Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    185s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 01:40

General

  • Target

    SuperDebug.exe

  • Size

    851KB

  • MD5

    91c86d309860a56ce80e9a493a224e00

  • SHA1

    2305910467169ce81251e5806eb8630cf1adfec4

  • SHA256

    c97f87fa5056c992abdb21babd803d117432b0e9cc9fc3126005497c29628ac9

  • SHA512

    064d552a6e78003828767e40db49efdd69093dfea00b58dc353eaa23f57c871bc86fc36089d0f98d9bc7e9c7086310122c3d873084c8261f55bfe2c9e7671ad2

  • SSDEEP

    12288:6eOYmHyNYLoQAUHBXNszSDaIQhkutlzpoGzzcUotHD3pZfavKPluH25izhm:6ePmHyNYLoQAUHBXNjJshDEPH7hcKi

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SuperDebug.exe
    "C:\Users\Admin\AppData\Local\Temp\SuperDebug.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\SuperDebugSrv.exe
      C:\Users\Admin\AppData\Local\Temp\SuperDebugSrv.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2196
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1812
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c1131d63abe25ad442fc7206ad2d9e09

    SHA1

    7867067c39f66b33774c23ca425de3c8656c4de1

    SHA256

    45f080de840b4912b37d729f75c7ed953d3997fb8885a1f21b401e992567cdb6

    SHA512

    1bf5631a567e7b867fbee7860b2cb8e59d98dbd5828a536c700e00a3a39485921ded9ba3d44f54262f450a70bb3acef0a3cf54b704e762a1d42e6f1bece2f408

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    14e11926f370fa7060dd1ac003bd69ba

    SHA1

    09863437a7382dacdbc55ec4546d14c98d61bf6a

    SHA256

    abe7c52028a55a6d64b121b4aa6cd5c591c7185d480f41316b22dc3d009c6609

    SHA512

    5c4e44bc4349182c36616ba3ce8bc0719c65788ee8e6b83a6ce1c939f820640bf1bd1b0a4d300b2b9f38291d3da3f62260358e522137c1fc094a7cb0e2414a34

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    89807472c4c8a7cf062ebc6239db73ad

    SHA1

    6f322af65e9fba353c3b36d8ff520d671be2d9f0

    SHA256

    25e1c3f1c8a9c609663262ad0c7d82e6420b4f026b7d8439aba96f0c2aba7676

    SHA512

    521229ee1e8ce68a47c1c5154a55bc846bc949f1277038f120a7b0844de07b19687a28f6a3a6b847636b51f879208001412a744039cbe478e4873ae5b4b0eef3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c3d1a5ad0ae1ce7000c5370c72989421

    SHA1

    688f8f9238c8466372c445876ddf70af7c9e5c5b

    SHA256

    8577f97bb4815c2ac41d5b4ba8189a31c27f6afbc613e0bbb2d69012feda2b0b

    SHA512

    60d85f84b36c92aac3111659f6bfc5be02c1ce51cc3f885ab9239edc980c4b2c7abc9143c553e1f8769af25a12b592e1105603c9d36a61a68110cc0a752aba98

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fcacf47958191de1a2a86d27a6445abf

    SHA1

    4f27b733bc101b793fb4f3506f41dcffdfdd033d

    SHA256

    fd760bf933329b27eda98a04125301cd1e3496382383004e80310bc4e28b4c2d

    SHA512

    8b18e27bbc9efe988e2b28a05cffef6e98d19f55e4b2528eb92f72a4e9b19ff5f500017e1a24ac5ce664bbf20feb33e00bde633b212978fd47eb7a52c0fc1f79

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b4f6582f824656796f75cf627759f1da

    SHA1

    05fb8d2b670db69a26e5b99a260b5f1cf956b826

    SHA256

    f77486a1713c45694f72dea525538323cffab065bbdc77fb8c7d37d5e1a1c48d

    SHA512

    73909c86866128aed4b43a914a994308f3ea630b1b0f193756f2b796281d72ec8ada461b6007f10ab0c20ca54f69e4231cc836de55c44551ff3a23de2124353f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b812673f550ebf41593fcf24cdb28573

    SHA1

    c67b88cb9755cdacbe9230682deb0f5e979d934f

    SHA256

    3d9b94d1f28bff91f515cfa2f6acd1f4f69445c2bcbf9da454b3b3e8502c9c56

    SHA512

    718b3dd34712c2c7314ecbc7ae4aef06b29a791830f409630391b8d31673a56aa4aa5cef52dabf39d7e4a54d1ae3f0d44f8adaaa9df89a19cf96e9b06351d169

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    def3f5517cef45bdb198e19a96a09f1a

    SHA1

    bf870bb93a949f5663fc7a8229bf9a03d474cae0

    SHA256

    6ee9469945c822266c4139d13529de5003e4d7f26b71839fb58bbe21d7c39af1

    SHA512

    1ba68e22be4e442e19c07ceb15ed52ddc2209773ab7eac7f28b13f5819b432b65fefa3b99bc4c6f37053bfa2cb7889c7af86ca41694fafa62aa3033e33c74df3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cbd854488afd7de4126b3cf95aadd5b5

    SHA1

    2743e9bde95e074e121c0c5aa8d40ace0aa56d02

    SHA256

    0298533b25f7fd4e5eed9d0ef6cc8d1489fd05e76aadd0a88d0b66f3894d7716

    SHA512

    6445ae454213e2574aae2c7d025aa83bb48423939a5d20d82512aedbbfa591c0fffc13f9fc03bb8119756a805ba5d9550533147e1b7e53912a6305451ff05e70

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1eb83851f25e30621e0e5bb32bbed18e

    SHA1

    89775b065d7ee573aa4f631e036a2dcd7ecb2c0d

    SHA256

    e21ea2fdeb201cc7082cb6e902ca5e6fb49ffbe7384e2abd16f774aac826cdc4

    SHA512

    da35d32eada4641c352d70dab369f0ebfe36134ad770c63c6fd78dc76cfda26fec6d23cb0748d8f16b6735d4981346d572d150fcce16763b7be9aab9ec0b2e84

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d172fb88df3ce996aa0720601b118da6

    SHA1

    d7142cd5735e6d4c62a2a590eeec33304307fca2

    SHA256

    73dd7b63d464aeab91912e62fbd7c8a468c7cffd2a65b03ae902519da6455554

    SHA512

    bba7020cc151270c89de4cf98d93d896b6c5657d89eb440f829d2a7220670cbfb636622ad879e78c644c6bbc2f04f219430d78b28688f7c6f8d0e61fc6771acf

  • C:\Users\Admin\AppData\Local\Temp\CabB4C1.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\SuperDebugSrv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • C:\Users\Admin\AppData\Local\Temp\TarBCD0.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/2196-24-0x000000007783F000-0x0000000077840000-memory.dmp

    Filesize

    4KB

  • memory/2196-23-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2196-22-0x00000000003D0000-0x00000000003DF000-memory.dmp

    Filesize

    60KB

  • memory/2196-21-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2736-12-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2736-16-0x0000000000240000-0x000000000026E000-memory.dmp

    Filesize

    184KB

  • memory/2736-10-0x0000000000230000-0x000000000023F000-memory.dmp

    Filesize

    60KB

  • memory/2736-7-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2896-268-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-27-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2896-8-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2896-352-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-353-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-354-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-6-0x00000000002B0000-0x00000000002DE000-memory.dmp

    Filesize

    184KB

  • memory/2896-28-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-0-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-269-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-26-0x00000000002B0000-0x00000000002DE000-memory.dmp

    Filesize

    184KB

  • memory/2896-25-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-13-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-679-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-788-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-789-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-790-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-791-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

  • memory/2896-792-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB