Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2024, 12:09

General

  • Target

    c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ec.exe

  • Size

    374KB

  • MD5

    9a5bb0cad32df50f58c266de40bae036

  • SHA1

    62c232cacde2b5d86a5032cd1a2379eedf889a7e

  • SHA256

    c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ec

  • SHA512

    93903abce64c9ee5674fcb9bd4d2a439c2117cc21f087bd2c3cd913830d157434518fbf10c067774186a6610d706ad1cad28231b6af8e2a7d59a4d5fad000a64

  • SSDEEP

    6144:8LD5Gs375vaV1LEUR5gMv8c5WTMDjLhpuQxvG8u6PjBcHq8pXblFT0i8YlF:8LD5z9aPZ0dMfuQpLBc1TZF

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Signatures

  • Mylobot

    Botnet which first appeared in 2017 written in C++.

  • Mylobot family
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ec.exe
    "C:\Users\Admin\AppData\Local\Temp\c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ec.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Users\Admin\AppData\Local\Temp\c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ecSrv.exe
      C:\Users\Admin\AppData\Local\Temp\c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ecSrv.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1872
      • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2072
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2568
    • C:\Users\Admin\AppData\Local\Temp\c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ec.exe
      "C:\Users\Admin\AppData\Local\Temp\c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ec.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\system32\svchost.exe"
        3⤵
        • Deletes itself
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\{00D7D4B0-4731-A92E-C628-C441E54326AB}\ad68042f.exe

    Filesize

    374KB

    MD5

    9a5bb0cad32df50f58c266de40bae036

    SHA1

    62c232cacde2b5d86a5032cd1a2379eedf889a7e

    SHA256

    c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ec

    SHA512

    93903abce64c9ee5674fcb9bd4d2a439c2117cc21f087bd2c3cd913830d157434518fbf10c067774186a6610d706ad1cad28231b6af8e2a7d59a4d5fad000a64

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0e5b83bd6bdec04b2220f3ca898c6084

    SHA1

    d55f9bf3e3868dc4cef69fccca93fd518a3ffc6b

    SHA256

    de7ca5f6f71fc337633f70ba1a1d20bb43eef0d6b4454c7e2f3e92ed4a110b9b

    SHA512

    58a3bc861c3e7f6b5fd6a3132be7d2d822e0b681baf6c9f316d9d909e96a21398d39c68aeb4230a2604e2a87efefd460b5d458ad1e7ec5109fff33da863cf40e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6a4a5eb61f7405fef606bf2ce8dd5598

    SHA1

    e9ea26598aa5765ddcd16ad96c65362d67ad6300

    SHA256

    d4bb3dd236613fb7d5a5939d28205db6efec11dac9a1c8ccbb692999e6c5b2a6

    SHA512

    6091d56390e32ff293154aa2bc3928c7b3e78d980499420c04059f03f6d266c1c94c452a996a92f34311f32d478571b0bac7f258977c7c0680684660ba95b6d9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0b946e753e72a10d2e5eccffdca67208

    SHA1

    b951924404a9ebcdf2bb56163542a4b609951f87

    SHA256

    48a36cedde3f35aba29802f0bdd53e6ab645d2ff8a05d55ac7c1c85ec015ba97

    SHA512

    84095c1de06425431843a83702eccc3c7473c91d66cfa2d9137bd8b3d5326538f88ddaac65ca99635d746b036f52973820c631b5bf145e96b33f435b1d6319ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6a5fccb99db3ca2b34607712badb0b7b

    SHA1

    e317aaf5b3c849629a9e1cad085e7893749aa6fd

    SHA256

    ec5e8938e021fb5e3268a074ed338a3c9d24cab6c8f84bbcddba58c32443032a

    SHA512

    b2233a2786a8f78479de253e9fa49cf0085a185190b3055ccf90961fd868c99abbeaee9bb46912e0a2f5c037ab2d7f5508ec06e10f2d02f5b7ebaf1a596b4b92

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ee56f9220f5eca6dda9269c09aee8e56

    SHA1

    8ebb987e9d938648207d9d75c4bc1ef7b0a53d27

    SHA256

    f79d7db631a7e4244284f416434b75fc4388e173d39138d8911395f3f1a06932

    SHA512

    9ef5e0556b7be5622e8d571a29c795dc3dd645c49f944fe63f739c37478a44d3da1d9f812e804334d57f1be202d2f36352c34109c54cd5bf41f498df40284e5d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    598bf1f2f5d7a56e5a51fb6f9ca0ad4f

    SHA1

    a27618a58e607acefa376a93763773945a374112

    SHA256

    ab6e89d6e5410841ce6f4f40226d1497337f1d467292b627b5b59f762d725287

    SHA512

    1384fba72bd7fdaa36be91720ed93d8c17f9d192d9ba14565c7322ae5bc863774c05106d6d0a2a5b974a02be46042fa6ecddbad7fb5121f0599b4abaa892e0ec

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bbf76e90b537bb72839b4051e8d71481

    SHA1

    f875ddc22f5e1db63ed409d9aedb970236463db2

    SHA256

    b3cec8ae3788f889bd52f42513e0bb75cbdce83991d0b10cb806dc7c27e24baf

    SHA512

    7f54fd92fc3e58172e16be62fb69a5a42c7d13be7bd9286e0eac623ebef5aa60172730c23e233fdaac24dc2bb986d945ed077865ee6b607b0bf7fede5215393d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7643d36ba4edbfaf07444e9612bec8b7

    SHA1

    6f072aed3481ed51ceccb8f778044b91562bed94

    SHA256

    271e4e7509b53f6c5d76d7a6537b4b1237f5ba6529c1e766bd728f0d42a31fe3

    SHA512

    45aad2c4d77ed8955be0242ecd4a1280304ec216bb421719a0bbd8dfc4cb006f9459c6679e2c445fbf93cb23edf84f60af0213f1333f5b49f598eb45288b4319

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2970eff09068a932308476f62b41f09e

    SHA1

    ed46f7712ae4d308296ffa3fc443700bfbee212b

    SHA256

    d2a35aacd78abe61c3b6f4eed11d7a9ce968c6420eccae1cfd1c40e7c542e1df

    SHA512

    d923cd126fb6462f3a4dedace58da40cfbf27ee598e8c6836b2e230c621412f7c3461fd4aacee5582d368a22c19b678cd43cbddcac81d53e5da195e0103c79aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    92992b85d3a5f80f111cf6248d2b937c

    SHA1

    34c13b45af6b739613cba7259c87e553925a7875

    SHA256

    b1addd810671d2d71080640b1bc2d63c78f0e6f56a5023ecd099d8d32f195cbe

    SHA512

    82bd9423518c64268e2aaaed7a99eb7c92d313a7537d304a3d6f38404b073547fae9c6a7dd4ae41158472500cd6a701f10a02d7dcffb584933e4f7d9f1b726aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    44130266b69b82530b99a460cc376b9f

    SHA1

    ab637e19978d3ffefe3cfda81130a5d02fba552c

    SHA256

    0e436bea509e26a00d2d107e2bc8ec75ba6862ef4aa01ed4efbda785ebbe8e02

    SHA512

    5f4ee7900ba481c6ba0bedd8ca95f0b18a31fc9b3ef6a8998f154b55ad2b240ed1ff4d7b46ef6521de7631ae5f036d0f5080e9b78bbbccc17e2394adc43a39bb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    98e3926ec5035d85633c3abb4dcb67ce

    SHA1

    06c721b6a1c0b55d66be9238ae2d6586598f633c

    SHA256

    b9d09cfe4e55a134f404c4ba8724993f49cb3163ed92ffc05f08ca12088b7733

    SHA512

    d3532f58018c0ee5ee3954f96918fb0b6b5c773c636f5becfebfe3609731c762a667ac895136a356afacc654d164e0e5becec7d09962968875041e08348dc874

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3deffacff9e70fdd77dca9c8054aed0c

    SHA1

    8e76c2860259c96e0de96dc2eb3b35125d41d7ae

    SHA256

    f14f14e55e14337a615eb652a2968e05b5ca1cfa97483a49e7689e0e20bfe465

    SHA512

    eaeca5b194e36ebe68b2b8aa6b11b114743a38c44a9b903e0f2a786b6c9cf704a27621a49c6aa168bf1d5f39228e9bb85847d8322f7c30841e987fb6e6ebf49b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    19c4a20696d45bfcda4e1ae1044981b8

    SHA1

    05903d52c731f06a78df17188cf5ef39b8d31ae9

    SHA256

    d24d8b18f626462e7e8918aa0254fb3e3f577234dde9bb44b48dc20f735857ca

    SHA512

    405da32278fc623463dac79af7bf192c71fd721a1c71d8cb7921b755caa3372d6e1afdfae9befe80a1847d8efbeaef465262dcd9ed0f2983f8b396e1851f6fc7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9d7e2b2c9df98cda34b1012162130c21

    SHA1

    49ff62a8ed9d680e49b292e78e5f9b180270c0f3

    SHA256

    105d326c9bfa937145f077269a03c47dd87e3fb1a5fe6ef85d4502052378c67a

    SHA512

    83f7c030a875e5dc7e8a579ad6080ca7fd6954ca7450358351746c8aef29f6b4fb45fe6aad6a8fc966ecf2447d91d087d44d2f7bba7c3d6f441683fb2740ba7e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    187d912ae0ecd2121c7a1cdfe81742a0

    SHA1

    ed5e5f7e1c6c55f10c4318a6db27618949a944f6

    SHA256

    8234f63736e1c1cdc6b2bfee7b173ea7ee9bbacb5ba85c83e7ebcbd7eca8d8ef

    SHA512

    a94ea0bf3e4fe1837b80cfbfa8cf6279cc0e8186e6579256963e761591e75faf90ca81206388f7afcb6025e0feb4bfc5ff9a1a15fa28467e0938be4092f597e0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a80db4c00cadf3fba4f533e86f5b3b93

    SHA1

    ece74dbfd4d64b64410a3866fea52a49a5d50f77

    SHA256

    915a8d53776af129dcbed5688dc0c72685c0a9d56fd746c194ea8ce14670d73d

    SHA512

    0c3e8c10a0a86c472e74d1448e38079515baf16e8695365e9ebcf1d83eb2dcbff4502858e400248548b5abd98ae871be3f583c912d4705843aaee13624d3a949

  • C:\Users\Admin\AppData\Local\Temp\Cab94C4.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar9582.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\c6d363698017db4132d9d39f599980bf52622ad8f33675844ed6d4b5726f47ecSrv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/1548-22-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1548-4-0x0000000000230000-0x000000000025E000-memory.dmp

    Filesize

    184KB

  • memory/1548-1-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1548-38-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1548-53-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/1548-57-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/1548-48-0x00000000004F0000-0x00000000004F1000-memory.dmp

    Filesize

    4KB

  • memory/1872-10-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1872-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1872-13-0x0000000000240000-0x000000000026E000-memory.dmp

    Filesize

    184KB

  • memory/2040-46-0x0000000000190000-0x00000000001C6000-memory.dmp

    Filesize

    216KB

  • memory/2040-41-0x0000000000190000-0x00000000001C6000-memory.dmp

    Filesize

    216KB

  • memory/2040-58-0x0000000000190000-0x00000000001C6000-memory.dmp

    Filesize

    216KB

  • memory/2040-40-0x00000000000C0000-0x000000000011E000-memory.dmp

    Filesize

    376KB

  • memory/2040-52-0x0000000000190000-0x00000000001C6000-memory.dmp

    Filesize

    216KB

  • memory/2040-45-0x0000000000190000-0x00000000001C6000-memory.dmp

    Filesize

    216KB

  • memory/2040-44-0x0000000000190000-0x00000000001C6000-memory.dmp

    Filesize

    216KB

  • memory/2040-43-0x0000000000190000-0x00000000001C6000-memory.dmp

    Filesize

    216KB

  • memory/2040-42-0x0000000000190000-0x00000000001C6000-memory.dmp

    Filesize

    216KB

  • memory/2272-39-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2272-29-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2272-47-0x0000000000440000-0x00000000004A7000-memory.dmp

    Filesize

    412KB

  • memory/2272-25-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2272-27-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2272-35-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2272-37-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2272-55-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2272-31-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2272-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2272-23-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/3036-17-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3036-21-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3036-19-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB