Analysis

  • max time kernel
    117s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 19:09

General

  • Target

    cg.dll

  • Size

    4.7MB

  • MD5

    b698513d3757545edc1328e6bea3eb15

  • SHA1

    b8f3889dc32db6f9a8287b91d95952942743bfd0

  • SHA256

    68d0bd4dbb3c1c26acc6a1c8741ec19f954b82571328edb3acd5bd2fd41bad82

  • SHA512

    9c831c06130dd120012d3f5491c288682dfd8eda92813c83accefc2050b55ca42f71f965e182cfcb2666128041d7cdceaf03f8285d26d063bfcb909a3b24988e

  • SSDEEP

    49152:8Pa020/OfOQka+NfXfkqa4B0vNv+sDEFs8cuO:8PP20/TvaUHkqaNWuEy

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cg.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\cg.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2380
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2152
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 224
        3⤵
        • Program crash
        PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    3b31fb4f36fa7e9121169941876d8fc4

    SHA1

    0906d3c8c460ff995f7d11f9d3a73fc8a7cc694f

    SHA256

    e02fe1b3455f1e49ecf0ef36a345468b1ab9808b596182437b483fa8d030d054

    SHA512

    a35c821e6a8b3c9a9b889e8d290876068e15efc7fe83aef08e501acc8139098c092597dca24e76be6ea398c6761aa679965f0a171fda9e3564f49a18f5e51a53

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8bdba1acf9588af5fe6eb13671215759

    SHA1

    34bd37f2f52f65809156efe88ba164f5e716bf1f

    SHA256

    a605f41de0a7304cf234b2925f1f0c09d68808cb6c59873eebdcf7cd0bde632f

    SHA512

    2809fbedcd6ce960f1df4cc78763ecddd9678954c50e3830a59c5eccc745a328fbf946085c666072fe2674e5f21ba1790b7a0d8bcf38055ba90062af886a7449

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    668d466767aee762863928020d275735

    SHA1

    8be531fd2fdb6c6a8b6c30a99e16795fe5d6a753

    SHA256

    a3bb08d05b5bc4e363fc9a8a594eba2d9b6463e8e8fd72b524a1434a85bf62f8

    SHA512

    3aa47c605bd3f31233d4c0072f425664d089b5b371ccb2bffd30e2d3c001f357a7077e469acf980e85e81930172ea42b74ef7b64df75daf43d0b4d0c5904fb61

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7a8882677db1b80d101a1cc744be427b

    SHA1

    29b334a1475123efb3ff30c767b74dcd018ce53a

    SHA256

    201cf279d88e8b74ec9ed9e30c78f0264629ca6da3e1f550fb5fc4868e46d9c1

    SHA512

    93b9b5f9d09d24c32f16df1af4779fded9d278a659e2af77df7e3c6a56e1985ff7cd8e162e6ea49e1f57cdbb499cce803f8750eee14afb7960d49a64e076ae72

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fbe5aff1b9f3573ebad5915f49df8724

    SHA1

    3e8d7d8d424ce7187133d507f63f6af5acc29c84

    SHA256

    d2b8d9a8bdd571ed36de3d01cff1e9849371df570c74c7e8bcc0f996deb1949c

    SHA512

    b35bd5a95b5f8a74ea45208b40f57dc5117668324802c16a85983952a373896950a7d0a5a5b804786fe1c2b6b09c9630c03e5091c293c56c28a21da3c68e813b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0faceec2b8f76a371dedbbc589c47c1b

    SHA1

    a051641e37bd8b842bc052ee01ff7c4c254f4dc6

    SHA256

    cdf31f7b30f7d2781467239e347e94044a2ea13ef9b17b4556ef730ffb8ce314

    SHA512

    5096818a71f32b54a91f810f598ae183fbd9b3d91f239ff74cae8c31680ccbf9a9c3dad2b4696d257dfd2f06181f26ab3f4fb5bf9390044da800d9d2f35d237b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c10c0b0d3c91022b29163af2ac10f8fa

    SHA1

    2d57703fe363f5051d4e3480465d40a8f1b960dc

    SHA256

    26d344b8eac3cb328dc8abe8d5ebe03834d8fbba110374afbf5de5f63bb70283

    SHA512

    91f593ca3cf09d94248db866583ac5c7618a653fa85f68f2a7a106d4ff0bf36efa1951cd51c1b8a73438ce937e857cf0d54595993739cda04b76b757d7678682

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    127daed07364906e8b4513e976288201

    SHA1

    326c4cabb9ee7ab37b5e302708501f00059fe11c

    SHA256

    c0aba8de04c07e42f458f511fefc170c1a8880c3046de0e110c4c4b89ae6db43

    SHA512

    e7fd20736b58548345ae1e220ecae6ef59031344182ebd1522439195e5eab86dfb5d72fb71d120a060582946a8d861943e3ca3271bfd79dda6f880391ec9be70

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    782502210fd3d88285749cc1811e0021

    SHA1

    0cd3ab55a1c1e82c3079e59f1fa49a5ff418f315

    SHA256

    0eb52e7730a732f725167524fad02c30066626a79dfcdc894bfd46b5f9f74362

    SHA512

    ae9b64d687ef66c0390b13d37922b4d6e8d89bd8ae62fc3c0972cd9b038f0c2c07141533ea88328766429c2c1c820a149152f5a65c9c3b34ec45391ce25f19eb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e167094c16b46c6723b47790c6f03e0a

    SHA1

    7e53cdc656f5258a7871b28e7abf59b6eb73f424

    SHA256

    8b71c0311ab7444991d4efc8c3d98b285aa245c9aae638b7393f7071600722e2

    SHA512

    745993985aeff7935ecdd2bea1270c72c746e14b81997de1fce1679fda833156e8638f4020195f5ea554b4f961b4063c2502c17f239b3bd3da3e847f3f6e015c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    614b4888ed20c262c0aed053407b10c7

    SHA1

    753dcb773c62c538796ed29779a60cc424be31ec

    SHA256

    47f6de259edb3b51e18a77e001630bc0899ff6a489ed95682e3464a3cb6d31f9

    SHA512

    9a96975c13588d4bcd91d86e2da7af197d59937d343b7f41837569f37647ab7171bdf40b2979fb36271af9aba862e3bb8c10c58f98745d64943ec241497d1f11

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a58a4c16ac9e28d25723d3a22c724e07

    SHA1

    b309d5fd7927e47dbcbe3c42ddf4c494a21a3130

    SHA256

    c7720069229bc43ab6aeb17b78ad0ac5bb301b5b6773fb53efdcb78881964520

    SHA512

    22ca192d39dba0a3776574ba3d34b7bfcb3d9d8565d88790c234e801b2e7ab356737a930d2110099ebedc3cdef1c3b4557fb4e7da55066fd2b67885fcf0bd5d4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b0bd58589f4cb843d5585dc92c84111f

    SHA1

    2057b1bf7b031740fb1631eaea4d88abf25315b5

    SHA256

    e98a0015447fbe24d13b4a993b9ee9e7de3b80615d067726084154d307785725

    SHA512

    44fe95216eff521b0719130c4ee131553c36db68d49d7fba459f95a3fa7f636aad57eeadf17a14bf92a65a11957174981fc68eeda4dc8ae22ee013b237c77d44

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    47fdfe454f5fbae8e7a06580cdb7a71b

    SHA1

    126f611b8d335b17e6aafdd69cc175354c89a5a3

    SHA256

    626d51852a14b8d6626e554273d879d0dbdbb26eef70317cf6fc3578b26b8087

    SHA512

    ceb4c5ca795a154f848eeeacf675b72f61597de44ce9abdd6db71ae4bdb93b4c83673b556e160c1e20046837c073fd7e1aedaa30840e350be2747dc17eb1f3ab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3ff66b281825d769cd21d0fe8b666e4d

