Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 12:08
Behavioral task
behavioral1
Sample
me.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
me.exe
Resource
win10v2004-20240419-en
General
-
Target
me.exe
-
Size
68KB
-
MD5
56ebc5ff9dece63f071cb0632a7cf43b
-
SHA1
50373327e5aee1719f7d7ba1387a2ac67abc7111
-
SHA256
bbe31a4ecad08a0cd9d895fcb01f6d2353d6e3a69a76c6d25ca0365eac810884
-
SHA512
d73b5399baf7ad66b00eea5c601a8aeb1d3900a9b345ede09796eb732be556e5b79a7dbd587fa7939e4986828a6846c782f9908dda528d0bc1d9d9fb6e0d5d39
-
SSDEEP
768:BCB8S+OR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMI5V:BHJaAoHoc2x7bZoYBAcQlwJdMJ
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
RunningRat payload 1 IoCs
resource yara_rule behavioral1/memory/2248-0-0x0000000010000000-0x000000001000F000-memory.dmp family_runningrat -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NETRUSDDL\Parameters\ServiceDll = "C:\\Windows\\system32\\259393283.dll" me.exe -
Executes dropped EXE 1 IoCs
pid Process 3048 NETRUSDDL.exe -
Loads dropped DLL 7 IoCs
pid Process 2248 me.exe 3024 svchost.exe 3024 svchost.exe 3048 NETRUSDDL.exe 3048 NETRUSDDL.exe 3048 NETRUSDDL.exe 3048 NETRUSDDL.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\259393283.dll me.exe File opened for modification C:\Windows\SysWOW64\ini.ini me.exe File created C:\Windows\SysWOW64\NETRUSDDL.exe svchost.exe File opened for modification C:\Windows\SysWOW64\NETRUSDDL.exe svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 NETRUSDDL.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz NETRUSDDL.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum NETRUSDDL.exe Key created \REGISTRY\USER\.DEFAULT\Software NETRUSDDL.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft NETRUSDDL.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie NETRUSDDL.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum NETRUSDDL.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" NETRUSDDL.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3024 wrote to memory of 3048 3024 svchost.exe 30 PID 3024 wrote to memory of 3048 3024 svchost.exe 30 PID 3024 wrote to memory of 3048 3024 svchost.exe 30 PID 3024 wrote to memory of 3048 3024 svchost.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\me.exe"C:\Users\Admin\AppData\Local\Temp\me.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:2248
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "NETRUSDDL"1⤵PID:3012
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "NETRUSDDL"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\NETRUSDDL.exeC:\Windows\system32\NETRUSDDL.exe "c:\windows\system32\259393283.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44B
MD56c2f5a6fcd7346414f1593233c7e8f70
SHA108033f1c32acd1314c4707acc332a40812339ad5
SHA256c9e07a20274ae6a302698788540e208aaf8fe56b75a3a594cd7287eb40de5989
SHA512f6079dfbbf76d3251afa55570423cca5c108f8a5c8a924fd0b57a1fad8baa0c864b98fc21cb07022ea7f953f9f23a915ea16ac72afb9a0aacd94ef91b2f24ea1
-
Filesize
37KB
MD54846bc2f230a559f16085f8f6539db14
SHA1ebf67aa28742dc138d67cb66d31ff2f6c090e74a
SHA256adba9413b442d6d0298cfa70acc38591e9b0fac7bc07e91d1dffc0962de90d1b
SHA512861b184f39d80b81379e9781375d578fd40fdaa282b70f876300d1b58bbadd36d65630ce6e6d56c7e02f31276a3fd18c10362ab0e1be865cb97b3b0009270449
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d