Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 04:53
Static task
static1
Behavioral task
behavioral1
Sample
b3389a16488b7cc5c4b7c03af7be310a2eb04123a9504c49052385b11785e441N.dll
Resource
win7-20241010-en
General
-
Target
b3389a16488b7cc5c4b7c03af7be310a2eb04123a9504c49052385b11785e441N.dll
-
Size
176KB
-
MD5
3962976ddaff97bd02bd8b73bda55dc0
-
SHA1
3daffe6cb072deb37f9ac7ad459f6083a85ed684
-
SHA256
b3389a16488b7cc5c4b7c03af7be310a2eb04123a9504c49052385b11785e441
-
SHA512
cb81d335a6772fe8795a8ca59c234832f5cc1273091990a47d34d65c4dfea7c9f9cedcad8df5b04b10bdd7d62afbc0a9f5d3f1b634c15cb9ee478aa58da7dbb6
-
SSDEEP
3072:KLKa1Zln2E+HVpTbFVKTyDr6wjZuqhWcA69EShJEsyDdb2zSp0ecQnttCe9VfAi:wKa1f2jV+2rDIKe69EeJElwa0ebtkM3
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 3064 rundll32mgr.exe -
Loads dropped DLL 4 IoCs
pid Process 2124 rundll32.exe 2124 rundll32.exe 3064 rundll32mgr.exe 3064 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral1/memory/3064-10-0x0000000000400000-0x000000000042C1D8-memory.dmp upx behavioral1/memory/3064-13-0x0000000000400000-0x000000000042C1D8-memory.dmp upx behavioral1/memory/3064-17-0x0000000000400000-0x000000000042C1D8-memory.dmp upx behavioral1/memory/3064-19-0x0000000000400000-0x000000000042D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2124 2820 rundll32.exe 30 PID 2820 wrote to memory of 2124 2820 rundll32.exe 30 PID 2820 wrote to memory of 2124 2820 rundll32.exe 30 PID 2820 wrote to memory of 2124 2820 rundll32.exe 30 PID 2820 wrote to memory of 2124 2820 rundll32.exe 30 PID 2820 wrote to memory of 2124 2820 rundll32.exe 30 PID 2820 wrote to memory of 2124 2820 rundll32.exe 30 PID 2124 wrote to memory of 3064 2124 rundll32.exe 31 PID 2124 wrote to memory of 3064 2124 rundll32.exe 31 PID 2124 wrote to memory of 3064 2124 rundll32.exe 31 PID 2124 wrote to memory of 3064 2124 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b3389a16488b7cc5c4b7c03af7be310a2eb04123a9504c49052385b11785e441N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b3389a16488b7cc5c4b7c03af7be310a2eb04123a9504c49052385b11785e441N.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
Filesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94
-
Filesize
97KB
MD5ef5dc2521333fb418bd5518f1db3fd08
SHA13d5e8d6dbf09a599f674fe9d6c1d736b0c31cb70
SHA25675bfc7c1f54f2579541c35f721a6bbd9083c7208bd989624ceb25f16bd03afbe
SHA5128768e95f5539dc61350f552d575c683e20e000f41283701c9c5f393da40975a02a7d432374c72565f3e1848266ee94e20d905f62b849f91f3c956b7980d87882