Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    6s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/06/2024, 01:59

General

  • Target

    71f110f2d6d5e36c9febf465f50ba6c98ce052c2b6981d3a353155840c1e2c1a.dll

  • Size

    260KB

  • MD5

    459b68e06ba1a22febd9cce064aafe3a

  • SHA1

    1191b301579d50816a8d46039972fcff226509be

  • SHA256

    71f110f2d6d5e36c9febf465f50ba6c98ce052c2b6981d3a353155840c1e2c1a

  • SHA512

    9829280c9f51662718521e19e1d9cff83312f4f317e0a02f5e50f664d9fe57f1a962c7708ff6c3d66ad8d6218f91fa8d633c918c72ef7099b59ca10d8d50caf5

  • SSDEEP

    6144:CJFOPSZCBpkeYi6HAApwfN545PTygoorSP:CJpZQ4iTKPtr+

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UPX dump on OEP (original entry point) 7 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\71f110f2d6d5e36c9febf465f50ba6c98ce052c2b6981d3a353155840c1e2c1a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\71f110f2d6d5e36c9febf465f50ba6c98ce052c2b6981d3a353155840c1e2c1a.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1240
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2272
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1856
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1236

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ca7ba11a58c879b83a91cf584baec0e1

    SHA1

    38832c39e49881e36c132e8607c270eec3bbafac

    SHA256

    c39181ea17b6bc74c5412cb66f9bbf9dc9135d2c4f580fee6294091813b1ed8a

    SHA512

    718820bcb4efb6bf1c8b08a7974568da8d6de4c88f1cad31609d9e54437ac16f72b4e7741a305ab3d016ccdc8609de4f9647aa86c20845b12a0d5bb9bad0020c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    33bf36678619539f8e45d52cbf8cb61b

    SHA1

    31c24fccee811f8e95a25a1a79f44bbbac23fc6e

    SHA256

    f82c97f05566e20d328dc0aa0b059bfcd0c7f86af56487a8987e969d0c73c7a0

    SHA512

    3040c62405bc69961ae4e8dff39abc059740bd47b61c20a5b2d5dcb5aca7809db55922b2dbaa95ce30334c0bd1a2078b45ec7096fedd2e20be77a751c7259879

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e89926fd64ae4a5105007d7e04496f14

    SHA1

    9080d6da7be6eadd6762a3a3481746402c17ae54

    SHA256

    283fde84a8c6d1af5475c43ce7de433bc587e5e85a2e60c621da6a224524941d

    SHA512

    05ac780a34189c7e007d961cc49b836c09e5914e8d679c28cd4f1adf8714d0cab3fbbc926d628b7896151740cd9d4abd9efe63dbe048428d0a095490dd2d3228

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    01220d62d6c28c0e4da2af501d6700a8

    SHA1

    5d2025d72391d0222f3b2389a45bb5345835a83e

    SHA256

    0eb57a110c1f64a84db5ff321985ec7113705dae450d0e7996d5c5cb22bda69c

    SHA512

    8fd28b9de62ab27ce1532d7afee2dba476c4e946f0720b51d6740c41d5a6c4929c178334a0661f4f07145e652579eb45dccdbd5b5680e8ebebebcc684d0a29f0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    83173cc31c85d6f165bd7da15925cd97

    SHA1

    ddd09e339f2e6b0a40b27ba262a70034a9faf44e

    SHA256

    94d009e43ed504910e08760d1de8c616564784b35ff7b64b22b11548391483bb

    SHA512

    2030b37e51802b9ee27842cd10a27c2f3ea0147f9b3c2970df08563f06e856f518da3bf3981882c8cf9334e7c8d45df740c20ba026207696d9915f56d7d30d6e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1a558d89ef006d356b925d46301792f9

    SHA1

    5a0e1090d654587f3e87ca4a49db14fa07ac6e87

    SHA256

    cb5adea77441ba69855139d8538d6950485b92be5ac9051931131cade6753a94

    SHA512

    fee4a65e2b4657512cec25289cc1465219bd640fb4d9d21bcb69198cc886927b7687bc1dab5b949a62264af97c4c2bd963eba7b5dca27c0f7e5eca8a0b3f1037

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3db14eb545df43d61cd2c73575a63e61

    SHA1

    a7260acf1db9a58f129d6587403f8363d3751e7b

    SHA256

    033ad94de56568211642b2ea1115eee8e92ccf6e99f0862cbc4ce84bdb9b32ed

    SHA512

    3a8914a6934ea01d260fdc8d74500ea94fbd39f359e86404cfd44d43c0d9cb673fbbc86c6785c2580c0371e636c44543b0174d461ddc27daac58076763cd107a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fb2cdbcd44836d2cbfd3f0ccd6ec342f

    SHA1

    de8c4115b09288add98883f0a91dcc7ac5854ae8

    SHA256

    e0325e069a44014358945e295302cc6e0078c82d7a0f4c5000ae5eaa16559e6c

    SHA512

    4302e7356d26a3f2cfe8453fa40f779fbbad965057e23d2509627547ac330279963f6f24317d7b06811702960999a54410681110f969a1000853e69d79ba095f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f3e33a2fe2c4a79157bea110e8fa54ec

    SHA1

    5c29b35fa999e9aee1c0a956522237f548cb032e

    SHA256

    0121fc5e5f66ead8bcba3450d2166494d6f68bc2e1f3211426a1284137194ba3

    SHA512

    f9b9c750aa54c60e6647a3c09a3348338089d564d832f98dc723da77e71763f43a4a977f462d361b9315778667704afd35368d6e46a5927c565cc27ff7c5c81d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    05218bb6477ef9bc70d3710fd3544e21

    SHA1

    bca8f1e4f60c2fab97ee8e3eae2d5b333d8fd3df

    SHA256

    255c6fb9db02e6e5d25a3b84220d94a2198b677ca32b5dce5cd5ed56c1f43973

    SHA512

    2641bc828697af27819179b43e8e9bfef74dca1619496d82acf17d2058121ff3cb9ce3273f939f35cd95030a36f948c1cd0f11c160e3b3da0780b1ebb1aca794

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    db1a3cad0c267c6ca9296e7bbdc99bcc

    SHA1

    8b89c37a057653b30ff8785babf94e9d86104498

    SHA256

    bd88d80cc7534420b71a21e3e1707b230a93d8e73f88c490cd241b94b3c77623

    SHA512

    8f94855e5fe68354ea92247a591ffcffb12a6119f865f791d4e0c9c40d779463bc7a0d7d7deca890a21771f757ab4eecf7cc4741e2d7237d2c833d5e9df5af6a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d886ffffe01e66c03ad52b0dfa950252

    SHA1

    d27ba349211be412ecb5762926b9847dd15474e1

    SHA256

    aefb71082e3a0b7df07884d574105802c4d4870e64c65a6c56bf342c3eb4dcab

    SHA512

    0c35526ceda1b45dc16a9db57bf13fbc23bb1831b3726158ff9a8c38e80d1a2361ca19bf5471827f4dc844c114f1562723089581dfb553ef8629e690c2aa4945

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    14b7e64df3e6d81c799394181bdc085c

    SHA1

    01dcb8d3796f2737a6da2b6acdace7fe1b2c2c22

    SHA256

    3152e05024cd5610a53302d00f2984c59d3f0294fd5c67cc5dcc4a6f6a735d71

    SHA512

    603e3b22aa9a6e9cfff99b82a877f79a4f20828ae788bb3418c9ed75c3ef83a703ac2e3e2bde0f43bff2157b1ff49a84e0cd5aeee253fac34022e6ceb170a7d5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a1f6ca265ae705a718f1537bf96f5c3f

    SHA1

    767d43363ca14ed5c5dcdcd6ee8f5deb181ef8a0

    SHA256

    a61f6bdf031e93db3a7522f0de4a9d4d40861b1bca37846e3a370d28c2b72ae5

    SHA512

    e5c07802868ed2a6c785ef4fe109d362fa159f2d0a5f4bbef80ff054ca443a5d02916c760424cded6d5f6a42e971874ad11e1c42c631cc02e8200cbe4003f25d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6eaa1df8259742c74ebb6e3792a5de26

    SHA1

    529df301894d7c50311d2c2ec18aaf07c5627b95

    SHA256

    2c5fc1107c633c8fa5316d59eb14f3929782e24e8ea0608a92929caf692382cb

    SHA512

    4a1c84a81cdd73c3ab34e51e0bee1c3c498ccd041fe501870a94a7d203a174f18417ad8f780e5c9b352e9567c579af59f9728458c26fcec744eeef74e47717e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e152fc6030ee82399e8f14d173da6f75

    SHA1

    180d5998ef4ff99045cbf61bcf273cfb220fb4a2

    SHA256

    e1612eeb6e792a1ceb13f643ca9a4b1c7892c6f5b892cb6452fbcee3ecb88aac

    SHA512

    bc485f2aeeb02d9fce4a04374c5076537147882511e20cdebbacf776d600f9091eab98fa2272152a7464aaa681aa904d093b9a8675e03be8b64fc574dd49df02

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5db7493446b0b5f09a2772ee162990fb

    SHA1

    24eef991935668b5244aeb49448af68733f6c281

    SHA256

    67e791516f04f3668833edcbba7d64c671fd42baca38be029fe059e4b053d0a2

    SHA512

    4e0188c1c5719c068b1a6dc13382a267d584127becd91aa2f51f0c884370e5202064b00e5afa3bd3f93ea198760f83b02f6d7fa3a13e02519a9f9172d8a84e94

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ecbac493a2f47dae21bac8c603828340

    SHA1

    0b1ad60eaf177b19f19f5e59090d1ed274b79087

    SHA256

    ea955398ef14c777b40317478bdfff21f3fc5e4fd4e314bb22b1525f7b6b83d4

    SHA512

    3a9f864a063b4a07e3808b44e4cf815acca0cb36a33c455d78609c10c34986ad7599ccdbbc1af2d4c84e44cfd19a2541a0461acd013df9ca6b087ba2203d877d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    64bc7bd018e47387bf278d18856432c2

    SHA1

    88e5ea71a63b64a4b52f2ef0fe071713ff1615cb

    SHA256

    5706dc8844f28b514af0fa372b194af286a05bd9f6026b4d31084ef86e6aa0b1

    SHA512

    1a349179468df6d0db7b69bb1a3f00382e8edcf5c5e8d2ccd5bdcc306df23d0842f3d32316095e8468670ecdce87cd00b6b3de5cad40581929a634866db8f7d4

  • C:\Users\Admin\AppData\Local\Temp\Cab3323.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar3426.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/1240-10-0x0000000000230000-0x000000000023F000-memory.dmp

    Filesize

    60KB

  • memory/1240-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2072-3-0x00000000001C0000-0x00000000001EE000-memory.dmp

    Filesize

    184KB

  • memory/2072-496-0x00000000001C0000-0x00000000001C2000-memory.dmp

    Filesize

    8KB

  • memory/2072-2-0x0000000010000000-0x0000000010042000-memory.dmp

    Filesize

    264KB

  • memory/2272-19-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/2272-18-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2272-17-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2272-20-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB