Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 07:34

General

  • Target

    fef1ec3367c1cdd00a658cc1879d48f1b2408fcd4f25c02b667a8272f24f2a2a.dll

  • Size

    176KB

  • MD5

    b52596cc2f51e4cca31b4be61a1c8ac0

  • SHA1

    89fdbc0d9781d1e2705b8712613e43b93aa436be

  • SHA256

    fef1ec3367c1cdd00a658cc1879d48f1b2408fcd4f25c02b667a8272f24f2a2a

  • SHA512

    f2fec90d388ffc46b9f1adfbde2c686b4f6e07fb778558ca99e22e21bc83997d4734bba425bb99fcb433452fe505fdfc301d4c125d817430d3e751ffa8ed0ad2

  • SSDEEP

    3072:pgKKuiX63bw5dNjDh8pWVgTlFIYnUBBOmCCYhTQw/adrEV:iKZp3KNjVGv5KYhMN4

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\fef1ec3367c1cdd00a658cc1879d48f1b2408fcd4f25c02b667a8272f24f2a2a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\fef1ec3367c1cdd00a658cc1879d48f1b2408fcd4f25c02b667a8272f24f2a2a.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:5084
        • C:\Program Files (x86)\Microsoft\WaterMark.exe
          "C:\Program Files (x86)\Microsoft\WaterMark.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:4160
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            5⤵
              PID:4788
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 204
                6⤵
                • Program crash
                PID:840
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4340
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4340 CREDAT:17410 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:1892
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
              • Modifies Internet Explorer settings
              PID:4448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4788 -ip 4788
      1⤵
        PID:1644

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\WaterMark.exe

        Filesize

        60KB

        MD5

        f75ba7b0befee8ceca41887a1c08275a

        SHA1

        c302a11726b67942df47bd592e0f16f4b55e27cd

        SHA256

        e17884dabe4a9f88f81cb7871f007699cc3f4ee349b12fa11e27750c6097104a

        SHA512

        23c379ad527f817382f9a38e2fda7cc6e77250289ca079a81a0e690fa8af98db290a55e953108788ecfbb6e1bf2746230c68fa1df513729d72758a782a768673

      • C:\Program Files (x86)\Microsoft\WaterMark.exe

        Filesize

        60KB

        MD5

        f75ba7b0befee8ceca41887a1c08275a

        SHA1

        c302a11726b67942df47bd592e0f16f4b55e27cd

        SHA256

        e17884dabe4a9f88f81cb7871f007699cc3f4ee349b12fa11e27750c6097104a

        SHA512

        23c379ad527f817382f9a38e2fda7cc6e77250289ca079a81a0e690fa8af98db290a55e953108788ecfbb6e1bf2746230c68fa1df513729d72758a782a768673

      • C:\Windows\SysWOW64\rundll32mgr.exe

        Filesize

        60KB

        MD5

        f75ba7b0befee8ceca41887a1c08275a

        SHA1

        c302a11726b67942df47bd592e0f16f4b55e27cd

        SHA256

        e17884dabe4a9f88f81cb7871f007699cc3f4ee349b12fa11e27750c6097104a

        SHA512

        23c379ad527f817382f9a38e2fda7cc6e77250289ca079a81a0e690fa8af98db290a55e953108788ecfbb6e1bf2746230c68fa1df513729d72758a782a768673

      • C:\Windows\SysWOW64\rundll32mgr.exe

        Filesize

        60KB

        MD5

        f75ba7b0befee8ceca41887a1c08275a

        SHA1

        c302a11726b67942df47bd592e0f16f4b55e27cd

        SHA256

        e17884dabe4a9f88f81cb7871f007699cc3f4ee349b12fa11e27750c6097104a

        SHA512

        23c379ad527f817382f9a38e2fda7cc6e77250289ca079a81a0e690fa8af98db290a55e953108788ecfbb6e1bf2746230c68fa1df513729d72758a782a768673

      • memory/1044-133-0x0000000010000000-0x000000001002E000-memory.dmp

        Filesize

        184KB

      • memory/4160-155-0x0000000000400000-0x0000000000423000-memory.dmp

        Filesize

        140KB

      • memory/4160-157-0x0000000000400000-0x0000000000423000-memory.dmp

        Filesize

        140KB

      • memory/4160-158-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4160-156-0x0000000000400000-0x0000000000423000-memory.dmp

        Filesize

        140KB

      • memory/4160-151-0x0000000000400000-0x0000000000423000-memory.dmp

        Filesize

        140KB

      • memory/4160-152-0x0000000000400000-0x0000000000423000-memory.dmp

        Filesize

        140KB

      • memory/4160-154-0x0000000000400000-0x0000000000423000-memory.dmp

        Filesize

        140KB

      • memory/4160-153-0x0000000000400000-0x0000000000423000-memory.dmp

        Filesize

        140KB

      • memory/5084-139-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/5084-145-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/5084-140-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB