Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    68s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2024, 22:01 UTC

General

  • Target

    5c86ed4d75334f33e539af77769b2d9f2bf55a412686064bf1110106c83d9d3e.dll

  • Size

    124KB

  • MD5

    4605906f8cdd177f6c2b0ddd8b4cdb52

  • SHA1

    189fbe9a496a57cf8feb8b2ba84e2cffe9f1488a

  • SHA256

    5c86ed4d75334f33e539af77769b2d9f2bf55a412686064bf1110106c83d9d3e

  • SHA512

    0841da0d3a10f7784951f7ca0c0c0490445a08ee3c0bc710f4d800bc9caaebb6fde39d4406d5f82b8e5cab7a69ba769029a5eac41dda2c49d212bed322d3ccea

  • SSDEEP

    3072:Sj6tEosM7VmKeZ88Dkj7oR2SqwKJXtf5DGyVBQwIY6X47:SMcvZNDkYR2SqwK/AyVBQ9RI7

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c86ed4d75334f33e539af77769b2d9f2bf55a412686064bf1110106c83d9d3e.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c86ed4d75334f33e539af77769b2d9f2bf55a412686064bf1110106c83d9d3e.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1740
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1248
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:275457 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2392

Network

  • flag-us
    DNS
    api.bing.com
    iexplore.exe
    Remote address:
    8.8.8.8:53
    Request
    api.bing.com
    IN A
    Response
    api.bing.com
    IN CNAME
    api-bing-com.e-0001.e-msedge.net
    api-bing-com.e-0001.e-msedge.net
    IN CNAME
    e-0001.e-msedge.net
    e-0001.e-msedge.net
    IN A
    13.107.5.80
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    747 B
    7.8kB
    9
    12
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    747 B
    7.8kB
    9
    12
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    779 B
    7.8kB
    9
    12
  • 8.8.8.8:53
    api.bing.com
    dns
    iexplore.exe
    58 B
    134 B
    1
    1

    DNS Request

    api.bing.com

    DNS Response

    13.107.5.80

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bc803fcaca9714a6c61852f3947e5c49

    SHA1

    78dad12d2ec798044b33bf458da772373dd54e4d

    SHA256

    bfa39184854524351c556a195a319b167a7e01f1bc983ef78ab7dc8eef24e150

    SHA512

    eb3c29fdc25fe63fedecfab19f90328255f5a60ea95199af17952c1993c86578382c6ebeb54c34ac4755f231e50faf576e2d12eea677620db0e73fb72a702a7e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5188fb76f30abf0744523b2a27c26c4c

    SHA1

    c3827ec1dc1ef0858d81c3a46a34b2d785478ca4

    SHA256

    05a26604067a59251d9a9eb3f02f85f6b73a3aba39967212f2553bdd06ada4a3

    SHA512

    5f3251b664b178bac82416e3488b32206ee9268a483e102e9bcb784cb31c8c18d67357b04b7c0b265b941ee49097c22d670e49ee3c04bb4ab63004d1e98f469f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    25704eade308ce7496c1881d4e8e27fa

    SHA1

    6a9c451d37d9226e38abab58c1e8ba7a7924128b

    SHA256

    d892a2a90a71a483bb737f6da58df515081518547b8c6aaf219e378497fbad6c

    SHA512

    31481ebe0832bc6f19cf921e4e28d275315906c9045927d862d15dbc3ec8977cd2d0aafbb52468c1c1ff6a5544f9da9b501465d361ad2a90df5a1c812bbaba9f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f0a7a062c3fd61154d844248449d003d

    SHA1

    270d9cfbb6e0df2880bf01f0e89c85ddef0f8ff9

    SHA256

    e077d490d594ff5b41171e5433ca400f7f1769410189101c7d528076b7be8347

    SHA512

    39fb06b727ab494297812dcf02d62e5806091249c350bf053a278264a45d3d91a604f0a0b5a148c1909669d042eaf8383e8c71f09c63919748f4af8e877e855d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b4d2b8338c250a42e7c87bfd805dff3e

    SHA1

    9d09c1a62bea139a1a156faee88867c852d46ad6

    SHA256

    629ed52d23ef950c4b60e4d8f24b9029a35ac8577845f2d2043d97e40db481b6

    SHA512

    42818f45ce613e0ff11cafec2a67570c6142a431fbc26928e0a9246863a2b3c19f195b1759790c83fed252512a307d19190d1fd6f1c3dc1dcf2f96d8c6ccb34f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9622e3a258c468e8729b8698ceed8d1e

    SHA1

    0353e95ef0ce6068365ac295407f50824341920c

    SHA256

    a2ddbc5519688f3bc06e32ed021606691d599c701852229696b523b6c12cac6a

    SHA512

    efc3af0f93d4920869a24a82e5c3823d7160b4fe47d3e36a65e6983367744f9306f0884df060a44a1ad582b05df7c7bac49636799f28c567ed0ca78acdf9a997

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d916c231e022d709898f9bc20133f5f1

    SHA1

    de94da8816424f05dcf988ddf7e269033ec65636

    SHA256

    126d282a8d046650b90f307035bbf9f0757bd29a60412a77b36fe3420a597cb3

    SHA512

    204ae2238c5f229fc079370dae758d2726a5a800c8f11e97e21490887b38509da2bde6a1912da62dc156cc0503ae32800c0d98d1b3f00d1712d48f9ac70882f1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    721e582c7a6b0e272f67cd5de5ce81b4

    SHA1

    4efacedfafbb0d6669879d1a6c654b7c08ca5b6c

    SHA256

    f3c61df8c58c76ae35e24d1c25930f7869f0e115bab3ade4692f299dc5e44e0f

    SHA512

    04612fd0ee964c9d68ff6b156133e62f7fe287872efc2d0ceb309c28fd8984a97d3c350479f847d7c8bfdbdbbc6a55bbafe06dda8670c39959c08799e4a9fd81

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a2f6ffcf4771f25485fd46430823e93e

    SHA1

    0fc588b180290933622970204f353f934d89ebc8

    SHA256

    69462e78bf49361519d1147a2595c235f276d473f37fde20f9603ef28738f3c0

    SHA512

    7055ca262d2b1f0c04dbd6738453738d92360bbd8499c56b2029c91b2af14cdc9c594e1e41ebdba34973defdfd75f14dca02c43543f0dc93b5c562be7b652848

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1d59e5dee72061ab24b31698ed12cba1

    SHA1

    ae3e2e4aecd3a9139c193e1999f7bc24e51e3a8e

    SHA256

    0fd3478753b5faa279dfbea42b7605b10d20b92586367b70088d170060964dc3

    SHA512

    5108ef9717407317dd067d712c4fdee7294030bb97d705e55debbafc737d2456f93ac9fe5d09ced6ba55ddc41cd249e8bb5cb2598a003e7bb9d17cb52898b378

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    57e52cbc8a49d75c119be8cedf2d6eac

    SHA1

    2fac5697f2ea09c64131aa382e929e3543e5f87c

    SHA256

    a7066edf061caa5aae7a23e5cbe1a2545a7245d98f3991c8d0f7979d57c70311

    SHA512

    603315154f4d5ca7180941ae225615f8206c6695824b540a6062b6e2dc210870688a412d24f50f3e3845428ca32be09f8f12189df66f6b1002637151d22e5188

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a3bc64b5f7895b5c82dd93c4dda28b95

    SHA1

    130e2fdc58c35ceb3ad70f8742a264c49e214eaf

    SHA256

    e214b63d50f7379f5d569d4feecb8c1c56a6137aa8ea4cec9dbe555462ac0c87

    SHA512

    d770b5dbb42fa24083d9f0b3668a829beb8ff3eac2409268d3f28092b06a9b060b93bf05289bcadd6ac00cc98fe2cf1d42d3c8e05d17209317596719e7e43a40

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    592400dd04e2d1e4d6943aa43919ae87

    SHA1

    2ae7e06af5e2658149138b065cd8e8ffd4331c99

    SHA256

    3c6550135d2d442fc087a657f5834d6626353aed805f8ac2c608ba04ba36f34d

    SHA512

    16d7c68f0b38902ec1b178cd40e834ef853b51ff09f99d332db80692015087be145fe2afc9a31521555665bdf452ed589b66a53ef1345ffb4e089f4aec84b6fc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3f438fa12ad82274e849a9c2428946d2

    SHA1

    c20c43fbe0eba960016b1c961a84ffefc5653769

    SHA256

    668c96c22f931a365be0373ddcf153a39649650e4d4404dc2d1b51143951d7ef

    SHA512

    d47c38345886b421a3531b574f8594e1f7223bcd4a665f4e07cd861966a10a9b20aacb4024a11b0c91807c69de6215e33e5f79725a90b724dd6e24b00fb4c676

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9f47058cf05efc0ae33aa8a4dd6495a7

    SHA1

    2edb34c37441c35c0c504be2b0d182f4bc8c20ff

    SHA256

    b7e1ac1c20c85ee2451876a4a6177caaf9fb6d6df01033e9bfc7047e9f07f529

    SHA512

    b7e7916b4a15b4b971125b432750515e7a3db52fc9881339f60f4890e74e9b534b5b8003d42397d454b8694adf48e37ec8ce0252799786196baa6d23bec62f86

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cdadc624d57a35eb5a99adba98c59ac1

    SHA1

    ef895ee034d58254b43c723a71c29fb228a0a1b9

    SHA256

    ca78a8cebc8805a29a4a6d8e116ff34f8ba37b35cde9d4b46028085257a51c63

    SHA512

    2d39b5877ec6b5c86f562558b511aec6fad19df46607d34a623a6f5adf4646135faf5a8ce6e6118263c04579bd904ffd8d9720187dfbf33c94f0d345b9e451a5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d71668197705c74c0c2435b50ed75762

    SHA1

    80722d06508fc9b0601ccf7db17c4c990e705abc

    SHA256

    c07cdb7dd5636e451ed93f932c3e61d5ef8b119ad980a8a92c7c5b2407bfb9b3

    SHA512

    c21536f6971d5cfa897796be3c1702ed1042550fd6b67b48d7255214be84800e86bfa5dfe84c8aa2ba81fb72628cb3d20ddecc5e1ee9f770b2e230a5ab17b425

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5a426d66fc6bd5e88995226d6b0b783a

    SHA1

    90578e127441e88b702711e66120e5208877b69f

    SHA256

    7e26367c2f1930fc74db5e7a73e55b2b7b5f10bbac636c5479fc2cebbe6b56ad

    SHA512

    b25f5967dbd3efd6c2777a236ffc1dc50776a4955b9df0403c9f9ed8a3f3a86b4dbfc22006b09623a9f158664d120ef40190c202fc07fc9047240173952ecf4c

  • C:\Users\Admin\AppData\Local\Temp\CabA8B1.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarA97F.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    88KB

    MD5

    fe76e62c9c90a4bea8f2c464dc867719

    SHA1

    f0935e8b6c22dea5c6e9d4127f5c10363deba541

    SHA256

    5705c47b229c893f67741480ed5e3bce60597b2bb0dd755fb1f499a23888d7d6

    SHA512

    7d6d5bfb10df493ffea7132807be417b5a283d34a1cd49042390b2b927691fd53ecf8eee459c727844395f34e4230b2cd85b38b7fb7df0a3638b244d0c3f6394

  • memory/1740-8-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/1740-1-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/2572-19-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2572-18-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2572-20-0x0000000000190000-0x0000000000191000-memory.dmp

    Filesize

    4KB

  • memory/2572-10-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2572-21-0x0000000076F6F000-0x0000000076F70000-memory.dmp

    Filesize

    4KB

  • memory/2572-13-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2572-17-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2572-16-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2572-14-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2572-11-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2572-12-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.