Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    66s
  • max time network
    67s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2024, 01:03

General

  • Target

    6d9d3b0cad90020a4a4bad47befa7408c1bed82dc62c840dfe39d1f11055c9ee.dll

  • Size

    160KB

  • MD5

    48460c49764b3501872b397d138d4d5e

  • SHA1

    e062959ba8f24f9fd8883beb5e189cb420cd5900

  • SHA256

    6d9d3b0cad90020a4a4bad47befa7408c1bed82dc62c840dfe39d1f11055c9ee

  • SHA512

    c3f3a7fb3ae85b5207066446bbfc95dc3631b7c9bfec00cc8f95d1b6ee69786e031097e8f1d376b8e07ac4a784f3e9c4dc88492f383acd9a018602083750f749

  • SSDEEP

    3072:hTYMTi82wQc+TBfCvKoQYxwFPtj+5X4BIHk:RYMOwr+TBqa0Wek

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d9d3b0cad90020a4a4bad47befa7408c1bed82dc62c840dfe39d1f11055c9ee.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d9d3b0cad90020a4a4bad47befa7408c1bed82dc62c840dfe39d1f11055c9ee.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2888
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2768
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a2de9df3bd6a0cf7d7eba6ad78b2bb8e

    SHA1

    95ee3ab73065f5585c3baa163a95420ba7840e82

    SHA256

    500688eb6331819bb213cad7ba8e7a633343a9ca3228489e22a3c4c919ef2571

    SHA512

    292450e37143b1f95c41c86ee5009ec6c8895584b9a304eb8b81dd810701eb881c0c55541f5c5b4067e5cf2fa8eb27fa56b4898dd6cd395aa1ac2c2ff585f8ef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    329874ae97b23ab7aca9572edf21da36

    SHA1

    3ce407f1be185026caec5a3b2c70314a4caf868f

    SHA256

    e1bf41c0fdefb4b476d434f1fc68b22d4a1aeea1d2740619545c6a3d683eec2f

    SHA512

    70405502eed62e4382a527e0fc66e85c54c88f020ce76768b0ff61f691484639d3cf527809923f6d4b496a3a59cafd3e4b42908071a327bf8ac784ab0f9a490e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c2c719b7e39c6f89637e41cda08dfad5

    SHA1

    1762387bd38c07c409cba14683c90a8fadfe2568

    SHA256

    df7eb8442feeb08579646ab50c21769fdb9d4ff34d425dc92c8aae68e7574d27

    SHA512

    23bd2cdbe90973ff39dcb52dfb531ddac981f55417fe93999fc832be976200a0864415f2c094f35807ccd0785515a8ab2bde348977a3f95c8837db980740b299

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    53d6440cf705c9c4cbdad498733d1362

    SHA1

    876c32c0f27b1be75dba3e7d26bc3022de1ea560

    SHA256

    311e1cb116572d62dc3fa557e0f26118daf04145075a8ed79a1068d0e39918f9

    SHA512

    8797d15716b75e8f610a449e96dfcea6c4bd14ab33090d2c09e392a17b3472f1017ef44880459ba57fff44639c7ab8dfd49fb4dd7f6d0ef49554fe172b6dd054

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8087d631b788696b6084cfa4ca714368

    SHA1

    491c1e3c0fa82105a0c88bd336c431a9761decde

    SHA256

    a549818fc3235bfafa23ef1811ce36bb26c7dc11d038a24ff655fda7f93c3e57

    SHA512

    974d8e7506220cec0f0ef602a729b79bed49becc3fd7089a022a567f7517c7a48648a292b3b2503b61e2a9044ea34b4addebaf843c90e4eab29d5af1f5ceba51

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8b7f1872bd1218783e92670b48df439e

    SHA1

    77c2692fd5c9d75fe9d44f34d440458595c38075

    SHA256

    46d731f4ac23b22ee79c49aa23b302fba0d6b4a4ee86f667118623277e8a916f

    SHA512

    965cc399529fba049d7262a4cd6f1f6f559347a542b3098ea1672b00d5cfec85e7ffcbcefc3826c81aab46f65193d07c4b5f5321f506e6716128357d6e810f23

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    237a502890e73e21332ad5671a90d82b

    SHA1

    73b50f5d14c9a9aaddf39a777670b5b2b0997552

    SHA256

    f541eed55fe4aa18b400937dc8d46f6afdcd983700dcfe0d9e30618f36ed7579

    SHA512

    71dbc80f58838863409fb259f0d0b776ea12a0f0c28eab983da816bc519fad48a44eb3a0eedbc28cea39650cdfe7b090db719e9c6ddbb76b9bada09564dc683b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c294800903e2da9b6fce78b3775fdd41

    SHA1

    882df13851924206392a69ecaeb0017eec5289ba

    SHA256

    19951de143a4468f7ae77bf4fe91bb483732fd86922e49ce250c8a5d1bef258e

    SHA512

    0f8cbe98e7c1976375d6a1b8a08f042aecd84540f420563f82b74eeacc1206fb43b82e25ca560b95b47d04ac1259230189c59996799f5b25448acd4a2a1c56f1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c29f8b3aa09d206bba19bb10e9f7e2d1

    SHA1

    cde843ed0e26c9c6810205003306e038316b96d5

    SHA256

    bb1b000591b19d19be0c7fd76813d903ebc29e47efa1baebfbf5d4b8b177cde2

    SHA512

    3d03abaf29e29f15ff2d37404c709e40a942d88d85f1fb82d26b50de3551923301de67ea925d64a9e3d49d0570bb4885ad8a0659009d3edad8a9500bb96792bb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    efebaad6b76f49aadf1dd0ddb715ac15

    SHA1

    2f6cd166e4652ccbfb18ec65a284cd280d5e62a0

    SHA256

    2d9268df01b0b2eea5cc6ae5f9cfc9c6929c58fd0692d7ddaa00b7f39de77d03

    SHA512

    778a5788d4b4e28b2efd8dff2c77cd66d45a52986a605aa1090f1331d09af33743034e9c5c96903dbff4a999297f9de9bc14290fd62af31b4e39259b3cf4f59d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c090b2636e7d898b4f13fca29d7f2f4b

    SHA1

    b4c10b5208ec94b16fcafde96bea9efb74054e5a

    SHA256

    6b957e16b09d3f1b89333eecc0bfcfb732249e69e50509f5145d0ac3e266f802

    SHA512

    6b9b3e4111b895b1b7bece910caf1a73bf079dab8c55ba020dd85d080998ed778bcb6aa4016dc041f4f65b14705d6693dcd79730b9d9754d684070bcfb92b5c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    095285287afad7498512a6ea95bf8459

    SHA1

    3143e58ef34358f9cfb41057f5789b0ccb0d7d16

    SHA256

    bc938175562ae1c2d02795e19a38068494df6989ce4383dfa21c142b2225e650

    SHA512

    9fc7bba390621ae1ba27cf457972434b2dba616869a9da1eff0371445f67bc4a5263b8da61ff3564bfef2b3d84fc481a52fe84f2ea26c88d6bee643f79036afd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0b171366c6a86e527e3f5a6b1efa6ddf

    SHA1

    519dd8c995307f7c54682211fc19a5d7f18cea03

    SHA256

    a901529d1b982ca9f0e9b9710bf50c3fa5d77bfac65a8383b4bc5da57f10bc4c

    SHA512

    a576793f049cbbaedd0199b13718c44b5bd493469b46ae3cf65fea2eecb2b32c5167e43e5fe3e3ba91fd201b36457c4e4d9413dfa66c07d96e299afc5d1cf802

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ea46b033f910badf57764f6d88eae999

    SHA1

    d5ed89fb56905b863f9da89d4a1c9dcbb057cc58

    SHA256

    2cc04cfd030bb3942a387f38019b7e8fef4a52822024643e53c1fed455210742

    SHA512

    36b3bacee9a030a30346ea264ef40729203c7ee7081894b1b9baeb98c3d4311a564ed5664eac3b3495992ebb8d32036d059d1e175114dea57dc365b7402813ea

