Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18/12/2024, 10:48 UTC

General

  • Target

    2715e2e331369c798ad9218355bc79e0bed9d8e4f6fdf165202ede645a158a7e.dll

  • Size

    4.7MB

  • MD5

    0fd370a8f48b6f0f833fb24a77d98ae3

  • SHA1

    579cbfbe20611958062b102652a4051a6b9a1be8

  • SHA256

    2715e2e331369c798ad9218355bc79e0bed9d8e4f6fdf165202ede645a158a7e

  • SHA512

    5f7be894f9f2675b7f8b4e643ce0d0cbbc3ab997856f8f51422f12c0978417de47d125d0ba88beb1334cdc974ff31030f4d8d570f46d74749e15437aa08f976e

  • SSDEEP

    98304:9aTiZ7qe+aOKvp3QZ6/HbS9FugmTw3gvhiWaOuBuJ0Ato4z/ukDr:9aTiZ7qfRmp3QZ6/+9Fu/v0AmWh/

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wininit.exe
    wininit.exe
    1⤵
      PID:380
      • C:\Windows\system32\services.exe
        C:\Windows\system32\services.exe
        2⤵
          PID:472
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch
            3⤵
              PID:588
              • C:\Windows\system32\DllHost.exe
                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                4⤵
                  PID:1940
                • C:\Windows\system32\wbem\wmiprvse.exe
                  C:\Windows\system32\wbem\wmiprvse.exe
                  4⤵
                    PID:1252
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k RPCSS
                  3⤵
                    PID:668
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                    3⤵
                      PID:740
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                      3⤵
                        PID:804
                        • C:\Windows\system32\Dwm.exe
                          "C:\Windows\system32\Dwm.exe"
                          4⤵
                            PID:1108
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs
                          3⤵
                            PID:844
                            • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                              wmiadap.exe /F /T /R
                              4⤵
                                PID:1084
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService
                              3⤵
                                PID:960
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k NetworkService
                                3⤵
                                  PID:284
                                • C:\Windows\System32\spoolsv.exe
                                  C:\Windows\System32\spoolsv.exe
                                  3⤵
                                    PID:1048
                                  • C:\Windows\system32\taskhost.exe
                                    "taskhost.exe"
                                    3⤵
                                      PID:1060
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                      3⤵
                                        PID:1136
                                      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                        3⤵
                                          PID:2020
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                          3⤵
                                            PID:2260
                                          • C:\Windows\system32\sppsvc.exe
                                            C:\Windows\system32\sppsvc.exe
                                            3⤵
                                              PID:2220
                                          • C:\Windows\system32\lsass.exe
                                            C:\Windows\system32\lsass.exe
                                            2⤵
                                              PID:488
                                            • C:\Windows\system32\lsm.exe
                                              C:\Windows\system32\lsm.exe
                                              2⤵
                                                PID:496
                                            • C:\Windows\system32\csrss.exe
                                              %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                              1⤵
                                                PID:388
                                              • C:\Windows\system32\winlogon.exe
                                                winlogon.exe
                                                1⤵
                                                  PID:428
                                                • C:\Windows\Explorer.EXE
                                                  C:\Windows\Explorer.EXE
                                                  1⤵
                                                    PID:1180
                                                    • C:\Windows\system32\rundll32.exe
                                                      rundll32.exe C:\Users\Admin\AppData\Local\Temp\2715e2e331369c798ad9218355bc79e0bed9d8e4f6fdf165202ede645a158a7e.dll,#1
                                                      2⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2684
                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                        rundll32.exe C:\Users\Admin\AppData\Local\Temp\2715e2e331369c798ad9218355bc79e0bed9d8e4f6fdf165202ede645a158a7e.dll,#1
                                                        3⤵
                                                        • Loads dropped DLL
                                                        • Drops file in System32 directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2740
                                                        • C:\Windows\SysWOW64\rundll32Srv.exe
                                                          C:\Windows\SysWOW64\rundll32Srv.exe
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious behavior: MapViewOfSection
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2780

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • \Windows\SysWOW64\rundll32Srv.exe

                                                    Filesize

                                                    84KB

                                                    MD5

                                                    15c4d91b9254aa6a5d9cdf15a8c5fad1

                                                    SHA1

                                                    b07290b367a128f452edad6de8de5e2acc9157b4

                                                    SHA256

                                                    b169c634039baad537f3bed807d571efb6c5d3bed0088effa06fbdaa4bd362c8

                                                    SHA512

                                                    007ac72c67af1ffa3d0e829dea45ae4a70ea3f537f281ec3f1add4253c3fa4b9e854887073b6c0dfed7cc7e058e3210a3cd9d259a5b1cd053dc0b64e6a5ae7ed

                                                  • memory/2740-4-0x0000000006000000-0x00000000064C7000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/2740-10-0x0000000006000000-0x00000000064C7000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/2740-12-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

                                                    Filesize

                                                    48KB

                                                  • memory/2740-11-0x000000007785F000-0x0000000077860000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2740-13-0x0000000006000000-0x00000000064C7000-memory.dmp

                                                    Filesize

                                                    4.8MB

                                                  • memory/2780-9-0x0000000000400000-0x0000000000435000-memory.dmp

                                                    Filesize

                                                    212KB

                                                  We care about your privacy.

                                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.