Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    29/04/2024, 12:08

General

  • Target

    me.exe

  • Size

    68KB

  • MD5

    56ebc5ff9dece63f071cb0632a7cf43b

  • SHA1

    50373327e5aee1719f7d7ba1387a2ac67abc7111

  • SHA256

    bbe31a4ecad08a0cd9d895fcb01f6d2353d6e3a69a76c6d25ca0365eac810884

  • SHA512

    d73b5399baf7ad66b00eea5c601a8aeb1d3900a9b345ede09796eb732be556e5b79a7dbd587fa7939e4986828a6846c782f9908dda528d0bc1d9d9fb6e0d5d39

  • SSDEEP

    768:BCB8S+OR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMI5V:BHJaAoHoc2x7bZoYBAcQlwJdMJ

Malware Config

Signatures

  • RunningRat

    RunningRat is a remote access trojan first seen in 2018.

  • RunningRat payload 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops file in System32 directory 4 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\me.exe
    "C:\Users\Admin\AppData\Local\Temp\me.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:2248
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "NETRUSDDL"
    1⤵
      PID:3012
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "NETRUSDDL"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Windows\SysWOW64\NETRUSDDL.exe
        C:\Windows\system32\NETRUSDDL.exe "c:\windows\system32\259393283.dll",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:3048

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\ini.ini

      Filesize

      44B

      MD5

      6c2f5a6fcd7346414f1593233c7e8f70

      SHA1

      08033f1c32acd1314c4707acc332a40812339ad5

      SHA256

      c9e07a20274ae6a302698788540e208aaf8fe56b75a3a594cd7287eb40de5989

      SHA512

      f6079dfbbf76d3251afa55570423cca5c108f8a5c8a924fd0b57a1fad8baa0c864b98fc21cb07022ea7f953f9f23a915ea16ac72afb9a0aacd94ef91b2f24ea1

    • \Windows\SysWOW64\259393283.dll

      Filesize

      37KB

      MD5

      4846bc2f230a559f16085f8f6539db14

      SHA1

      ebf67aa28742dc138d67cb66d31ff2f6c090e74a

      SHA256

      adba9413b442d6d0298cfa70acc38591e9b0fac7bc07e91d1dffc0962de90d1b

      SHA512

      861b184f39d80b81379e9781375d578fd40fdaa282b70f876300d1b58bbadd36d65630ce6e6d56c7e02f31276a3fd18c10362ab0e1be865cb97b3b0009270449

    • \Windows\SysWOW64\NETRUSDDL.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • memory/2248-0-0x0000000010000000-0x000000001000F000-memory.dmp

      Filesize

      60KB

    • memory/2248-6-0x0000000000270000-0x000000000027D000-memory.dmp

      Filesize

      52KB