Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2024, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055.exe
Resource
win7-20240903-en
General
-
Target
6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055.exe
-
Size
1.4MB
-
MD5
6706a3d1fb79cc02ef9817c0f77331cd
-
SHA1
36cab5ee9e17753b9e8f301032ffeb5b971e3a59
-
SHA256
6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055
-
SHA512
a20400372de0e8683a7dcc17dfd1a27d0c54c822bc3debe2a4b1f8db1c1114c20a0554966e62611c1f4b8f62a0a099a4a08f0ec3267d426fffce68d863657e35
-
SSDEEP
24576:EpU3n5+rG/LzOaLahrD8hcrHhjN/NnMTkKPZ6WSocKEsO:8UXMuXOhrgh+HnoZ6WJct9
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 2 IoCs
pid Process 1340 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055Srv.exe 2712 DesktopLayer.exe -
resource yara_rule behavioral2/files/0x000a000000023bf9-3.dat upx behavioral2/memory/1340-4-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1340-8-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2712-13-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2712-16-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2712-12-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\pxB2B6.tmp 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055Srv.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055Srv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148773" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148773" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1083988371" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1087113403" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440587586" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1083988371" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6C35313C-B6D8-11EF-91C3-EE81E66BE9E9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31148773" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2712 DesktopLayer.exe 2712 DesktopLayer.exe 2712 DesktopLayer.exe 2712 DesktopLayer.exe 2712 DesktopLayer.exe 2712 DesktopLayer.exe 2712 DesktopLayer.exe 2712 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 184 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 5020 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055.exe 5020 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055.exe 184 iexplore.exe 184 iexplore.exe 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE 2136 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5020 wrote to memory of 1340 5020 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055.exe 83 PID 5020 wrote to memory of 1340 5020 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055.exe 83 PID 5020 wrote to memory of 1340 5020 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055.exe 83 PID 1340 wrote to memory of 2712 1340 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055Srv.exe 84 PID 1340 wrote to memory of 2712 1340 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055Srv.exe 84 PID 1340 wrote to memory of 2712 1340 6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055Srv.exe 84 PID 2712 wrote to memory of 184 2712 DesktopLayer.exe 85 PID 2712 wrote to memory of 184 2712 DesktopLayer.exe 85 PID 184 wrote to memory of 2136 184 iexplore.exe 86 PID 184 wrote to memory of 2136 184 iexplore.exe 86 PID 184 wrote to memory of 2136 184 iexplore.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055.exe"C:\Users\Admin\AppData\Local\Temp\6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055Srv.exeC:\Users\Admin\AppData\Local\Temp\6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055Srv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:184 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2136
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD52d1847b341a938389fc5b14b0bcd9eb2
SHA14036e71c4002e7ee173d59dc84a9cb5aa1390d34
SHA256275c7427c6238d335e521a313e6cff2357b16e645202f11e3433cd56539ccc32
SHA512384e910821ee8b786f70b5358f120cb3aea47f0e50d1f5c6e4c7304435c7d88f2c5ac9027c73823916149a369ac1c7640c18b13db8e6ee740c963e1b8bd51428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5a58e50c13b9a278f7bee0e86a3c33297
SHA1cc2a5976e14f19bf7f135d0323485fe8b2e02aa3
SHA256cb3dfe705d30b0f5ea4c4f46fb82af5a2300c1d261db23ffebd56fe31054c656
SHA512c4c611c4d4c02a2a31d4baa9cfdafdd59766c3cff4987b089d1a5552e313a50e5a54b2d302950a35504307d0dd4c3c91f150fd10b0ff70c8692a8245f19274e7
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\6f3d6bce14407fbc12d6a7372a988c06bd84e1d44dea8ed6b4c4bf77947c7055Srv.exe
Filesize55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a