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9f7c4150fef650bc4af95e9857b60e03

    SHA1

    e3b9b433cdcbd3fcbf96b884c07c5de321b5855d

    SHA256

    a4ae4071933a379b1d4f944ef476b2e53d1f871432d99c53b9198fe1256e9d57

    SHA512

    0c2cb2571fe67a89465d16497d3c2033ebb10d6a25ffe51e1e432b741c01953bce8d59c8c5a58cf20157680dcef0fe1fe8e52f8920f3ed70e56336cd87506aa2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6e8886b65e354ca627ecd67daa9f4d08

    SHA1

    5aa626e5420b07f1bf3d43acef868ba067f575b0

    SHA256

    8c483b8938fb26de788412f42696937cdc7287d54ca6eefee3a5dfba24a70331

    SHA512

    42f510f549bc980ea23e6606223356a09a0b1f5ad9d444fe1f42e0a3bf2e4cd6dc75bb156ca37fe63f1d3440e1393e34fbfa4e34ba461b653ef2618aed412ee5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cbbb7d89ac4465468ae88364cbba8028

    SHA1

    269dc5ea22139db63eb20afb61944da26237446f

    SHA256

    cc14a1c036da14bee472530e59c25c364977620efc8233f0607b576ee8842015

    SHA512

    77663c2dafe5d250e43ab8c01357493a202c451817e941f9dfd264061a9cc0e4810cc3106ba7256f9c2da0af2461ff88318715dafd7907b50af9500453788b99

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ca408e13b01137ad414ae71756d87423

    SHA1

    a03037d9597b6decc682cb5f2b6ae0c7b7d0683a

    SHA256

    da85a786d51b2de8ff7c7db6f88f370233a5630c1c95fd6a1de19e625c8099f8

    SHA512

    cfe90542d5cf82c08d9e73d20a4603cab454a53473b42c79141f17e5888020d0c52045e5446e978e232f6e230dce08207905e5ad68197385557315a435681a91

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b399d93f0adc9e2fdc5576451ab0cfab

    SHA1

    8a6c88e3fa7bc939b9b02c39bd5e71109d421097

    SHA256

    a25747fc242cca190a730d4157556347c65ad12b5c4651e5e038978348fa4b80

    SHA512

    959c51627aa9a7fe49f5f64915ce33c12391deaf60ab18a8f5cbb1581304439625c7614a999c82d019db265ef837b5c46b124b4817496d91f41565158f561f87

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    888e794eda519eacf29a06a96d991233

    SHA1

    4417741bb97f093249bb53695a1f702180106925

    SHA256

    39a2e7a3ed69c123bd0a00899a9789833c39ba0a7deeb0a864386e69901f2907

    SHA512

    47a0a18977ac77d8fd4b07b59f62f2c889039b4e1dd7409ff48d34955b01aa7e9c8c492858bcfcc0a06eff9e21543f5307daeb98464b522da2dc7666cffcdae3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5a088e39e4f9096147d5689ffb7e6622

    SHA1

    ca5b07d62282836c8bee3501be2e90ba8d6c9314

    SHA256

    259db1138fae58b5e60d462b16f61b1b9459ca948d5e135ff6cc5cfb98ce19e9

    SHA512

    b184d6bf22d01f5c7714b6850ef769b2965b511cd89111f528bf7e8e91549efce7e9fd029d343d00f9fd314cbd4ce0462a67955092dfbf0d13dc1e68ae97d6d5

  • C:\Users\Admin\AppData\Local\Temp\Cab9520.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar95A1.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/2280-15-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2280-18-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2280-17-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2372-4-0x0000000000240000-0x000000000026E000-memory.dmp

    Filesize

    184KB

  • memory/2372-1-0x0000000010000000-0x000000001003C000-memory.dmp

    Filesize

    240KB

  • memory/2888-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB