adbc086b51cdadbab8348f940c6908179fc4509d6d0954cba459f9248ae00a9b708803869

  • C:\Users\Admin\AppData\Local\Temp\oJfxHI1K

    Filesize

    99KB

    MD5

    2f5964aefc23c144312263bcde6f4c29

    SHA1

    7235402d08be134c24289c202b21437cfdee6a44

    SHA256

    9c04fadd4b513f6d221d903e513bc6ce07b9a564db88cbce174db6d9e9a75831

    SHA512

    afe0a089537669cb1de2ab4ed9575665d9837e84cad5acceba5fc22adbc086b51cdadbab8348f940c6908179fc4509d6d0954cba459f9248ae00a9b708803869

  • \Users\Admin\AppData\Local\Temp\ddbjiefi.exe

    Filesize

    99KB

    MD5

    2f5964aefc23c144312263bcde6f4c29

    SHA1

    7235402d08be134c24289c202b21437cfdee6a44

    SHA256

    9c04fadd4b513f6d221d903e513bc6ce07b9a564db88cbce174db6d9e9a75831

    SHA512

    afe0a089537669cb1de2ab4ed9575665d9837e84cad5acceba5fc22adbc086b51cdadbab8348f940c6908179fc4509d6d0954cba459f9248ae00a9b708803869

  • \Users\Admin\AppData\Local\Temp\ddbjiefi.exe

    Filesize

    99KB

    MD5

    2f5964aefc23c144312263bcde6f4c29

    SHA1

    7235402d08be134c24289c202b21437cfdee6a44

    SHA256

    9c04fadd4b513f6d221d903e513bc6ce07b9a564db88cbce174db6d9e9a75831

    SHA512

    afe0a089537669cb1de2ab4ed9575665d9837e84cad5acceba5fc22adbc086b51cdadbab8348f940c6908179fc4509d6d0954cba459f9248ae00a9b708803869

  • \Users\Admin\AppData\Local\Temp\ddbjiefi.exe

    Filesize

    99KB

    MD5

    2f5964aefc23c144312263bcde6f4c29

    SHA1

    7235402d08be134c24289c202b21437cfdee6a44

    SHA256

    9c04fadd4b513f6d221d903e513bc6ce07b9a564db88cbce174db6d9e9a75831

    SHA512

    afe0a089537669cb1de2ab4ed9575665d9837e84cad5acceba5fc22adbc086b51cdadbab8348f940c6908179fc4509d6d0954cba459f9248ae00a9b708803869

  • \Users\Admin\AppData\Local\Temp\ddbjiefi.exe

    Filesize

    99KB

    MD5

    2f5964aefc23c144312263bcde6f4c29

    SHA1

    7235402d08be134c24289c202b21437cfdee6a44

    SHA256

    9c04fadd4b513f6d221d903e513bc6ce07b9a564db88cbce174db6d9e9a75831

    SHA512

    afe0a089537669cb1de2ab4ed9575665d9837e84cad5acceba5fc22adbc086b51cdadbab8348f940c6908179fc4509d6d0954cba459f9248ae00a9b708803869

  • \Users\Admin\AppData\Local\Temp\oJfxHI1K

    Filesize

    99KB

    MD5

    2f5964aefc23c144312263bcde6f4c29

    SHA1

    7235402d08be134c24289c202b21437cfdee6a44

    SHA256

    9c04fadd4b513f6d221d903e513bc6ce07b9a564db88cbce174db6d9e9a75831

    SHA512

    afe0a089537669cb1de2ab4ed9575665d9837e84cad5acceba5fc22adbc086b51cdadbab8348f940c6908179fc4509d6d0954cba459f9248ae00a9b708803869

  • \Users\Admin\AppData\Local\Temp\oJfxHI1K

    Filesize

    99KB

    MD5

    2f5964aefc23c144312263bcde6f4c29

    SHA1

    7235402d08be134c24289c202b21437cfdee6a44

    SHA256

    9c04fadd4b513f6d221d903e513bc6ce07b9a564db88cbce174db6d9e9a75831

    SHA512

    afe0a089537669cb1de2ab4ed9575665d9837e84cad5acceba5fc22adbc086b51cdadbab8348f940c6908179fc4509d6d0954cba459f9248ae00a9b708803869

  • memory/456-87-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/804-81-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1136-77-0x0000000020010000-0x000000002002E000-memory.dmp

    Filesize

    120KB

  • memory/1136-73-0x0000000020010000-0x000000002002E000-memory.dmp

    Filesize

    120KB

  • memory/1496-67-0x0000000020010000-0x000000002001D000-memory.dmp

    Filesize

    52KB

  • memory/1496-64-0x0000000020010000-0x000000002001D000-memory.dmp

    Filesize

    52KB

  • memory/1640-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

    Filesize

    8KB

  • memory/2004-56-0x0000000075811000-0x0000000075813000-memory.dmp

    Filesize

    8KB

  • memory/2024-95-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2024-96-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB