Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
75s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/01/2025, 19:50
Static task
static1
Behavioral task
behavioral1
Sample
586f70c01d659e169a5ba71289db61dec251af98749491a917e3922cfaa162f0.dll
Resource
win7-20240903-en
General
-
Target
586f70c01d659e169a5ba71289db61dec251af98749491a917e3922cfaa162f0.dll
-
Size
205KB
-
MD5
815489afafac56f981e4f35e7d2f0c92
-
SHA1
a66e91aa537cc9cdfb1bb7da0c1776e5168eab71
-
SHA256
586f70c01d659e169a5ba71289db61dec251af98749491a917e3922cfaa162f0
-
SHA512
5985d8a6d70054ae3e16f88a8f375c093f36b17206c980eb1c33308583c6c361b522adb4f9489b07fd9cdf6b5477e8d3a08169fdf0847daf2ce751510792faee
-
SSDEEP
3072:SgB3oFE5a27z3EAS1uvY8XDxr3gNO0QO8rH/PyLpiuwRTzDZX:l1X33Eov9XDJgNAfqqRh
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2760 rundll32mgr.exe -
Loads dropped DLL 2 IoCs
pid Process 2400 rundll32.exe 2400 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral1/files/0x0003000000012000-6.dat upx behavioral1/memory/2760-12-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2760-19-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2760-18-0x0000000000400000-0x0000000000464000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe -
Suspicious behavior: MapViewOfSection 25 IoCs
pid Process 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe 2760 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2760 rundll32mgr.exe Token: SeDebugPrivilege 2760 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2400 2680 rundll32.exe 30 PID 2680 wrote to memory of 2400 2680 rundll32.exe 30 PID 2680 wrote to memory of 2400 2680 rundll32.exe 30 PID 2680 wrote to memory of 2400 2680 rundll32.exe 30 PID 2680 wrote to memory of 2400 2680 rundll32.exe 30 PID 2680 wrote to memory of 2400 2680 rundll32.exe 30 PID 2680 wrote to memory of 2400 2680 rundll32.exe 30 PID 2400 wrote to memory of 2760 2400 rundll32.exe 31 PID 2400 wrote to memory of 2760 2400 rundll32.exe 31 PID 2400 wrote to memory of 2760 2400 rundll32.exe 31 PID 2400 wrote to memory of 2760 2400 rundll32.exe 31 PID 2760 wrote to memory of 380 2760 rundll32mgr.exe 3 PID 2760 wrote to memory of 380 2760 rundll32mgr.exe 3 PID 2760 wrote to memory of 380 2760 rundll32mgr.exe 3 PID 2760 wrote to memory of 380 2760 rundll32mgr.exe 3 PID 2760 wrote to memory of 380 2760 rundll32mgr.exe 3 PID 2760 wrote to memory of 380 2760 rundll32mgr.exe 3 PID 2760 wrote to memory of 380 2760 rundll32mgr.exe 3 PID 2760 wrote to memory of 396 2760 rundll32mgr.exe 4 PID 2760 wrote to memory of 396 2760 rundll32mgr.exe 4 PID 2760 wrote to memory of 396 2760 rundll32mgr.exe 4 PID 2760 wrote to memory of 396 2760 rundll32mgr.exe 4 PID 2760 wrote to memory of 396 2760 rundll32mgr.exe 4 PID 2760 wrote to memory of 396 2760 rundll32mgr.exe 4 PID 2760 wrote to memory of 396 2760 rundll32mgr.exe 4 PID 2760 wrote to memory of 432 2760 rundll32mgr.exe 5 PID 2760 wrote to memory of 432 2760 rundll32mgr.exe 5 PID 2760 wrote to memory of 432 2760 rundll32mgr.exe 5 PID 2760 wrote to memory of 432 2760 rundll32mgr.exe 5 PID 2760 wrote to memory of 432 2760 rundll32mgr.exe 5 PID 2760 wrote to memory of 432 2760 rundll32mgr.exe 5 PID 2760 wrote to memory of 432 2760 rundll32mgr.exe 5 PID 2760 wrote to memory of 480 2760 rundll32mgr.exe 6 PID 2760 wrote to memory of 480 2760 rundll32mgr.exe 6 PID 2760 wrote to memory of 480 2760 rundll32mgr.exe 6 PID 2760 wrote to memory of 480 2760 rundll32mgr.exe 6 PID 2760 wrote to memory of 480 2760 rundll32mgr.exe 6 PID 2760 wrote to memory of 480 2760 rundll32mgr.exe 6 PID 2760 wrote to memory of 480 2760 rundll32mgr.exe 6 PID 2760 wrote to memory of 488 2760 rundll32mgr.exe 7 PID 2760 wrote to memory of 488 2760 rundll32mgr.exe 7 PID 2760 wrote to memory of 488 2760 rundll32mgr.exe 7 PID 2760 wrote to memory of 488 2760 rundll32mgr.exe 7 PID 2760 wrote to memory of 488 2760 rundll32mgr.exe 7 PID 2760 wrote to memory of 488 2760 rundll32mgr.exe 7 PID 2760 wrote to memory of 488 2760 rundll32mgr.exe 7 PID 2760 wrote to memory of 496 2760 rundll32mgr.exe 8 PID 2760 wrote to memory of 496 2760 rundll32mgr.exe 8 PID 2760 wrote to memory of 496 2760 rundll32mgr.exe 8 PID 2760 wrote to memory of 496 2760 rundll32mgr.exe 8 PID 2760 wrote to memory of 496 2760 rundll32mgr.exe 8 PID 2760 wrote to memory of 496 2760 rundll32mgr.exe 8 PID 2760 wrote to memory of 496 2760 rundll32mgr.exe 8 PID 2760 wrote to memory of 588 2760 rundll32mgr.exe 9 PID 2760 wrote to memory of 588 2760 rundll32mgr.exe 9 PID 2760 wrote to memory of 588 2760 rundll32mgr.exe 9 PID 2760 wrote to memory of 588 2760 rundll32mgr.exe 9 PID 2760 wrote to memory of 588 2760 rundll32mgr.exe 9 PID 2760 wrote to memory of 588 2760 rundll32mgr.exe 9 PID 2760 wrote to memory of 588 2760 rundll32mgr.exe 9 PID 2760 wrote to memory of 668 2760 rundll32mgr.exe 10 PID 2760 wrote to memory of 668 2760 rundll32mgr.exe 10 PID 2760 wrote to memory of 668 2760 rundll32mgr.exe 10 PID 2760 wrote to memory of 668 2760 rundll32mgr.exe 10
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:588
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:836
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1688
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:668
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:736
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1172
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:848
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:960
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:108
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:348
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1032
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1120
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1520
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1928
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2844
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\586f70c01d659e169a5ba71289db61dec251af98749491a917e3922cfaa162f0.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\586f70c01d659e169a5ba71289db61dec251af98749491a917e3922cfaa162f0.dll,#13⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159KB
MD58703c6aeb2e62da71e50db9698d91e35
SHA1cafceda794c5b1976b46a5d39949137aba8dc9e6
SHA256c3a332de99e2b195bbb3e5927f8ee4217f968bc373f8c499db45db0b3388d47d
SHA51248e45868929fcacfa06c5078de2e54d32cfab80e5dd00036b37f3d55b33269f0ee82f46b68e7a6adc2ec9aecad8672393a77602c1b995133876c2c4e6d15229a