Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    85s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2024, 19:25

General

  • Target

    6db87102d00ab090b552675b0a6a46d51f83d214d1a52ab27db392bb6208edf0N.dll

  • Size

    439KB

  • MD5

    afca455fdde4658e22c9bbbb75c124f0

  • SHA1

    3bb347d1f42ba804c920ef5e43f226eddb8796a6

  • SHA256

    6db87102d00ab090b552675b0a6a46d51f83d214d1a52ab27db392bb6208edf0

  • SHA512

    48c67bfaf755b4fcd36ff89ef55bbdc61e289e0da8a0f5330e825e1ef0dbb12ef5c5d03c65f62c79992b90cbf1427114cd7a72126326e6622fca00f04150acac

  • SSDEEP

    6144:yOp8HpzdQOStK+XsAWxnuTNo3+wO90oi8T:yOp8Hpz7+XsBJ+SXO9g8T

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 12 IoCs
  • Drops file in System32 directory 4 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of UnmapMainImage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:332
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:380
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:476
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:592
                  • C:\Windows\system32\wbem\wmiprvse.exe
                    C:\Windows\system32\wbem\wmiprvse.exe
                    4⤵
                      PID:1712
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                      4⤵
                        PID:400
                      • C:\Windows\system32\wbem\wmiprvse.exe
                        C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                        4⤵
                          PID:948
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k RPCSS
                        3⤵
                          PID:672
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                          3⤵
                            PID:760
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                            3⤵
                              PID:808
                              • C:\Windows\system32\Dwm.exe
                                "C:\Windows\system32\Dwm.exe"
                                4⤵
                                  PID:1176
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs
                                3⤵
                                  PID:852
                                  • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                                    wmiadap.exe /F /T /R
                                    4⤵
                                      PID:2164
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService
                                    3⤵
                                      PID:968
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k NetworkService
                                      3⤵
                                        PID:284
                                      • C:\Windows\System32\spoolsv.exe
                                        C:\Windows\System32\spoolsv.exe
                                        3⤵
                                          PID:348
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                          3⤵
                                            PID:1072
                                          • C:\Windows\system32\taskhost.exe
                                            "taskhost.exe"
                                            3⤵
                                              PID:1108
                                            • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                              "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                              3⤵
                                                PID:1500
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                                3⤵
                                                  PID:2960
                                                • C:\Windows\system32\sppsvc.exe
                                                  C:\Windows\system32\sppsvc.exe
                                                  3⤵
                                                    PID:2396
                                                • C:\Windows\system32\lsass.exe
                                                  C:\Windows\system32\lsass.exe
                                                  2⤵
                                                    PID:492
                                                  • C:\Windows\system32\lsm.exe
                                                    C:\Windows\system32\lsm.exe
                                                    2⤵
                                                      PID:500
                                                  • C:\Windows\system32\csrss.exe
                                                    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                    1⤵
                                                      PID:396
                                                    • C:\Windows\system32\winlogon.exe
                                                      winlogon.exe
                                                      1⤵
                                                        PID:432
                                                      • C:\Windows\Explorer.EXE
                                                        C:\Windows\Explorer.EXE
                                                        1⤵
                                                          PID:1200
                                                          • C:\Windows\system32\rundll32.exe
                                                            rundll32.exe C:\Users\Admin\AppData\Local\Temp\6db87102d00ab090b552675b0a6a46d51f83d214d1a52ab27db392bb6208edf0N.dll,#1
                                                            2⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2028
                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                              rundll32.exe C:\Users\Admin\AppData\Local\Temp\6db87102d00ab090b552675b0a6a46d51f83d214d1a52ab27db392bb6208edf0N.dll,#1
                                                              3⤵
                                                              • Loads dropped DLL
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1448
                                                              • C:\Windows\SysWOW64\rundll32mgr.exe
                                                                C:\Windows\SysWOW64\rundll32mgr.exe
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Drops file in System32 directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of UnmapMainImage
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1728
                                                                • C:\Windows\SysWOW64\rundll32mgrmgr.exe
                                                                  C:\Windows\SysWOW64\rundll32mgrmgr.exe
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of UnmapMainImage
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3060
                                                                  • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                                                    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of UnmapMainImage
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2788
                                                                    • C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
                                                                      "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of UnmapMainImage
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2716
                                                                      • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                                                        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                                                                        8⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of UnmapMainImage
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3000
                                                                        • C:\Windows\SysWOW64\svchost.exe
                                                                          C:\Windows\system32\svchost.exe
                                                                          9⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:824
                                                                        • C:\Windows\SysWOW64\svchost.exe
                                                                          C:\Windows\system32\svchost.exe
                                                                          9⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1908
                                                                    • C:\Windows\SysWOW64\svchost.exe
                                                                      C:\Windows\system32\svchost.exe
                                                                      7⤵
                                                                      • Modifies WinLogon for persistence
                                                                      • Drops file in System32 directory
                                                                      • Drops file in Program Files directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1312
                                                                    • C:\Windows\SysWOW64\svchost.exe
                                                                      C:\Windows\system32\svchost.exe
                                                                      7⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2392
                                                                • C:\Program Files (x86)\Microsoft\WaterMark.exe
                                                                  "C:\Program Files (x86)\Microsoft\WaterMark.exe"
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of UnmapMainImage
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2940
                                                                  • C:\Windows\SysWOW64\svchost.exe
                                                                    C:\Windows\system32\svchost.exe
                                                                    6⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:860
                                                                  • C:\Windows\SysWOW64\svchost.exe
                                                                    C:\Windows\system32\svchost.exe
                                                                    6⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2116

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

                                                          Filesize

                                                          692KB

                                                          MD5

                                                          68f5a696dc1835441a18f1b2325e12b4

                                                          SHA1

                                                          0f4a88221f9b1f2ad67361de27af3bd674ce49b2

                                                          SHA256

                                                          2a99904be6c0a33bf4be120ef18f8696cacad9e784e7fdd6c84bc61c0e981bf5

                                                          SHA512

                                                          086d7e946d5ccc5ad8768d1ded5344540d82446b18c64ce979a483b7552c48b20f9cface9cfa715ee6073b837b8ee3e36fae262910b5dc4c2f7ea0ef4df05e61

                                                        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

                                                          Filesize

                                                          689KB

                                                          MD5

                                                          618f639800fe5d9ffe05d0d467df54f3

                                                          SHA1

                                                          db323fde4f2115eed4b0fb6738478bdab152d73d

                                                          SHA256

                                                          881041f450a405de0a48b84e9f42051213092b4701cb73028f958ca5a844a5aa

                                                          SHA512

                                                          30ea34672cf44a71999a7790f8581c1baf6d6f678210a5e4bb8f7292b4b4bf75ffdfed6772f209418f36f4484bf756edb57dd19791451bef9f30a1fc621776af

                                                        • \Windows\SysWOW64\rundll32mgr.exe

                                                          Filesize

                                                          339KB

                                                          MD5

                                                          7385f723cdfd6a19523b29e19fe63e39

                                                          SHA1

                                                          6eb6694a76aab6587eb45575f380cc7a80c66bc5

                                                          SHA256

                                                          a50f5786e2dd07cfbc89f72484e3af5dcccc31d476713bd7b433c6f74ebc4e37

                                                          SHA512

                                                          858c17a06aec78976775cd9df4f2652cfb97e35c14aa863e88f27cd332c6b6ecdb0c062d0cfdb53436981b50ba4681ebe04d00128df8be67398d021aa6d83632

                                                        • \Windows\SysWOW64\rundll32mgrmgr.exe

                                                          Filesize

                                                          168KB

                                                          MD5

                                                          0943b815c588255874985439061ba474

                                                          SHA1

                                                          31ad4cdb76003b35f553cb96c78d887e7c960eba

                                                          SHA256

                                                          7b1559c2f8d511f7be152a22809b358088048fc3e00d9963b92ad0ecb384bf51

                                                          SHA512

                                                          fce7596624b5c224cbaaae55c4b224ff995eea33ed0ca9d40c33cfb5ffaa98f387f267175788f5431ca7209c2c69ef1024b9541f7b53a1a3c6412b09a19bd601

                                                        • memory/860-107-0x0000000020010000-0x0000000020022000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/860-109-0x0000000000080000-0x0000000000081000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1312-150-0x0000000000090000-0x0000000000091000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1312-148-0x00000000000A0000-0x00000000000A1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1312-149-0x0000000000080000-0x0000000000081000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1448-2-0x0000000007000000-0x0000000007070000-memory.dmp

                                                          Filesize

                                                          448KB

                                                        • memory/1448-3-0x0000000007000000-0x0000000007070000-memory.dmp

                                                          Filesize

                                                          448KB

                                                        • memory/1448-11-0x0000000000400000-0x0000000000464000-memory.dmp

                                                          Filesize

                                                          400KB

                                                        • memory/1448-0-0x0000000007000000-0x0000000007070000-memory.dmp

                                                          Filesize

                                                          448KB

                                                        • memory/1728-33-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/1728-34-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/1728-16-0x0000000000120000-0x0000000000159000-memory.dmp

                                                          Filesize

                                                          228KB

                                                        • memory/1728-13-0x0000000000400000-0x0000000000464000-memory.dmp

                                                          Filesize

                                                          400KB

                                                        • memory/1728-36-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2716-89-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2788-901-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2788-151-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2788-56-0x0000000000400000-0x0000000000464000-memory.dmp

                                                          Filesize

                                                          400KB

                                                        • memory/2788-68-0x0000000000120000-0x0000000000159000-memory.dmp

                                                          Filesize

                                                          228KB

                                                        • memory/2788-67-0x0000000000120000-0x0000000000159000-memory.dmp

                                                          Filesize

                                                          228KB

                                                        • memory/2788-101-0x000000007755F000-0x0000000077560000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2788-99-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2788-100-0x00000000001A0000-0x00000000001A1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2940-77-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/2940-102-0x0000000000050000-0x0000000000051000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2940-70-0x0000000000400000-0x0000000000464000-memory.dmp

                                                          Filesize

                                                          400KB

                                                        • memory/2940-898-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/3000-160-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/3000-105-0x00000000000F0000-0x00000000000F1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/3000-95-0x0000000000400000-0x0000000000464000-memory.dmp

                                                          Filesize

                                                          400KB

                                                        • memory/3000-904-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/3060-26-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/3060-25-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/3060-24-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/3060-23-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/3060-51-0x00000000001A0000-0x0000000000204000-memory.dmp

                                                          Filesize

                                                          400KB

                                                        • memory/3060-41-0x0000000000400000-0x0000000000421000-memory.dmp

                                                          Filesize

                                                          132KB

                                                        • memory/3060-31-0x0000000000140000-0x0000000000141000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/3060-22-0x0000000000400000-0x0000000000439000-memory.dmp

                                                          Filesize

                                                          228KB