Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 06:09

General

  • Target

    c7e1293ced0f737be3a9b57532fb1ce4.exe

  • Size

    101KB

  • MD5

    c7e1293ced0f737be3a9b57532fb1ce4

  • SHA1

    680885f3826c7775c112c734cdc97a1cda17d0be

  • SHA256

    7e4ad8b40121445fd07609684f39a629054c5b6b0924d446c5a1dea80bf0452c

  • SHA512

    38bf57af0cca69f8f8cd6ed0184cd462c905f3466a260d6b1dd627caea31272804f72b1e4a7e41666dcaa50decbe1249124d42a7d8b1217c307e719e1bfa61ba

  • SSDEEP

    3072:9gIpT1t2YXm8XdstQculie6qbcU5jwaaHw7Koj4r:aIx1dX3XCt2bB

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UAC bypass 3 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7e1293ced0f737be3a9b57532fb1ce4.exe
    "C:\Users\Admin\AppData\Local\Temp\c7e1293ced0f737be3a9b57532fb1ce4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2932
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Checks BIOS information in registry
      • Drops startup file
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2584
    • C:\Users\Admin\AppData\Local\Temp\bvanjvfbrdtciwoi.exe
      "C:\Users\Admin\AppData\Local\Temp\bvanjvfbrdtciwoi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:692

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\bkkgwtwe\jqcshtgu.exe

          Filesize

          101KB

          MD5

          c7e1293ced0f737be3a9b57532fb1ce4

          SHA1

          680885f3826c7775c112c734cdc97a1cda17d0be

          SHA256

          7e4ad8b40121445fd07609684f39a629054c5b6b0924d446c5a1dea80bf0452c

          SHA512

          38bf57af0cca69f8f8cd6ed0184cd462c905f3466a260d6b1dd627caea31272804f72b1e4a7e41666dcaa50decbe1249124d42a7d8b1217c307e719e1bfa61ba

        • memory/692-85-0x0000000000400000-0x000000000043A200-memory.dmp

          Filesize

          232KB

        • memory/692-86-0x0000000000220000-0x0000000000222000-memory.dmp

          Filesize

          8KB

        • memory/692-88-0x0000000000400000-0x000000000043A200-memory.dmp

          Filesize

          232KB

        • memory/2536-5-0x00000000003A0000-0x00000000003A2000-memory.dmp

          Filesize

          8KB

        • memory/2536-7-0x00000000771B0000-0x00000000771B1000-memory.dmp

          Filesize

          4KB

        • memory/2536-9-0x00000000771AF000-0x00000000771B0000-memory.dmp

          Filesize

          4KB

        • memory/2536-0-0x0000000000400000-0x000000000043A200-memory.dmp

          Filesize

          232KB

        • memory/2536-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

          Filesize

          4KB

        • memory/2536-3-0x0000000000440000-0x0000000000441000-memory.dmp

          Filesize

          4KB

        • memory/2536-83-0x00000000771AF000-0x00000000771B0000-memory.dmp

          Filesize

          4KB

        • memory/2536-80-0x0000000002520000-0x000000000255B000-memory.dmp

          Filesize

          236KB

        • memory/2536-79-0x0000000000400000-0x000000000043A200-memory.dmp

          Filesize

          232KB

        • memory/2536-78-0x0000000002530000-0x000000000256B000-memory.dmp

          Filesize

          236KB

        • memory/2536-71-0x0000000002520000-0x000000000255B000-memory.dmp

          Filesize

          236KB

        • memory/2536-4-0x0000000000400000-0x000000000043A200-memory.dmp

          Filesize

          232KB

        • memory/2536-51-0x00000000771B0000-0x00000000771B1000-memory.dmp

          Filesize

          4KB

        • memory/2584-54-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-89-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-43-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-44-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-50-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-28-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-52-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-98-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-55-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-56-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-57-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-58-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-60-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-59-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-61-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-62-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-63-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-97-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-96-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-95-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-94-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-92-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-91-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-90-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2584-34-0x0000000020010000-0x000000002002C000-memory.dmp

          Filesize

          112KB

        • memory/2932-8-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2932-11-0x0000000000050000-0x0000000000051000-memory.dmp

          Filesize

          4KB

        • memory/2932-17-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2932-15-0x0000000000070000-0x0000000000071000-memory.dmp

          Filesize

          4KB

        • memory/2932-16-0x0000000000050000-0x0000000000051000-memory.dmp

          Filesize

          4KB

        • memory/2932-18-0x0000000000060000-0x0000000000061000-memory.dmp

          Filesize

          4KB

        • memory/2932-22-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2932-23-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB

        • memory/2932-24-0x0000000020010000-0x000000002001C000-memory.dmp

          Filesize

          48KB