Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/01/2025, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
5e5e0ed014f836749b4652ca7de765340b5e122f22fff1a982604500b0223454N.dll
Resource
win7-20240903-en
General
-
Target
5e5e0ed014f836749b4652ca7de765340b5e122f22fff1a982604500b0223454N.dll
-
Size
216KB
-
MD5
e35b79f86c57b2927f5f906eb35ec3c0
-
SHA1
50a5e5355d4dfbd3f8d77ce301b0f240c406f13f
-
SHA256
5e5e0ed014f836749b4652ca7de765340b5e122f22fff1a982604500b0223454
-
SHA512
5a3e184f9197ecedc19403c7001308908473252bc68268bd3a5550b87d72f88c59514ea0624ab28072490b8739969c8972e254228bf3c5808ef679702a36acc2
-
SSDEEP
3072:dn2PxxtNKMQLBvBt0M1qCWzJP0ruTTBaClHpspom7ffrAmpe:lbHLBf0dJ5TTBZbspom7bXw
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2916 rundll32mgr.exe -
Loads dropped DLL 2 IoCs
pid Process 1948 rundll32.exe 1948 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral1/files/0x0009000000012117-9.dat upx behavioral1/memory/2916-18-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2916-20-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2916-12-0x0000000000400000-0x0000000000464000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe -
Suspicious behavior: MapViewOfSection 25 IoCs
pid Process 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe 2916 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2916 rundll32mgr.exe Token: SeDebugPrivilege 2916 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1960 wrote to memory of 1948 1960 rundll32.exe 30 PID 1948 wrote to memory of 2916 1948 rundll32.exe 31 PID 1948 wrote to memory of 2916 1948 rundll32.exe 31 PID 1948 wrote to memory of 2916 1948 rundll32.exe 31 PID 1948 wrote to memory of 2916 1948 rundll32.exe 31 PID 2916 wrote to memory of 384 2916 rundll32mgr.exe 3 PID 2916 wrote to memory of 384 2916 rundll32mgr.exe 3 PID 2916 wrote to memory of 384 2916 rundll32mgr.exe 3 PID 2916 wrote to memory of 384 2916 rundll32mgr.exe 3 PID 2916 wrote to memory of 384 2916 rundll32mgr.exe 3 PID 2916 wrote to memory of 384 2916 rundll32mgr.exe 3 PID 2916 wrote to memory of 384 2916 rundll32mgr.exe 3 PID 2916 wrote to memory of 392 2916 rundll32mgr.exe 4 PID 2916 wrote to memory of 392 2916 rundll32mgr.exe 4 PID 2916 wrote to memory of 392 2916 rundll32mgr.exe 4 PID 2916 wrote to memory of 392 2916 rundll32mgr.exe 4 PID 2916 wrote to memory of 392 2916 rundll32mgr.exe 4 PID 2916 wrote to memory of 392 2916 rundll32mgr.exe 4 PID 2916 wrote to memory of 392 2916 rundll32mgr.exe 4 PID 2916 wrote to memory of 432 2916 rundll32mgr.exe 5 PID 2916 wrote to memory of 432 2916 rundll32mgr.exe 5 PID 2916 wrote to memory of 432 2916 rundll32mgr.exe 5 PID 2916 wrote to memory of 432 2916 rundll32mgr.exe 5 PID 2916 wrote to memory of 432 2916 rundll32mgr.exe 5 PID 2916 wrote to memory of 432 2916 rundll32mgr.exe 5 PID 2916 wrote to memory of 432 2916 rundll32mgr.exe 5 PID 2916 wrote to memory of 476 2916 rundll32mgr.exe 6 PID 2916 wrote to memory of 476 2916 rundll32mgr.exe 6 PID 2916 wrote to memory of 476 2916 rundll32mgr.exe 6 PID 2916 wrote to memory of 476 2916 rundll32mgr.exe 6 PID 2916 wrote to memory of 476 2916 rundll32mgr.exe 6 PID 2916 wrote to memory of 476 2916 rundll32mgr.exe 6 PID 2916 wrote to memory of 476 2916 rundll32mgr.exe 6 PID 2916 wrote to memory of 492 2916 rundll32mgr.exe 7 PID 2916 wrote to memory of 492 2916 rundll32mgr.exe 7 PID 2916 wrote to memory of 492 2916 rundll32mgr.exe 7 PID 2916 wrote to memory of 492 2916 rundll32mgr.exe 7 PID 2916 wrote to memory of 492 2916 rundll32mgr.exe 7 PID 2916 wrote to memory of 492 2916 rundll32mgr.exe 7 PID 2916 wrote to memory of 492 2916 rundll32mgr.exe 7 PID 2916 wrote to memory of 500 2916 rundll32mgr.exe 8 PID 2916 wrote to memory of 500 2916 rundll32mgr.exe 8 PID 2916 wrote to memory of 500 2916 rundll32mgr.exe 8 PID 2916 wrote to memory of 500 2916 rundll32mgr.exe 8 PID 2916 wrote to memory of 500 2916 rundll32mgr.exe 8 PID 2916 wrote to memory of 500 2916 rundll32mgr.exe 8 PID 2916 wrote to memory of 500 2916 rundll32mgr.exe 8 PID 2916 wrote to memory of 596 2916 rundll32mgr.exe 9 PID 2916 wrote to memory of 596 2916 rundll32mgr.exe 9 PID 2916 wrote to memory of 596 2916 rundll32mgr.exe 9 PID 2916 wrote to memory of 596 2916 rundll32mgr.exe 9 PID 2916 wrote to memory of 596 2916 rundll32mgr.exe 9 PID 2916 wrote to memory of 596 2916 rundll32mgr.exe 9 PID 2916 wrote to memory of 596 2916 rundll32mgr.exe 9 PID 2916 wrote to memory of 668 2916 rundll32mgr.exe 10 PID 2916 wrote to memory of 668 2916 rundll32mgr.exe 10 PID 2916 wrote to memory of 668 2916 rundll32mgr.exe 10 PID 2916 wrote to memory of 668 2916 rundll32mgr.exe 10
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1996
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1580
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:668
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:748
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:820
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1044
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:852
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:284
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1068
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1076
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1156
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1384
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1788
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2076
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1128
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e5e0ed014f836749b4652ca7de765340b5e122f22fff1a982604500b0223454N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e5e0ed014f836749b4652ca7de765340b5e122f22fff1a982604500b0223454N.dll,#13⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159KB
MD58703c6aeb2e62da71e50db9698d91e35
SHA1cafceda794c5b1976b46a5d39949137aba8dc9e6
SHA256c3a332de99e2b195bbb3e5927f8ee4217f968bc373f8c499db45db0b3388d47d
SHA51248e45868929fcacfa06c5078de2e54d32cfab80e5dd00036b37f3d55b33269f0ee82f46b68e7a6adc2ec9aecad8672393a77602c1b995133876c2c4e6d15229a