Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 07:30

General

  • Target

    c80d747d792f6a52d3fac3b6f9c829ef.exe

  • Size

    98KB

  • MD5

    c80d747d792f6a52d3fac3b6f9c829ef

  • SHA1

    ef4dd0b539b704ed7a3d43eb5fd58b8ac25646ba

  • SHA256

    243fa45cc6d163d24e52c777921b923bc9a5f0a732fb159896418e46c381ab19

  • SHA512

    7706f1ea8a05813be3faf343a8435d3d1521fb9a47d025533e0973addb807547b6bccb4cbeebf6c9c9d1082bd62757f41e46d721a302df66008240ffa228b365

  • SSDEEP

    3072:bFlBBhhbIXzakFDhbZ2Gkk8jwaaHw7Koj4rDc/9uK:fhhbwvDjlMM

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c80d747d792f6a52d3fac3b6f9c829ef.exe
    "C:\Users\Admin\AppData\Local\Temp\c80d747d792f6a52d3fac3b6f9c829ef.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4936
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:4924
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 204
          3⤵
          • Program crash
          PID:2720
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3744
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4084
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4084 CREDAT:17410 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:3560
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4084 CREDAT:82948 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:5068
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:2128
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 212
            3⤵
            • Program crash
            PID:2152
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5024
          • C:\Program Files\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
            3⤵
            • Modifies Internet Explorer settings
            PID:3184
        • C:\Users\Admin\AppData\Local\Temp\daefmyafbvifochb.exe
          "C:\Users\Admin\AppData\Local\Temp\daefmyafbvifochb.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4212
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4924 -ip 4924
        1⤵
          PID:3760
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2128 -ip 2128
          1⤵
            PID:3380
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
            1⤵
              PID:3968

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\suggestions[1].en-US

                    Filesize

                    17KB

                    MD5

                    5a34cb996293fde2cb7a4ac89587393a

                    SHA1

                    3c96c993500690d1a77873cd62bc639b3a10653f

                    SHA256

                    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                    SHA512

                    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                  • C:\Users\Admin\AppData\Local\Temp\daefmyafbvifochb.exe

                    Filesize

                    98KB

                    MD5

                    c80d747d792f6a52d3fac3b6f9c829ef

                    SHA1

                    ef4dd0b539b704ed7a3d43eb5fd58b8ac25646ba

                    SHA256

                    243fa45cc6d163d24e52c777921b923bc9a5f0a732fb159896418e46c381ab19

                    SHA512

                    7706f1ea8a05813be3faf343a8435d3d1521fb9a47d025533e0973addb807547b6bccb4cbeebf6c9c9d1082bd62757f41e46d721a302df66008240ffa228b365

                  • memory/4212-38-0x0000000000400000-0x000000000043A070-memory.dmp

                    Filesize

                    232KB

                  • memory/4212-34-0x00000000008C0000-0x00000000008C2000-memory.dmp

                    Filesize

                    8KB

                  • memory/4212-33-0x0000000000400000-0x000000000043A070-memory.dmp

                    Filesize

                    232KB

                  • memory/4924-9-0x0000000000C90000-0x0000000000C91000-memory.dmp

                    Filesize

                    4KB

                  • memory/4924-8-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4936-5-0x0000000000550000-0x0000000000551000-memory.dmp

                    Filesize

                    4KB

                  • memory/4936-10-0x0000000000400000-0x000000000043A070-memory.dmp

                    Filesize

                    232KB

                  • memory/4936-15-0x0000000000400000-0x000000000043A070-memory.dmp

                    Filesize

                    232KB

                  • memory/4936-17-0x0000000000400000-0x000000000043A070-memory.dmp

                    Filesize

                    232KB

                  • memory/4936-18-0x00000000775C2000-0x00000000775C3000-memory.dmp

                    Filesize

                    4KB

                  • memory/4936-6-0x00000000775C2000-0x00000000775C3000-memory.dmp

                    Filesize

                    4KB

                  • memory/4936-0-0x0000000000400000-0x000000000043A070-memory.dmp

                    Filesize

                    232KB

                  • memory/4936-4-0x0000000000540000-0x0000000000541000-memory.dmp

                    Filesize

                    4KB

                  • memory/4936-2-0x0000000000530000-0x0000000000532000-memory.dmp

                    Filesize

                    8KB

                  • memory/4936-1-0x0000000000400000-0x000000000043A070-memory.dmp

                    Filesize

                    232KB