Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2024, 16:23

General

  • Target

    1809ee420b94efc3e58366dc5663396e1a90dbb3750ff4bf7219abdbb0e12ce5N.dll

  • Size

    148KB

  • MD5

    db437ccf4d10f3cdcad132fe0b023370

  • SHA1

    6a553bea7c08fbf461d45f94c9d5c80235f1d726

  • SHA256

    1809ee420b94efc3e58366dc5663396e1a90dbb3750ff4bf7219abdbb0e12ce5

  • SHA512

    460f145ca83371aba9d57a9aa5c93814add1fa1d5cac8b114cc358616ac3a7a466f3a9075795108374e8904e31cf96de04f4754a521f3aa40b55fa4ec660a919

  • SSDEEP

    3072:+Bbqirt+ZEM7VmKeZ88Dkj7oR2SqwKJXtf5DGyVBQwIY6X4O:F5cvZNDkYR2SqwK/AyVBQ9RIO

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1809ee420b94efc3e58366dc5663396e1a90dbb3750ff4bf7219abdbb0e12ce5N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\1809ee420b94efc3e58366dc5663396e1a90dbb3750ff4bf7219abdbb0e12ce5N.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2228
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:2656
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2800
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1e064b5feadba36e6b1fb3dc09555f18

    SHA1

    72c1159f5b7b88556eacf56e5db7b1cbb87225c9

    SHA256

    36e47a9fc29fd31b7531743bd9af112db17d3b13947fe5bf028d485ab8b8acca

    SHA512

    80b472b882ae3a09c04af7c3cb78554892d136210a057e5108752f059e77fac51772e0aef37f9ee9dd38a7a27489216211b0ba9ac9b4c9e5f3bdc0e75d53a7da

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8a2c2e96e2212c377b3c6c14e8b1e1fe

    SHA1

    d3dfa5bae23c1478e7b3305fc3018b612190cda5

    SHA256

    38a9495f93908791a0b22d153ecb2ba904399a47c99f2e8dc9cb0bf3ef273f22

    SHA512

    1b8ab6ba82998aee8bddeef2a7ba48811dd67ddf768af2066194d76772b11e2aea5dd8bdb712cb6f0507dd9f60c041a892224da5ed52243e3493861efee607e4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    681a2723919ad00c1adeccd51bd13e52

    SHA1

    f1b02b7fa93b29b330318292305a4d32d2ca800b

    SHA256

    01fe5dbe82cfb8720388fb819df50ff09f38edd22370f78cd95c3acb3d04a786

    SHA512

    0d6452f22d6c5df2f3b8c3185533d4e5694b24e1ea577306598a28b9410fd90ef86432c7cecf246accf7b11c3238937ec1b0033b47b08bdec5a58070687227b6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    47386cdbef2158951b5a3534d3943bbd

    SHA1

    5d0af93e87f5f1c0a475bb6d231908c8585c88b2

    SHA256

    def90b4826eca80381464eba22982f20d37b9937afb7d7dcae65ec3b3ac3f8f6

    SHA512

    38d80c44768e8f9dc00394ed34cc36f60320900429b48a660648b126403c59a3a81ea6e9808989e2f61b3640931b3c6b7d7721c6a7a1f24f6292cb29e5468fa7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    63d68870bfca82a0fe776973cea8aa49

    SHA1

    6fd420df667a2a93819e4277cff9fc937b05b3b1

    SHA256

    5e07e6e4652de6cb112b6759167d3cad619ed1b3d7b064f1c42b119fa2af19f6

    SHA512

    48d93dc09f930451aea92e72854ec66a0b0f764d4bf4c99aba3974bb1082230577425d329c4dabf623a3ec4a5ced401dc22114160d10c7ec86e70b3b5fa26e83

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7ded989d7edecd497fa27df00b7893c1

    SHA1

    485b54769e870ff5a042c6a7d358209270bb20eb

    SHA256

    f94b66f872f8c551b8405b355513bc6e42b54bf063cfb28902057248024e8639

    SHA512

    ebceaeb47231e659f074a5b0d758a59dbf8f94289a2e89a505d3a6589c297ee0b75b7289d67987dc9b90cbfe654b4a0c855a67b891e5610d0f10acfeb2b2dcb3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e67a75a3fc04bd05615efe274187aa3f

    SHA1

    846fddbe9aac30d449e5f7ed07fff239c65e93c1

    SHA256

    ee1d759c50a0e1755793020050f00ed514bd4e548cd9cf63bd89df431138b077

    SHA512

    422a0faebfa3c905b7fb83d0b970a06192146952b9c621c81b7b29da62797da25510fee663ada61ea333898be6dd6457bf044d32f9581dfba3edb97ea7819c26

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    af08a349acd5162cdc421e71e2d2bb60

    SHA1

    d272351e1821a475133ca8e9904cbdd5c268776e

    SHA256

    f158978e5d45f20b267d510cdcfa3d5135a526d90eb3e31c7256b5fc11722a92

    SHA512

    e845cff8e66b142bf17c60a6308c450cc182da2ba8132dc1aeb2682941051a32541667b8061bf40fa8d2db76861f4b253b2305f8c68c933efc5dfe214e2720b8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b228066612402bff3e4ddc7636fa33d4

    SHA1

    b4ef55d21a0638d990dc0202dc9bbd8a921eb8de

    SHA256

    d70af37133d429bb85f5dda8c85e5dc50f9fc7869e1431d651ae4925c84130ec

    SHA512

    6657c5dafef4b76b8bd89a4ad5ce431ce421c572cbf9b33e82a6009e8e227cf48cc46e442bbe944260a80d3bab1f5a6daeb104dcb1e7d8c19c7459e032c1057c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1fa72598527563d7676549fd00143331

    SHA1

    9a3f562ae68ec7c73becc6c14849336078f315de

    SHA256

    ad8b82a12dd377666681cc86db73d364304756a1977fef62cfcac5be05801b2c

    SHA512

    e9ca329316839ba0a18e0784fa79c1751cad99cd723da9e7e79903ece61295be1f8bd9ed355e46ca181e6dab908f5e97758d7db22575c795782318535f0c2e65

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    867ff14ca417a6f712b226c3e8caa328

    SHA1

    b8bcd5a85fbd5be52c74c1db4fdf71bca28c8738

    SHA256

    eaf2d17e760dbb36c2a1d56a313a73b601cdc6855cd303d07e2b5ef5d4536f0d

    SHA512

    5e836bec279e0da0a90a5cb4d85a9962469bc95fdaba09e4c8630d926b9777d3e5aa313dd176eda9a2e91f59c94b1d4ac63f227a8879a029713621dbf541179c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b91c04bac74b40c476f2559f76356ae9

    SHA1

    bb53a867230ddf287185efa7a409d324564dd39e

    SHA256

    a827809d784575974d63f3f2800f8170d21250e307f6f26e201876344f1a10dd

    SHA512

    e3ec2d18d2f37b68d5b10c332d53f70a256c7cb82ec42d5fa0c43589a299a61244d3cb8e01306161570e9b7b4683beb36804669b930d1e47a0668781c1501919

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    412fa6035b44451481df3c49991e6599

    SHA1

    a826df3c3edc88e7658c37864183e71c23ef84dc

    SHA256

    7bbbf603eb933e50ca230158f3f163b1ac3e7aa70486da1331030d91a430365d

    SHA512

    f863e5f77d245ff8913ce29f69c24f2a59dba0315ce496c662c44e489b2573b47ac52b8b911d3f5e4023498dec56a72f112749e368475340b0242ece09366e94

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    518e20d14ec63bf6a9a51cf660d14c2f

    SHA1

    0e76dab4a88842fc9682f033c5efde054f9ed286

    SHA256

    2effcecef182232fe7b8f49b70c78cb5c833594501de670cc97e2c78a3057e9c

    SHA512

    3b7ab077fd9908a1314b54274c9354e208ba1c0141099a7bb18a3e4e707b5de470326a2a58f228fe0ebf9189024c299a2fcf6d6cb0b1a4f8ee92d3f88789aba6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    58316b3829e09d6643cf884cf07fcf46

    SHA1

    59685ec973d2dd2cfc9f352b52eb32361f8b8cb0

    SHA256

    0f5b31b4f1aaf074d3cc68f4d453d8671e7c46d54539a29fd36141b8269ba4cb

    SHA512

    1602513b78f7601e709cf741734950153d36913f8152c939513ccd016be1e84f430e21af85036760ca242aa4ca980fbb41ab94346c93c475c0579acf94125239

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    08898088b41bba5a787564f6f539a095

    SHA1

    a06e5121840a7c9ab05962cd3af47674096463be

    SHA256

    60462c30a9bc0d5f51ac57c08ac801ee264d57298c790147964db9c14f6d7c55

    SHA512

    1d48b0aedcc94a948460a76514007d53788c39c107ddc3e7f72535dd0326b288399095e83487319571a539d0f251a0f65ffee26f975ea9a2792b9ee6bd910719

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    666c26baffee17d05aa8a4292646ea2f

    SHA1

    596463eb77f9691dfc172eef7848cfb7eabd7535

    SHA256

    23928ed00d3d74e433b1c7b84e5328acef56c06a97cf360881a291252588afeb

    SHA512

    5b44e00f0b2d92836fc9425c70f4944cd251f0e10b7203b9391ed4d380b4af21a6f60f4a1114ac5f30b376da327c268abbb3a3117447f5bae074bf03af2cbff1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    df465874733426ba72ddb9dfba84d1f8

    SHA1

    127e873ec85693b947cf2ae4331042b17ea49eee

    SHA256

    2460cc41172218b6d7b8c26a768f1ea54a480db3390649cef0c50d1263717997

    SHA512

    db2ed67578419c0a5046b295bc22050bff65ebbbd6262c79c9988a3585c5962d3c49e36c7ff033e3acf2ac97800e24483507856f70bbf99063e221cf4e0e64ba

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    98a4f1bdec0b5ee33a5f3099dcfa3c37

    SHA1

    eb8aa3420b7e94619e9f8e85e5b6915c97cbc8a3

    SHA256

    18ef79264728b6c5f0c30218f5c39db6894966e24eaae4379ca9ecfd4f90e577

    SHA512

    10e03b434d1e4ae05ce595a8ed6cb508f9f156d51f1e676b1ed6a141383f05a74c84f91a38e72c7b8f08315b48bd3b144e053195b824b617e7fced4dcee93fb2

  • C:\Users\Admin\AppData\Local\Temp\Cab570.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar5E0.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32mgr.exe

    Filesize

    88KB

    MD5

    fe76e62c9c90a4bea8f2c464dc867719

    SHA1

    f0935e8b6c22dea5c6e9d4127f5c10363deba541

    SHA256

    5705c47b229c893f67741480ed5e3bce60597b2bb0dd755fb1f499a23888d7d6

    SHA512

    7d6d5bfb10df493ffea7132807be417b5a283d34a1cd49042390b2b927691fd53ecf8eee459c727844395f34e4230b2cd85b38b7fb7df0a3638b244d0c3f6394

  • memory/2228-2-0x0000000010000000-0x0000000010026000-memory.dmp

    Filesize

    152KB

  • memory/2228-0-0x0000000010000000-0x0000000010026000-memory.dmp

    Filesize

    152KB

  • memory/2228-5-0x00000000001D0000-0x00000000001F0000-memory.dmp

    Filesize

    128KB

  • memory/2228-11-0x00000000001D0000-0x00000000001F0000-memory.dmp

    Filesize

    128KB

  • memory/2656-23-0x0000000000410000-0x0000000000419000-memory.dmp

    Filesize

    36KB

  • memory/2656-18-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2656-22-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2656-17-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2656-24-0x0000000000401000-0x0000000000410000-memory.dmp

    Filesize

    60KB

  • memory/2656-19-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2656-20-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2656-15-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2656-16-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2656-14-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2656-13-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2656-12-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB