Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 06:28

General

  • Target

    599efaa8ae4f37beda54f57b98b09da0.dll

  • Size

    456KB

  • MD5

    599efaa8ae4f37beda54f57b98b09da0

  • SHA1

    140022bf32af7d27896d8e85af3c42d49ae4b5da

  • SHA256

    24b7d682b49cdce81fd7a6f9832a9c634ba2bd14fef7dd43ee92797d1def4f54

  • SHA512

    aa70e5cbb83e79c75abe557dd57c6504969744f39398fb32089a0b61857c69bf46d983e4ada2ead80a2a6a1d7149431c3804a423e354cac0afaace92fa6ab2f3

  • SSDEEP

    6144:J4TmSt9uNNtXlD2K0Hp/59dB9SzH2xLBzWjKEyS4X1OGTUX7x8A3u:xYQtXlD2N7SD2xF0BY1DTUX7x8A3

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UAC bypass 3 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\599efaa8ae4f37beda54f57b98b09da0.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\599efaa8ae4f37beda54f57b98b09da0.dll,#1
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2944
      • C:\Users\Admin\AppData\Local\Temp\Pdf4513
        "Pdf4513"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Users\Admin\AppData\Local\Temp\Pdf4513
          "C:\Users\Admin\AppData\Local\Temp\Pdf4513"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2764
          • C:\Users\Admin\AppData\Local\Temp\kmdlopfoanwroxda.exe
            "C:\Users\Admin\AppData\Local\Temp\kmdlopfoanwroxda.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2528
            • C:\Users\Admin\AppData\Local\Temp\kmdlopfoanwroxda.exe
              "C:\Users\Admin\AppData\Local\Temp\kmdlopfoanwroxda.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:2852
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks BIOS information in registry
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2392
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2276

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Pdf4513

    Filesize

    36KB

    MD5

    58cd26d5cba48c86377d4f3dbcb0d437

    SHA1

    f9e276dff048acf593c072d9be9ade926c25bb6c

    SHA256

    d27a8de4bac6465d635ead175e99711216cf960483a7e3306931cb87d2f701d7

    SHA512

    df03cf84d177733f702040167a9d02b67586c7e6cd38593a71c19efe5282fa711a0cb9a726d4f4df77aec84bf049c7cb7a6828d4531aa9dcff4ca19e80559c01

  • C:\Users\Admin\AppData\Local\Temp\Pdf4513

    Filesize

    100KB

    MD5

    c43c51d12dab7d81aa13e6a16af1e6d0

    SHA1

    1fb4751c7831a1c8ceab47bfc869e95e1dd06af5

    SHA256

    5a388b21e1ec19fd9a99f154cb863b6cc4c5bbefd75c7dd81bf781408e69e2f6

    SHA512

    7bafb0bf2437232cecbef7c0e0c1cb459db5267a23cb1309dbd3689dce095f92b7875d6921fd123505e9008bb40713f9243525db0da3abc897ec9a010ee33a91

  • C:\Users\Admin\AppData\Local\Temp\kmdlopfoanwroxda.exe

    Filesize

    43KB

    MD5

    983b39e0a5d4962365cd299c076bc33d

    SHA1

    8e36878557c483c5ae6430ca591e5cc1dc0582f0

    SHA256

    7ac87a80477f8fabfa1d48c394fa60996693ccd2354892bc67648a8aa748fe8b

    SHA512

    c4dec5d60c79ba59c17fa33c96f684bf8e46b207a8505b83d49650d7346ed990e009922aaf6e6e82616f91f436f24530aead04048d0409678bf34527cfb218bb

  • \Users\Admin\AppData\Local\Temp\Pdf4513

    Filesize

    51KB

    MD5

    a7b3ab44d8d4b8a78ed32c0692d182ef

    SHA1

    972a4ab4fe4994240aab8faa6476dec5f3d2f5a9

    SHA256

    564a77c32fc55c3898716c6073ec79924aba3f49327f311e8835878cbecbf4b6

    SHA512

    a9665102a33bbfc36a96475c13ddf44b290f7a4e0d4331fed5919a9dbb28d5cd731725c3634a238a62edef1ec9b347103a9f764e3a0956eaee84a91c25ba8ab7

  • memory/2276-40-0x0000000000070000-0x0000000000071000-memory.dmp

    Filesize

    4KB

  • memory/2276-34-0x0000000000050000-0x0000000000051000-memory.dmp

    Filesize

    4KB

  • memory/2276-49-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2276-44-0x0000000000060000-0x0000000000061000-memory.dmp

    Filesize

    4KB

  • memory/2276-41-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2276-42-0x0000000000050000-0x0000000000051000-memory.dmp

    Filesize

    4KB

  • memory/2276-47-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2276-32-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2276-48-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2392-75-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-81-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-59-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-69-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-79-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-53-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-80-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-82-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-83-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-68-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-84-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-85-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-86-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-87-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2392-88-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2764-21-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2764-30-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2764-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2764-14-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2764-10-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2764-23-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2764-25-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2764-27-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2764-29-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2764-17-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2764-20-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2764-38-0x0000000077AEF000-0x0000000077AF0000-memory.dmp

    Filesize

    4KB

  • memory/2764-24-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2764-39-0x0000000077AF0000-0x0000000077AF1000-memory.dmp

    Filesize

    4KB

  • memory/2764-78-0x0000000077AF0000-0x0000000077AF1000-memory.dmp

    Filesize

    4KB

  • memory/2764-105-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2764-12-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2852-120-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2852-129-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB