Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 11:32

General

  • Target

    1734abe3407f61e9ae95c46ba0f94b2a.exe

  • Size

    84KB

  • MD5

    1734abe3407f61e9ae95c46ba0f94b2a

  • SHA1

    168ecd346b31b10dc710b9bef26ae62a67888ddb

  • SHA256

    e5989273e7c025a7dd2801cf410667e84755f17dc9cc9a0e6e2f5e33dc01c29e

  • SHA512

    61dba6e7aa79482390e480a6d9d9e4e87d73eb02be5146f99e05247de243864e7f6302c98841e50ed5d63b4fb64369f6e3755211977f683eb90b6d77c74253f1

  • SSDEEP

    1536:3ODUngi71V1f8TjQDkF2l3BPoesXv8So3fpl1hFasN:eDUngiD1f8TjQDkF21lHO8SkPhp

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1734abe3407f61e9ae95c46ba0f94b2a.exe
    "C:\Users\Admin\AppData\Local\Temp\1734abe3407f61e9ae95c46ba0f94b2a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    PID:1996
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 128
      2⤵
      • Program crash
      PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\~TM6D15.tmp

    Filesize

    1.0MB

    MD5

    b4c9ba56daa490aac10f837beb943cfe

    SHA1

    6972e8e7382773224213cd67792c15ae6cc07363

    SHA256

    635b715d328d6f69eca75d3ab9f6482fcd86ddbeae4b11dea1b6266b368a7a2f

    SHA512

    cbe592b39ca4b210c9075089b34fdebbef7e569f2d2cfb5d5ac53d411959aa7c19033845cbeb2eb84bcc6b692159c29488c31fb640319fc2cc16119dce5d645f

  • \Users\Admin\AppData\Local\Temp\~TM6D45.tmp

    Filesize

    98KB

    MD5

    cf97e692621c6365324978d8a4b7999e

    SHA1

    9bc6185207a68b72a06fdc310a0cdd7e2df02e36

    SHA256

    91970cfc5436ed2868ccdb5cee4651211ee626727a68e9caba16198bae05de0e

    SHA512

    6b1f4474490b4693f30b2898c92baed38c97da1cbbe3b623b2e7bbe00aca356b4f89e96940a3bc9b1cca7e8c5ab9ceb6b5f5ff3e985dbda7d7776816b8609467

  • memory/1996-4-0x0000000000360000-0x0000000000361000-memory.dmp

    Filesize

    4KB

  • memory/1996-20-0x0000000076140000-0x0000000076250000-memory.dmp

    Filesize

    1.1MB

  • memory/1996-0-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB

  • memory/1996-5-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1996-6-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1996-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1996-21-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1996-1-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1996-23-0x0000000076140000-0x0000000076250000-memory.dmp

    Filesize

    1.1MB

  • memory/1996-22-0x0000000076140000-0x0000000076250000-memory.dmp

    Filesize

    1.1MB

  • memory/1996-3-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1996-16-0x0000000077B80000-0x0000000077B82000-memory.dmp

    Filesize

    8KB

  • memory/1996-15-0x0000000077B80000-0x0000000077B81000-memory.dmp

    Filesize

    4KB

  • memory/1996-14-0x0000000077B7F000-0x0000000077B81000-memory.dmp

    Filesize

    8KB

  • memory/1996-11-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1996-9-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB