Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    75s
  • max time network
    68s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2024, 14:48

General

  • Target

    a3a0279b47cf0c47c6f62c267adee86c49cd36ad24b8e4d95552397e5d2aad98N.dll

  • Size

    124KB

  • MD5

    f354cf407d385c972fae6e51d666fdc0

  • SHA1

    b35965420b25ef5e59ff8a41d6fdfcb08a5edde4

  • SHA256

    a3a0279b47cf0c47c6f62c267adee86c49cd36ad24b8e4d95552397e5d2aad98

  • SHA512

    40df2f255043c5252f77c1f9eacb08e7696fd4ac209f5b1a2e72845877b3aaca710d7e8cb27ce5d1042a44ad28c113b3f25b85198b3d520af0be4f1258f2ce69

  • SSDEEP

    3072:Fj6tJY+M7VmKeZ88Dkj7oR2SqwKJXtf5DGyVBQwIY6X4oL:FzcvZNDkYR2SqwK/AyVBQ9RIw

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a0279b47cf0c47c6f62c267adee86c49cd36ad24b8e4d95552397e5d2aad98N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3a0279b47cf0c47c6f62c267adee86c49cd36ad24b8e4d95552397e5d2aad98N.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2648
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    68ea12fda28160f581efa868e6d503d9

    SHA1

    79f2a0efc123e40048254f75f62a0ab3471a4938

    SHA256

    54ef2c20e00f52bf15dbea440cd9a58640f982731a8d780f33f2431aff42823a

    SHA512

    5ca5c5f370150561c053ab547fe366ffe8d33bdfa5c5ffea8eca608346d74a80dd53871bc65e81e19c1acb6df912fd52b84cbe12faf625aecc6e0d8e46368177

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f70572aec4654d1232c1c1d25c6aa5cc

    SHA1

    e0412d9e13ff15e9f82e93b93f2ca5be14570fc8

    SHA256

    ce20d58fe831bd079a5fd45ce2185ff972399e1c50e9303434d9b2915ce229fd

    SHA512

    c0a3ade1f7288125ed8683311ab7a4e923c13d278d0d29c5a222236c5f82ec0c5cc8791cba6c7b80351f390854a26e05089cae96bfbba93a1670b5c2c30e2022

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fdcfd6fd57a16f87ae1b64ef3be72b63

    SHA1

    7dfdb5df5b299d16975cb54c95fad556aa3babc5

    SHA256

    2194a9f4ec1606826fd9ddd39513bdac1c7db6f37f2c7f09dacd664af9ac5cde

    SHA512

    097105519bdc7d3f79815bea0dc5a8bbb9104db05e4c556afd42e0dee2418815d1534a0405c1d381463d144f4200c647d02a9eec0d3d24a66bc5539035daaeb7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d189d312b9f92b3f868fee552b3c5751

    SHA1

    d630497dffe7eb244b109307e4a0fc9d6f505d91

    SHA256

    f776f4e9eae19e50e753346eb0fbe0b49b50880cca2b19960ec4293d476886c8

    SHA512

    9033f1fb84ba33e0e46ddb69479f0bb2247fabd052da2c81bb36e73eff3f80cbfd1558f16a2f9560088bcbf15235e895fc9b90a76940e90189e60786149cdf57

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9409d60175c3f2c7440f6bbd0a3ef5a5

    SHA1

    180517775a17e4e3efe01fb2978776957bd774ea

    SHA256

    5b75fadd80b375504e804f82d0aad43f15283763352844fb9a55f94dfb6fa44a

    SHA512

    07c66ead9b9cda63b3a1d77301e77f26f5e20b74ca67904b9cf1c371535feb372f1f6620ef3d1bf3f5cbfc023ce5a7681019e7bceb1e0a8d15dcb2ae95f66cf4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    247193fff8071120b236ae6e10c6fa21

    SHA1

    f76c9223a050c926c8c22dda82771dc0957a2cf3

    SHA256

    ac6b1c9347e19c1bd8521c1e6b7a5ffe0f213d57819c6bb38187b2f506bafc7f

    SHA512

    33be760eaca796e11920afe9ee35ed5deaa83d3db0b19fd2212f2838d74c22e152c00bb315cd6e9966b74bde530baf11c5e7037f8e83ef679a2506e29a2a7419

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c0d01a2a341510de4f0ed580717e33bd

    SHA1

    3bbde30b42432e5f2aa5157a8cfa8e3c2be29682

    SHA256

    d1528640a0549f757da124c2606a334a74093814addd5ecb09a445328c70509f

    SHA512

    653c1ce51b9c40aea5f388636ef0ba9799f7a214d3806d148a0f29e8eb3825ef647fefe4ed7c68bbdbc7dc2551cdf6088a3ef20c6188b72ac02912d6886c48b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2e5f54475ca88c74659cadc63a52e06a

    SHA1

    3a6a03c387436fbc8eae301e5aa97098ec92ae52

    SHA256

    272270cd4d8fae37774fc54891946ba59454a16b0fe91ad31c55d6c4a02360e9

    SHA512

    c653f99181c5ab6e5ced673df6cf92a08746856399e339be67b32a871bdc487ec4da9265c79e9697461ac6253e8120e0cb3efae823ac82761b8f5dda73cb2028

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ece05f8156fbc92f8ef25597747bccf3

    SHA1

    1464c3ea53aae55d721543bcc33ba2700cea13c8

    SHA256

    cf36bc37c8dfb0dc2ebafcc8ff20b2991886cc785096a9f3121e776a212bdb42

    SHA512

    4c55c6bd6cd9e9d51b3dc19938dc76a76ac360fce5136fe3c7078437754a3a535263effcdde5c56b96127f70b462084e862197ea488c46c182d8c78ca0de16f1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e208c950b8a7ed2b8e90a9c4f1eebed1

    SHA1

    e54b685eff7b2a5a2484a7ca722c45f15e5abf54

    SHA256

    b582b6735f6695491b7eb0833bac78979566c16c1230736707352bad7d3746a4

    SHA512

    f39101b456a644230e32bfdb324419eef9c80cf23352e6279a3bc460995c54ba68cd389203cfbae01c9efd516749995ec6c5ab77750a32e5364dbdd45f9a96b6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f709c80aa4060348b0baa584100049f2

    SHA1

    14e5ab7276ebff300b772645a9e3528515e4f9ce

    SHA256

    bbbd6141fdb0e83df8245428c0d29e602cf65c80a4eede6b20dc84c55ff7f4f8

    SHA512

    1af706a4dd322151b164c0c929baaf4b1684f81c86d469231b55c1a79cae7496f7c1850653bc56a5eda8a048b63b0ead28891d89918ad615956ae98cb359771a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    eb536199fb5433dc3771a64a1c30985a

    SHA1

    4b863fd8174a1c0312165dc2dc95cb39ba90cac5

    SHA256

    c48d767580955b9b1a161a0ef9fb2cf02ade7260b55dd0d2e8b8ef5546d39478

    SHA512

    2eca314f6927f770f225ea227f09b50513ea61cc53e8618589c86230615b6df979dc084b0497ab56b3de575eef67cfc3c4c5b7b04583dc26aea05accb5694194

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    efd56c0caa1a27a9c291403af4afc340

    SHA1

    29a39d01f86f543a0cca0f8f4be2d6b533e4b6b6

    SHA256

    bf2dcd2bc2aaff9a14e6099660e0d425963ddf1b5fdab80d7680686235777871

    SHA512

    671a93319f2f289c709eb20a626b6c6004407bbcfdba0e9071fab97b63d84c721a37bc4f3ad585666a736f90c9a43cf2b4560ac0a38a5f7008f63a88d6b85533

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4bd35c84d675d44bd0e3266498c2cd6c

    SHA1

    ca782d8ced921820f30126a873da1a8ede1eaf5a

    SHA256

    2f5677cb25cef1de1138e7b3aea5942f96d6db80c02fa3e0b2b27a594793e956

    SHA512

    012bbdeaf4bc9f0ad5d9c67b0ba1a2c803ec8ab21828af1b3917d669c211642fe5e752a4b52b7e6295cd9fc957d84a033f506b6abb626ec93743ea63450c9b26

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e13ed4a341f6a85c8f1fd8231fcab88e

    SHA1

    23c93a5691151128c7c5995ce708c887e9ca3efc

    SHA256

    2e87684ef924c5daa8ab5f8853b4c5358bec42c16e149db49d7b351de8b6e229

    SHA512

    7a8a1f81679d8c9a87058fd871d1d011e76d2ff8bd3e499869d12862fe28e9828cdac8abb21beb16b5709d6afc05c6da4fd3f48eade0ebdc7073f5ae18e99af7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    68a04648b879ded663a0dce7f04f532f

    SHA1

    bd22d0c2b02d5ff64519fdf6dcc13ac7dd9cea90

    SHA256

    dd71e3474db30849ddb20c00c4cbfcdef7a4a418c97c00ed5175efebc20fc4da

    SHA512

    1eaa418176e0692bacc00b1472d1264ed19e93c3ed0112d48f7ddd976172451d02501100b0373bdb0b01586e1532f2c97348378478f105240f041200284a8d0d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1f6616a78f80e204da9e39c30d41cf9d

    SHA1

    6ddf895a9f1341ddab5eb70ffa06adf5f78ec8aa

    SHA256

    38d482c3a8bb7eb8564e73f95672f9894bfd659025565be3fbfdb11170a12ad5

    SHA512

    8a7a9138cf89fccca1a58a9e110c419d25e75590301adfcef27274d49f8bc0ab542fe6089d26c7f837e0845a7a8b2cd595bec310ba3197a074bb9efdc00a9563

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    00cbea9d80c2bca84ecd521af3cd691f

    SHA1

    228dc43f868ee7999108a2537ca2bf76b6dca723

    SHA256

    7cf5d158ee49ea4e39e58a4af791c32522f4c2bfc7a0011ff1483012a47786c7

    SHA512

    429642eae3f929fc74a992f6506bbceecbabad4af1c1603442d395ad2d8d503d8ecb601fcfd8dc7d1a4cb51edab19be2869d8e9fdeb93301a5ce2b031868bbe8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    71e50f8068ef3ab2894e81468d14f5b7

    SHA1

    331e06d168eaec4abe85e6ca3c4ce53e9cf1dd8d

    SHA256

    cd1be9cbe33f3244ecea252ead18eff66bb139d1eef2191d48e2a2763ff448f2

    SHA512

    5125b23e09f77c53d741bd5e26cdc1398026cdd6b5ba451048be9acc49c3dba4b1c8706854e351296c3f950b44c9e817ffc150d4332fcf7a96d64bb757f80bc8

  • C:\Users\Admin\AppData\Local\Temp\CabF96F.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarFA3D.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    88KB

    MD5

    fe76e62c9c90a4bea8f2c464dc867719

    SHA1

    f0935e8b6c22dea5c6e9d4127f5c10363deba541

    SHA256

    5705c47b229c893f67741480ed5e3bce60597b2bb0dd755fb1f499a23888d7d6

    SHA512

    7d6d5bfb10df493ffea7132807be417b5a283d34a1cd49042390b2b927691fd53ecf8eee459c727844395f34e4230b2cd85b38b7fb7df0a3638b244d0c3f6394

  • memory/1880-454-0x0000000000170000-0x0000000000172000-memory.dmp

    Filesize

    8KB

  • memory/1880-11-0x0000000000170000-0x0000000000190000-memory.dmp

    Filesize

    128KB

  • memory/1880-12-0x0000000000170000-0x0000000000190000-memory.dmp

    Filesize

    128KB

  • memory/1880-2-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/1880-3-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/1880-0-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/2112-19-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2112-24-0x000000007742F000-0x0000000077430000-memory.dmp

    Filesize

    4KB

  • memory/2112-21-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2112-14-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2112-15-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2112-16-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2112-17-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2112-18-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/2112-23-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2112-22-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2112-13-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB