Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/03/2024, 12:07
Behavioral task
behavioral1
Sample
ysme.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ysme.exe
Resource
win10v2004-20240226-en
General
-
Target
ysme.exe
-
Size
68KB
-
MD5
63e89bf274c20c083a0fe769e948e2b4
-
SHA1
ffe988132fc4e69e782f3fc9da8e13c281d1b302
-
SHA256
d536aae3b7468b7598e0e5e39e004bc26a087b81e68c3fdf9205762f2bb6782a
-
SHA512
108e8eccba50e0bc91ececd68fdfb3019e42f2d6be04885a29c5b81f288803eebc619a3ec00cf6458b87038d62bfe63ce9c642627742fded111890b3b5fc9c6b
-
SSDEEP
768:BCB8S+OR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMIIV:BHJaAoHoc2x7bZoYBAcQlwJdMY
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
RunningRat payload 1 IoCs
resource yara_rule behavioral2/memory/3872-0-0x0000000010000000-0x000000001000F000-memory.dmp family_runningrat -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NETRUDDL\Parameters\ServiceDll = "C:\\Windows\\system32\\240652968.dll" ysme.exe -
Executes dropped EXE 1 IoCs
pid Process 3616 NETRUDDL.exe -
Loads dropped DLL 4 IoCs
pid Process 3872 ysme.exe 3872 ysme.exe 3176 svchost.exe 3616 NETRUDDL.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ini.ini ysme.exe File created C:\Windows\SysWOW64\NETRUDDL.exe svchost.exe File opened for modification C:\Windows\SysWOW64\NETRUDDL.exe svchost.exe File created C:\Windows\SysWOW64\240652968.dll ysme.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 NETRUDDL.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz NETRUDDL.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum NETRUDDL.exe Key created \REGISTRY\USER\.DEFAULT\Software NETRUDDL.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft NETRUDDL.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie NETRUDDL.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" NETRUDDL.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3176 wrote to memory of 3616 3176 svchost.exe 102 PID 3176 wrote to memory of 3616 3176 svchost.exe 102 PID 3176 wrote to memory of 3616 3176 svchost.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\ysme.exe"C:\Users\Admin\AppData\Local\Temp\ysme.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:3872
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "NETRUDDL"1⤵PID:4456
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "NETRUDDL"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\NETRUDDL.exeC:\Windows\system32\NETRUDDL.exe "c:\windows\system32\240652968.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3144 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:1860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD509eb4fd3bf9dc0c551ef0018de949a4b
SHA1c610bc0276fadcb79a0895baa5b908f43ee996cb
SHA25650f45124d1d5e8d433ff30baba0d242071d7f19231bdd54e2a498ef66721732e
SHA512bc8a0d77b54542cb914692fe1a1eb0d92e5c75f7ecb1a595ff37b0c4c05d29d8a69e5d5d6f4bd65ccbec78e832d9c4cc546f43f0c9e29c059b5cd8cf46904d8c
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
44B
MD5741a4fc3c8cce4d60d602f58cf3ebc3a
SHA1d936fa073b66330a2da4e1dd04a04bd212f8e4a0
SHA25627af54cc90e01244ff8a4ed2b7cc112dd7385a1c6fee4236eb85187c001ba72e
SHA512dc55c5c65a41cd5552213803b2f0701ecaf6c352ac2736d408b11a456d3fb46a6b5a66330a23f592685130dfe7213842f6112dfd50fe9dcbdfe19affeee23b10