    SHA1

    91fda69f74d5981c6b2ed1e5a537582a67942e1f

    SHA256

    3e43e03e1d7add2a8f4665b49fb80ee4e1bd347e6be18db5416229211ff101a9

    SHA512

    93ecddf74fc7ed59cbf25dfef282737de530a463a2ad30c5c98ae9b9dfd9be08bfdc24166120f532c49fd24ee034339425afc36c526e5e26049cd46a3e44d8a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    933f909175d3795ab31252247c3729a0

    SHA1

    b6cd49ffd34d5eaa4d910095c926c6999f7ed676

    SHA256

    c8fe1d7406a72616d29aef01ad5b1de370c59c279a6d9c5ca7a8839b3732f7e0

    SHA512

    8c2c726b0fa174165a67810f5d250587b2db64beed5db2ee7be1f219f8a560bf74b11d0b2e77389216f0d671e5c61fefe98280f2060ff1312355d9ad305f1ac9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8bf2d99e14ef961e0d199c14ca30ccd8

    SHA1

    cbb87cb61485549b650685b5e879063e6cb31901

    SHA256

    fdeb5ac1408df69661d948f0de8722ea4d2d050bd92f3929a751890d6cddce79

    SHA512

    cf0a4df189d858f60f2e463ba388abb47092dcc66ce3608ce4fd093c360a4232d532f593004c376dc011721217d98995f71b795644859543e8580ae9dacc6f7e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ab681042471462119cd6b5d66acba506

    SHA1

    81e4c811ff332fc00203e06009220f874ebf312a

    SHA256

    da33d1c58cd59b9b5385839ac964b95ac50bd15dc9e9e84276cefa34de72db0c

    SHA512

    f72548c6607f99468327e5c0d66a1473e30ff75fd7ece5c224d98d89cd31edb9168cd9d5f809f5b04d5d0cabd93bb070113072dde75e452617bbb72aa103f98e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e453bc7d4cdf8c41e84a834194d797b4

    SHA1

    995a6b2dee7ff27b078fdba252d430a2cbc6044c

    SHA256

    4fb6287e39565bfd60aec8aea836150310e69d58407204bd76dd452ed81a7b4b

    SHA512

    ecd9f94acd30633e80b3ef893bc8049ee6d8a74f44f3c6457380af1d69a0ed3c7b93b502aec527e9e16275a09e65a0426a2111746b0974f7f9129426aacf097b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    41a103358cf818610ae809f7f7bf2d38

    SHA1

    dbcf227fcc369b169c03626e05df5bcdd6241b69

    SHA256

    3f32a3cc375f8c1716211114c1ff6546d4f4222742de66e522647b0a4f73976f

    SHA512

    84670357cfb4a908a3969948c8b69d6f413943998bb19c0c057da2fbf60162736c9d802a679a4b58798ea89bf3c1cfbe0c4ce0125cad1b7648a441e8c76cb9af

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    ac5456edcbfced1cbaa864e6b1c26ee4

    SHA1

    0cadc8cdca5d87f697c25ce537b006c24f1d20e0

    SHA256

    20d2c41b2c712d35395bc97503b15d571bc25dcf6b2b9bd6a43bda1197a89e0e

    SHA512

    3605ed49d2137c8bfe668ca910ab9fd52cc7336da1011751d5fdee9496fc1788c70a3a3aeeef6fc174d292ddee81f441445f346b818bc7bb8be02749cdf0ce49

  • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

    Filesize

    4KB

    MD5

    da597791be3b6e732f0bc8b20e38ee62

    SHA1

    1125c45d285c360542027d7554a5c442288974de

    SHA256

    5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

    SHA512

    d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

  • C:\Users\Admin\AppData\Local\Temp\Tar25CF.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • \Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/2380-12-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2824-17-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2824-15-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2956-18-0x000000006A000000-0x000000006A4C2000-memory.dmp

    Filesize

    4.8MB

  • memory/2956-608-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2956-19-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2956-11-0x000000006A000000-0x000000006A4C2000-memory.dmp

    Filesize

    4.8MB