Analysis

  • max time kernel
    120s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 06:09

General

  • Target

    c7e1293ced0f737be3a9b57532fb1ce4.exe

  • Size

    101KB

  • MD5

    c7e1293ced0f737be3a9b57532fb1ce4

  • SHA1

    680885f3826c7775c112c734cdc97a1cda17d0be

  • SHA256

    7e4ad8b40121445fd07609684f39a629054c5b6b0924d446c5a1dea80bf0452c

  • SHA512

    38bf57af0cca69f8f8cd6ed0184cd462c905f3466a260d6b1dd627caea31272804f72b1e4a7e41666dcaa50decbe1249124d42a7d8b1217c307e719e1bfa61ba

  • SSDEEP

    3072:9gIpT1t2YXm8XdstQculie6qbcU5jwaaHw7Koj4r:aIx1dX3XCt2bB

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7e1293ced0f737be3a9b57532fb1ce4.exe
    "C:\Users\Admin\AppData\Local\Temp\c7e1293ced0f737be3a9b57532fb1ce4.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:5104
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 208
          3⤵
          • Program crash
          PID:4676
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3860
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4976
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4976 CREDAT:17410 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:3568
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4976 CREDAT:82950 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4456
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:1872
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 212
            3⤵
            • Program crash
            PID:4840
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3836
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
            3⤵
            • Modifies Internet Explorer settings
            PID:4112
        • C:\Users\Admin\AppData\Local\Temp\yholordothmlnohk.exe
          "C:\Users\Admin\AppData\Local\Temp\yholordothmlnohk.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5096
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5104 -ip 5104
        1⤵
          PID:5116
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1872 -ip 1872
          1⤵
            PID:1848
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4008 --field-trial-handle=3044,i,17059189006398306756,4247826696353232857,262144 --variations-seed-version /prefetch:8
            1⤵
              PID:1384

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R2H8ZEZE\suggestions[1].en-US

                    Filesize

                    17KB

                    MD5

                    5a34cb996293fde2cb7a4ac89587393a

                    SHA1

                    3c96c993500690d1a77873cd62bc639b3a10653f

                    SHA256

                    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                    SHA512

                    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                  • C:\Users\Admin\AppData\Local\Temp\yholordothmlnohk.exe

                    Filesize

                    101KB

                    MD5

                    c7e1293ced0f737be3a9b57532fb1ce4

                    SHA1

                    680885f3826c7775c112c734cdc97a1cda17d0be

                    SHA256

                    7e4ad8b40121445fd07609684f39a629054c5b6b0924d446c5a1dea80bf0452c

                    SHA512

                    38bf57af0cca69f8f8cd6ed0184cd462c905f3466a260d6b1dd627caea31272804f72b1e4a7e41666dcaa50decbe1249124d42a7d8b1217c307e719e1bfa61ba

                  • memory/4148-10-0x0000000000400000-0x000000000043A200-memory.dmp

                    Filesize

                    232KB

                  • memory/4148-18-0x0000000077212000-0x0000000077213000-memory.dmp

                    Filesize

                    4KB

                  • memory/4148-6-0x00000000004F0000-0x00000000004F1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4148-4-0x00000000004E0000-0x00000000004E1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4148-1-0x0000000000400000-0x000000000043A200-memory.dmp

                    Filesize

                    232KB

                  • memory/4148-2-0x00000000004D0000-0x00000000004D2000-memory.dmp

                    Filesize

                    8KB

                  • memory/4148-0-0x0000000000400000-0x000000000043A200-memory.dmp

                    Filesize

                    232KB

                  • memory/4148-11-0x00000000004D0000-0x00000000004D2000-memory.dmp

                    Filesize

                    8KB

                  • memory/4148-15-0x0000000000400000-0x000000000043A200-memory.dmp

                    Filesize

                    232KB

                  • memory/4148-17-0x0000000000400000-0x000000000043A200-memory.dmp

                    Filesize

                    232KB

                  • memory/4148-5-0x0000000077212000-0x0000000077213000-memory.dmp

                    Filesize

                    4KB

                  • memory/5096-33-0x0000000000400000-0x000000000043A200-memory.dmp

                    Filesize

                    232KB

                  • memory/5096-34-0x0000000000400000-0x000000000043A200-memory.dmp

                    Filesize

                    232KB

                  • memory/5104-9-0x00000000007D0000-0x00000000007D1000-memory.dmp

                    Filesize

                    4KB

                  • memory/5104-8-0x00000000007F0000-0x00000000007F1000-memory.dmp

                    Filesize

                    4KB