Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2024, 00:42

General

  • Target

    d39929aef03609c5e8f15f4e833e9c4816a2f01caec08171eb0f6b45aa0ff301.dll

  • Size

    124KB

  • MD5

    f37998cac6517e6f11e623d8b670bbd0

  • SHA1

    f664f3c6b8dc395be714d458ccf84b6442f7a53f

  • SHA256

    d39929aef03609c5e8f15f4e833e9c4816a2f01caec08171eb0f6b45aa0ff301

  • SHA512

    0f322d74a79cbbe28828e89598bf4c58e4592f920061477397547d8b4d3cbb8b46cda420835d582945c7b663c7ac70f2eac4e22011c83cc7ccdd4ac83a21fb92

  • SSDEEP

    3072:hjulsxEJM7VmKeZ88Dkj7oR2SqwKJXtf5DGyVBQwIY6X4L:h/cvZNDkYR2SqwK/AyVBQ9RIL

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\d39929aef03609c5e8f15f4e833e9c4816a2f01caec08171eb0f6b45aa0ff301.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\d39929aef03609c5e8f15f4e833e9c4816a2f01caec08171eb0f6b45aa0ff301.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2360
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:2052
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2292
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    72d03f1ad7049d01f00399efaf866f26

    SHA1

    d096d57b70ee88efca99ed4cd9077c48cac44410

    SHA256

    8d5ba8270c604fab0086efa793a1d1d74f275ec295979bf44d602500c318a8dd

    SHA512

    ac60841da896031e79e49a20ab97f9de2f82970075f0073e9bbcc5a081b86086ef99dae33641c7825f62ef24e33fbc93734afb2b6e1388f17050bb772de49673

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bb27ac38afea38f6de61f2b9535ee645

    SHA1

    7f26a6915f2ca8d93b5bc1e96e67349e3771603b

    SHA256

    63ac0f4bde429102f0c07d2d4a4bc2f3921f458a94d55da919c5e9143a8fd1ca

    SHA512

    f1a0891dc5d1de96a02c3b5cc6862cc5c8c3f5fa4f6feea4cfaf45eda2d902d7e0f76063ae8bc62693403c7759e88b114a8ab97d98b12e374dabf89bb0e3de22

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c41272619ffec0ba4c5cc122115405da

    SHA1

    536cc9df3f12f646438376a7e821d3256d274fc2

    SHA256

    268c0c6ef187e7b839f1a257fde285c35b57e83ca2bccd3034d61cb56c7e989e

    SHA512

    806bb02716029c3bee57e85e17ef3a9584cd77b43eae79e5c4e8821ea021a2800014f88278357cf590c9d8ccb597b7937c4b908db0c097c6ac7fb1f1ef99c543

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    264093f53a2dbcd872caf153eae6cc7f

    SHA1

    89012721bc34e4fc4207531692da2891245a00ce

    SHA256

    9fe21fd3f9fb32319d45cb446420e7451689b09928a3be4c76abda401149b316

    SHA512

    7c75d28934912ca7b680893befbb36a33501179435587b23cdc8f536019eb57fd11b6017b20165439d62949660a29114c97004d28aa0177d9aef9373a1547876

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    04c870f25bb3c133d8e687f8cee292ff

    SHA1

    b06d499d743994a0e89f822207f1ec650070c219

    SHA256

    f197af7058f18b28e6fa063abc47ce08ac0864d5abb3e66ce332cf3bb508f297

    SHA512

    df136899bfcda4499e351b3472cc92b906bd8e37d975f2e80fc838aa015323f853c4da7469dd7b14d5dc10ffa617d3a7bd8dcc6f1734202e3c7cf47eff4318f5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4100f7fb019b5086a780560a503e675e

    SHA1

    f4dab1c790f884c99543c364f104e6aa9283effb

    SHA256

    1db43f4d16af50916244058e6db5af91e9b4427d0071d802f70aa8cf0f5803aa

    SHA512

    8500abb5fdff1d49392aebe0f5346d522cdeeabf99812b04761c7e7cb3abe45833f3264f36148e70c8ab29a07c9dd292d7ce13ba9a8d134104f7ca3ffa17ce0f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    69a559b7cfd017ec99b65c67e8090908

    SHA1

    2eb56becdcdca40e5d8b4196fa008c56e82d10a1

    SHA256

    75914ed9f8fd0da2028ee39aac4f5db980280f262e5ac9567759c7fa2ebe3e30

    SHA512

    1848791a48171a7589a0b979c12662e87950c3ae9483fcba66bf163d6f069508b469d407944abe23809a0f5057fb964fe5d55b2934cfc7284693a8d8d9054838

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f006a041f1d9fa822ca7d29a61700fd6

    SHA1

    76ca3dac749225486ddb2fcc4f6f4186a9727438

    SHA256

    d0235051f250d1d5a64a03da214b610090db639b0345a532b494a2507aeef037

    SHA512

    653b68cc8f15dcd28c67c9986408d9bade413c2ce213d5ade2f80325cb2a5281242871556926942690454dcb2397ac89e92c6de014f454de4cf29ffdfc1fe84c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6d7c8b0e37bcd2d47b63234f7eaadfa3

    SHA1

    931a17506a33ea4ffaf578b1e06ef04e1618688b

    SHA256

    e9a0383e52e40e5f85a822b3dc1f3ba6facc7afdaea3bc8e115b20b13af7b38a

    SHA512

    2b6128b584737dd067f3b08dee9890d0a9f5841c1e5eca1e71ca48efe4777582d2fe168e593e0061b7bf5ed569415f8be03db820118ffb0a499ef2b799f85363

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f1dbf44d521294ad61588a9098ff705e

    SHA1

    9c5638717e4680fdeb3b688ac5634a84e8464eab

    SHA256

    013668c00c9a1276ca6030fe5c8969a649ffb9bfaebea51158de2009bca57c9e

    SHA512

    6d7962798612c7cb224f613c27a1a3aecff600f038fc0d67484f297e50f367852f3a64b6c95f867539866c99c2e63414b8ed32ec7fdc86320f0b94de642e1a4e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    825fad84943ba112ff8c68d2f41a5882

    SHA1

    d215f3f4a437946b9157bcc074d1fcdc30c70736

    SHA256

    e9557b7f665aaf612a25b17356b7b6ea62e12108771db790d2b82fd1339893ff

    SHA512

    91b8138986c09842ed070b0fa02b26cddce74ad99420623f2ee4782c0edd9f90ea08999e0ea00d37c09d6408c548bf8b4347b2bb108eaf333ef979b7c5f8d1cc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6471dd9ef1abc130329a86a38614bd64

    SHA1

    c5749625a70bb7a6b950b47330c1faf6853eaf8b

    SHA256

    ea5f18cdef6d37379828645bcfdc49e291383ee3220cb8abd125ed3ee55ee7f0

    SHA512

    af53a91a975f884450c6c4e7f518d4a8ba5d7d12831d437338614f2b276dcf4eac8422a406efdd6033b3bd3122b08e65f1a503a5c9e0eaf52eaffef4b154a4f7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d31efae1c61836e4fe0c17d73c18e8ec

    SHA1

    df91954aaaab001c01847fb66ca2f19a3550a72a

    SHA256

    d627022c6c558db5747b984f733b660cc6e9fa72731ca7e1ebe7b7cd0af23009

    SHA512

    7e3ab636f441f838bf4e7dddc97a12448c6c8f1f920d539a550d14ad3159a6c3255c4e6686564709deb51eb07e80266265837c5eed0690e130e65f16ae33c851

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3d3df99bb3fd72a096e7c33a3e9b40ac

    SHA1

    c16fccc24937fe13c05c300c529b028f05948500

    SHA256

    7157ef82a52d5b503c9b403b8a783d3768269eb7c6ca3dddbf019595897e65e7

    SHA512

    dbed6863b1fb0d2d737a1264149b4dec1772a522073bb3ea00689bda04cd4317c91c50d9e19eea853b26239f2f329d7cddfdd5e2b3f5ebf70991f20a506029b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    86429ebbd4af6bc03d2b2c28ccbed325

    SHA1

    da4743688ea297aaa2875a2b3d5b78ca86e2da1a

    SHA256

    22bda653d610f027385b9f7d6f7c81875f50cff43b60832ff6d3b9a8caeeff52

    SHA512

    f1448b8ae8a29fb836d2c328b203f0bf339b60fccdc493fc5dc2bc44f03312f9864599a27d6786f7bc6b0c6f8f63d155a23ef97d89b8efa0b78271cd4a06cd48

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fdcdda345256d135e65a52b8799ac36f

    SHA1

    0efee9bc75df56a9005da9e851814781d62a99b6

    SHA256

    48436f7a06869df5b69c21f7540b4f78e29202f51343dc3e8e1a243b1aec14d1

    SHA512

    e449941a832ecdee3837cc869725fb1836a182d94a5d44a9e5d7f409eeeaa4d24aa53b24ad56d693b47ade81875e442f6b45be22c46a55cfaf4856e896fd906e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c339a94653d8df6c9f47fcf634b47acb

    SHA1

    410bdb5ee230a311ae599803ff61add97c8f8f67

    SHA256

    14a9d406a796803fbf52ae570b5504b0a837fe5070b32ddd0d340de8f55c215a

    SHA512

    5673ddda7effd8c6058bce95b15bc5a635f8b6dd7f5d17777d5486521295414fba2210c940f21b0d0cf31c9bf7788f9edede467ab64f8374fc70e1a24a727bb8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1917fc265bd13fcf67d969f9a4bbc918

    SHA1

    592163f8efc7cdab2d188325206139bbf548a2c7

    SHA256

    6489c2a9506de7df7262388357963c6ecac828319b8b6bfbcdc3d0263f952126

    SHA512

    5cec2830d981974ae3bb6285ecf781ca6b7cae55f40d862b31610f3a270acbc4abe809886f489222875704cae9905f9435fcd491c53a40e87f211b6c8409e383

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    40652f0b5f5d74b8cc73ee5257a1ff60

    SHA1

    2e0945ea0d6966510d4f355f4b46db4cbbcd69ab

    SHA256

    04b861829563d74d3ff7d801f54687cc5c5ccf1944a4e6a789f37ccedd4d6571

    SHA512

    6715ffa37f25f56a309ed707fde094795629649cba21d97140bb194ce9b3ca366f71df17ebd94ec5d1c32d6ec23751722739a815736ffae469957c7dc95cc886

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8539955c033e283606ff5bddccae9f7f

    SHA1

    6301baa7b0cb76ae0eaa697fe095be6e87c9deec

    SHA256

    722ea1df44c3088a120a092611222784f063199b60f2f77a29f3cbcb0b377f42

    SHA512

    29bfc195248a17c18930aad6d77d4df7374c67307b906d1c1504f32a797f25c1063dc30d23957c7e33c39b83ae45a43d9356662099e51d0f0680ab782a5f8cc3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    999a3fa635b9ed3a64a79584ea1f808a

    SHA1

    db9419c7ab263d8a183331c1826c222b37db0e5a

    SHA256

    dc039bb2348bc1847583e883f86ed3a73a70a8df8e60a6fb2f3a3d1cffd5e29b

    SHA512

    a1df7360e6acea95a42c53db8ddd0c43bbc3166620a54fd5938338aff331393ba2d0ba91471475033131c01e962aec9faa4dd702328ecf5b99621a64f6e8db4d

  • C:\Users\Admin\AppData\Local\Temp\Cab16A.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar267.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    88KB

    MD5

    fe76e62c9c90a4bea8f2c464dc867719

    SHA1

    f0935e8b6c22dea5c6e9d4127f5c10363deba541

    SHA256

    5705c47b229c893f67741480ed5e3bce60597b2bb0dd755fb1f499a23888d7d6

    SHA512

    7d6d5bfb10df493ffea7132807be417b5a283d34a1cd49042390b2b927691fd53ecf8eee459c727844395f34e4230b2cd85b38b7fb7df0a3638b244d0c3f6394

  • memory/2052-21-0x0000000000190000-0x0000000000191000-memory.dmp

    Filesize

    4KB

  • memory/2052-19-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2052-13-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2052-17-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2052-18-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2052-11-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2052-22-0x0000000077C8F000-0x0000000077C90000-memory.dmp

    Filesize

    4KB

  • memory/2052-14-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2052-20-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2052-15-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2052-12-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2360-8-0x00000000001B0000-0x00000000001D0000-memory.dmp

    Filesize

    128KB

  • memory/2360-1-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/2360-9-0x00000000001B0000-0x00000000001D0000-memory.dmp

    Filesize

    128KB

  • memory/2360-452-0x00000000001B0000-0x00000000001B6000-memory.dmp

    Filesize

    24KB