Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    68s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2024, 02:09

General

  • Target

    e61c561aada669fd9b6a00bda768f81368a091e4fea581d29fdf058d4144658fN.dll

  • Size

    124KB

  • MD5

    ab0a8d77ba1aca11ac8e8d2003a19840

  • SHA1

    af203381dcf061e1f1f5652f7876c9c027300f96

  • SHA256

    e61c561aada669fd9b6a00bda768f81368a091e4fea581d29fdf058d4144658f

  • SHA512

    740b5dc815d4ab96a824a54fc77b74cd67d3d8e4de2cfb873c7c7b8a52cb385f430e8dfe8a4f9fc5721e4bf6ef9380820980e2d5e76782e8d876612d30ad4ba0

  • SSDEEP

    3072:fj6tCphM7VmKeZ88Dkj7oR2SqwKJXtf5DGyVBQwIY6X45:f2cvZNDkYR2SqwK/AyVBQ9RI5

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e61c561aada669fd9b6a00bda768f81368a091e4fea581d29fdf058d4144658fN.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\e61c561aada669fd9b6a00bda768f81368a091e4fea581d29fdf058d4144658fN.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:348
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1252
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1252 CREDAT:275457 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    58e823dad7ffb8c1e552e5d2ada23b38

    SHA1

    ae2d6b6aa425083094c54a2ff721c9822b797992

    SHA256

    9b7ce516a0a9c17cee1ddc42e082f1a2b26a1293339265c832bab86309f9cab3

    SHA512

    349910dbcd91e7bbeeacd1c1de9eef3836258ee9e0970b3086ed2b93883a8eb3f251ea40ab8dc0daf56885b47e676ea784f60ca0997d5e69b21cc3fd0858140d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bbaf2c86d4fb221e3f8a922be91da124

    SHA1

    3747ed8e25ff30c06b297a902ad1b0b720f57049

    SHA256

    3c4506931c1c9e740b0ceb36209b3be56517d72322c92e320f093e29e55792b3

    SHA512

    18d9812af8fd91efcc1713c0477271ed8109c5e904e5dd41c488fcfb626c0d0bbfe06a59f4185025aebb48b9bb8f9ff54d7da72b3f2777705d7f7bc19f7b8ef1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7560a9043e853f0d4f3961a8b96b9b9f

    SHA1

    2992052ac4a3de7e0c143589143df99121cd4e9e

    SHA256

    c1ef973d4cd464cb0b24c24c6c17457206141dcfb8d43f78b2dc2a8da0efb0cc

    SHA512

    fd854364dff8f31b5a2c9049e64488af0863873d940f5aac36fa335a41907d0e3a271ebd9caf8da2a6dd1b9f43a16f452d6a2bbeafffaf89a0507539cac84379

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a3d40f2ae7cea83e8e35281cd0041873

    SHA1

    807d08398c891cac8972a76a5870d97922ee2e2a

    SHA256

    cbdb50485d8643e786c27ed2861cc4275519512f5dc680b5b5d1bb5dcf47fdff

    SHA512

    8f3e28a94c8ad82cef4efb9f95b682be7c4f57965d410d93bceddeb04697a4c75da79ffe72b5d4adbc3887e6a708eddf8b0213118819f74899d8a53d397bc794

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fcdbbfa5b4db98ece58545a8bbd5d5e2

    SHA1

    c6ed6a2c4ec4974b63b5445c754677a2cc42d385

    SHA256

    7a62157c63de2f057b539ff3a09a5632a3df549c36ea7479804d58ec68e92da0

    SHA512

    67d4e5c90248d2d7fb1511a7bd6f4b50f10586d9e18e5df32bb355466c759b757208d6c928ae11dd5fd52b98b01431bad58630659eb5a07f1ca59b4c55c92840

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    98f0bb75bb8d4c4c5775e06847138cab

    SHA1

    4282a0380c2bc9ee9030f356659c6ce49c07f020

    SHA256

    9e29574d9e0ab1403b26f655045f342bea739b1b5b46efd1f1ac9c6f7be08960

    SHA512

    16256a32fa8395a1f312185fef4e67d08539620955e124c8698caa8c98d2acf5f7fd3b2088ffee334757081f3ba907ff98406e8fcd3bcde7efc9dda49f4ec2b4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    70448396cfe009fbd10d979d7dbb6d62

    SHA1

    15a7985eff1e85ae0cde9d62d8d4ff986a43938c

    SHA256

    84a1607e18f03aa45c62f1d312ea9c57363ba816cd1cceb99bf5b65173f0ba78

    SHA512

    d4b68cdc012ec057515b2836f94e649fb6c4cd8794795fac0b818f1e0ebdba26fd4694b89977d04270988c5185fb1dc2f532c08f57a91440cd7482c333c3e736

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f8783faa4e1a7a445ec896d2b6cca3df

    SHA1

    6e45d2465358163dd0716aaee47c73c8ff74a0fb

    SHA256

    ee58cda33beeacc256addef5ed99fdbded1b62970536d5c2f0240c4ca250f004

    SHA512

    e6cd02d1913e17d40bf68aa6d1a7c5464347df8a1182e4f6a7646047f9427da1fafc086f3c98e0d39a7be485b1ae17854e841f9e7183019ede8dc8d060975eb6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    76556235fdf40651c08b66052ec99132

    SHA1

    2c4e9c95afa047d186c0c45b29114aa3cc07a084

    SHA256

    5fa0ecc28e5c40e11e35b2398e2b2e0b37bb11737b753e520aed0a72be9f6f6f

    SHA512

    5b7cb05b0c516f4fb253be5183e101f87c359c747182801ad80bbc226ed56c9e144247d753ddcb7365aa1bba1da1b08b76835830240a611c8a1c1a57cba71261

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    798deb10ea22dd0f2c49fff4da52bf91

    SHA1

    162b5d8125f696db292c0b2f978e40a8cd0b5a75

    SHA256

    07a8280f37a564017f43b87d5507add304ce58b5cccc98ff44492af013a92686

    SHA512

    ff63d4b233a91ff678994115e20106041832280eb449767624653c97877edc371972f2aa79f5d1e8e317a3c7744082dbe404d5720750c192a12883608addb67f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    27203709607d8e6cdf4e400137a6d8b7

    SHA1

    6c1cb62f224e07a9bdc9964f1e52083f8b60f3a3

    SHA256

    e74df07a74d4fb7640bfe9d2f40bae9263c9e0297204c693655d1e48c57ee31f

    SHA512

    395da46230130f7dc642ba975e1435bba463db0a1938b2d97711a7eaa36370e0379039240bad655ac6e10e2c8274609fc10a3dc8b16563eef2bedae373f3fb47

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    26f72d0dd6737fcfc20d50cbad175c19

    SHA1

    f53204be370b785ca762f7b5f8ec7bff2a2205a1

    SHA256

    6437a527b8d90436444c6fc5fe8f1068a6a49ab06eb832057138c63b456f6934

    SHA512

    89bdb615094f92553da9a7b0e919c7c9631e0289fc6428d805237e5e6da402139c74da0e1ed8c820873ffc6c63b0f657c936b7a8244d1d6edec299c841f750b1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6b5b6c0b69447377e1c67ed9021e67f2

    SHA1

    2923f8330abc32e6d6b4d7b29d92c15e87fb3c3c

    SHA256

    7dff0094e67ad4ac9c5dd0fc1675334f474489047941e9bd077fcbfc69a4d713

    SHA512

    f2094ff4b747478a20fee982c3cf52d03a9870d8fab4f7586ab8bc1c65d45e0acbfd9ec0323b28d7814098e8ff85e1eb05a7fd2bcae217d140729eb1ef678ef5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    73e716eca010426fbb24ec913fd95fd0

    SHA1

    01eefc6bebe548ecb80cebb44883cddbb501e921

    SHA256

    47f042bbd321b10162c98cf727be94b82b273921d9cc626aace7186d965f1889

    SHA512

    81ca4de8f4dd7dd5cbbf4f7cda7ccb6b09bc70107a2edbaf6eb84bceb9a0768a985242c43484ddfaed144014ad8d747720952a977015636917ce8625edd842f9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5935efce7ff31b821d9bb84c48657018

    SHA1

    20da3c581d8f25078aa9072f0e1205a8dc8ffb2a

    SHA256

    834166c48e564574e35340ba4d0639b82d42100f111b851e384c60c0fef2d96e

    SHA512

    989e29dff2a10cdeb16ce992e12eeb47b3d687f533debc8f810e8985b101f8ab9ebabe6345b9767acea8d737c3f6119ced85ac92c1f60b3da8e479fff41e8874

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c0aa8135b5a596f10694c84abdb829e1

    SHA1

    c2f33b553cf8f25d69465ab76af4c5b3ed8d613f

    SHA256

    b23ab1c714ced7fd0199eb1e7135e301875de23adbbb930ff8291fffb0018a53

    SHA512

    70f9b37fffcf9c62746beb979fb6713c1bec883292208d3a5fa59d106040a04adda25480b2747c4d2b96a7e4cd661790d6c633e658bced078245c273bd329939

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c3553769a9713330f2b640e138882b41

    SHA1

    cf53512058cfd81e0cd56c91f1432b259a7fd9ee

    SHA256

    82b408da5bfc8e3c0fd8441cac49d2fcf650c2a1568df8f00adf639d3efc8092

    SHA512

    20035666976f50d8d7cf73af91cff17927ed9f9c98e1cf269f8ea94b6f431f5fedba6a75bd8508a4ab9f79f7ba41513c4f601ff1e45cd0001c473204653c76d6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a31b4c3fe19d3cb0841fdc194dcec881

    SHA1

    77e4d4ad385361aa96e727a2ce14c6bb4fc4deeb

    SHA256

    32f086c784366750f28f1f14d386b439ad151bff7fc6241404e1194c37320989

    SHA512

    6ebc7761f2337fb21aae54dbb99eae19d645f0cd52938d921ff3123c73e6baef21b0fab62704a8f5ff007b15420722a053099493708eab2947699f0d3ca49da7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    13e0596908b1d0c265d44f890380b362

    SHA1

    ef039b70c9975aaf7bd877cd1e1765dae7877d48

    SHA256

    b0dbec774bc1bcf5b696f47570a04dc2ae6e000976f9fc137af242eb6341e31b

    SHA512

    c6f4cb3dac3f9a1e0e29418895513c04ee3d8ad625f8b0ec34be8d64e03883547d883dc0f8b04493fde7cb926e6727444ec13a7fb4b7f8f1d2301814e69f9960

  • C:\Users\Admin\AppData\Local\Temp\CabD605.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarD713.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    88KB

    MD5

    fe76e62c9c90a4bea8f2c464dc867719

    SHA1

    f0935e8b6c22dea5c6e9d4127f5c10363deba541

    SHA256

    5705c47b229c893f67741480ed5e3bce60597b2bb0dd755fb1f499a23888d7d6

    SHA512

    7d6d5bfb10df493ffea7132807be417b5a283d34a1cd49042390b2b927691fd53ecf8eee459c727844395f34e4230b2cd85b38b7fb7df0a3638b244d0c3f6394

  • memory/348-1-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/348-4-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/348-10-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2084-17-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2084-23-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2084-21-0x000000007777F000-0x0000000077780000-memory.dmp

    Filesize

    4KB

  • memory/2084-20-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2084-18-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2084-16-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/2084-15-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2084-14-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2084-13-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2084-19-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2084-11-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2084-12-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB