Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    10s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2024, 09:59

General

  • Target

    02db6c6dd0119ae4dd092c95269ef0fa.exe

  • Size

    104KB

  • MD5

    02db6c6dd0119ae4dd092c95269ef0fa

  • SHA1

    0c847bd4af6ef9eb9da384374fb70117be59150d

  • SHA256

    1e835832f440f1a949ff14547bfe943013f5211e3d5ad80632048554861d70ee

  • SHA512

    b83eef9cd127287da84fc6682b2cf84a1e6961d961fc6b194150ccce15fbdf5dae273a584041d39ffbabb7a55a7e922e43e1be8e67c1dce782360fb31f9d966b

  • SSDEEP

    3072:lQ5faGko6CFrbJKARb0WQ9FSE1Fk8jwaaHw7Koj4rgdy:61afCF3IO0WmFR

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Program crash 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02db6c6dd0119ae4dd092c95269ef0fa.exe
    "C:\Users\Admin\AppData\Local\Temp\02db6c6dd0119ae4dd092c95269ef0fa.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:4876
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3576
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:3156
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          2⤵
            PID:4064
          • C:\Users\Admin\AppData\Local\Temp\jcauhppdosanovdb.exe
            "C:\Users\Admin\AppData\Local\Temp\jcauhppdosanovdb.exe"
            2⤵
              PID:2916
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4876 -ip 4876
            1⤵
              PID:548
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 208
              1⤵
              • Program crash
              PID:3276
            • C:\Program Files\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
              1⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4496
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4496 CREDAT:17410 /prefetch:2
                2⤵
                  PID:668
                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4496 CREDAT:17416 /prefetch:2
                  2⤵
                    PID:4352
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 204
                  1⤵
                  • Program crash
                  PID:4428
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3156 -ip 3156
                  1⤵
                    PID:1512
                  • C:\Program Files\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
                    1⤵
                      PID:4948

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/1952-2-0x00000000009F0000-0x00000000009F2000-memory.dmp

                      Filesize

                      8KB

                    • memory/1952-17-0x0000000077092000-0x0000000077093000-memory.dmp

                      Filesize

                      4KB

                    • memory/1952-16-0x0000000000400000-0x0000000000439CD4-memory.dmp

                      Filesize

                      231KB

                    • memory/1952-7-0x0000000077092000-0x0000000077093000-memory.dmp

                      Filesize

                      4KB

                    • memory/1952-5-0x0000000000A10000-0x0000000000A11000-memory.dmp

                      Filesize

                      4KB

                    • memory/1952-4-0x0000000000A00000-0x0000000000A01000-memory.dmp

                      Filesize

                      4KB

                    • memory/1952-0-0x0000000000400000-0x0000000000439CD4-memory.dmp

                      Filesize

                      231KB

                    • memory/1952-10-0x0000000000400000-0x0000000000439CD4-memory.dmp

                      Filesize

                      231KB

                    • memory/1952-1-0x0000000000400000-0x0000000000439CD4-memory.dmp

                      Filesize

                      231KB

                    • memory/1952-14-0x0000000000400000-0x0000000000439CD4-memory.dmp

                      Filesize

                      231KB

                    • memory/2916-34-0x0000000000400000-0x0000000000439CD4-memory.dmp

                      Filesize

                      231KB

                    • memory/2916-32-0x0000000002060000-0x0000000002062000-memory.dmp

                      Filesize

                      8KB

                    • memory/2916-30-0x0000000000400000-0x0000000000439CD4-memory.dmp

                      Filesize

                      231KB

                    • memory/4876-9-0x00000000007D0000-0x00000000007D1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4876-8-0x00000000007F0000-0x00000000007F1000-memory.dmp

                      Filesize

                      4KB