Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2025, 22:52

General

  • Target

    359e71cde7060cfb520ffbb4a1830768ba9661253ed6044a1e2123d5c8e48cd6.dll

  • Size

    528KB

  • MD5

    4507297f5c5ad6c447ae15afd59b5ae7

  • SHA1

    3df549fa8b8aee5a787d1a6c609ea355875aa965

  • SHA256

    359e71cde7060cfb520ffbb4a1830768ba9661253ed6044a1e2123d5c8e48cd6

  • SHA512

    1a8f9348a1234f3a303aa29fe633217a59248f94c7bf1bd0196507a792fffd928d1deba141c9c6cf0b05b46ffa452a152459d176ffa24ddd9419030d2ca9a0f1

  • SSDEEP

    6144:ZOrGe84PbAEPuRrTw/hsjQTDs40VK13v/UgliPjvjqE9oXnB94YQwx5XSboondwS:BKJPuRnwT/3C8k1vv9oRS1wnXedww/X

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\359e71cde7060cfb520ffbb4a1830768ba9661253ed6044a1e2123d5c8e48cd6.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\359e71cde7060cfb520ffbb4a1830768ba9661253ed6044a1e2123d5c8e48cd6.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2496
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2264
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2964
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 224
        3⤵
        • Program crash
        PID:1492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    78a0a0325d19112b285456ce0c913ab0

    SHA1

    44f9f76b48945c9f135645073ae5dedb0c786049

    SHA256

    df57be3dbe45d6284a8727f0dc8ebc4177f3d72fb56ad7de7401ff79985445c5

    SHA512

    11a805f8a146bbafbff4ef9a8f685ff672bbcea8d984a1a44e6fe27bc6f91ee4ea7673564ffa0d7ace0be1494d0151222790d1cfe535e13fe5a8ce4c2cbd950e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    43be1394f241601236374de7130b79de

    SHA1

    b5dc33afedc0941cfa47d3b75c0274357faaa73c

    SHA256

    79aed5645e8135876bd778b8f66fbe2f2dc191fd0b946d493c95dbf84ca2b2b9

    SHA512

    927dc37f4bf78cb1f43ec1213b80e185bc73cb730172c8142eb2784946d5f19f82d557eb0ea952c3551557b9ae4d00218e1a98b67c6a45b9777db3e279ebf778

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c52e3cf701010f36435f45b3e0b0d158

    SHA1

    17d66fa2c0caca1384cf17ac28b01c4e9ce79311

    SHA256

    a70a4392d638c55a8386a078a5e4a414c6ff09dfbcb67e8440af26b34a082014

    SHA512

    1ad57b3f2e90c63b9f1cbd6745c77ff68a3e96e39fb85407511c1308b093cc441248d8ea304264f34466e946a4f2ff56f6c18d45a874d0029b59161ca01dc53f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0700bb4e9e6b293b6df99e1ad201b83a

    SHA1

    1c9fa0bf012f150fa2dcefbaa60992e838dbf13f

    SHA256

    1f9e0f6e09877379c245de4d653b19447d38d70dfe96e93ce40fea552f5c73a4

    SHA512

    8373b44d9c8fea0a84e726f21ef20a56929b7a561dfdf06cd0fbb3e74ea812a9d3c8c575a94bc311ce892586a5c54c7cd186273ee4c757a3b2a0317d162b99b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8de84a4d6cb55c2aa5126f0d78df9858

    SHA1

    fb6a5f60a11eb84ee44dcfe093497d1e2f882227

    SHA256

    d981322d0adb4306a9bb2cf5fd8bfce681800abd7f28a028c92e7609501d4ad3

    SHA512

    3c1c765b79814f99a355206b18fc0a0722902bf83705ea65500b269928d9326ddc16d8e28319a4112661d09adfd778bc7d19fc928cebab2f1ad11881621d27cf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    39ea2920dc14eec3d6a1f898681afaad

    SHA1

    c4afe2a735d893dddf66a74b4968e18cd8c94b48

    SHA256

    6f7eb85420d9a31c125065aedb76b4c4b3aecacd907dea207854f8f889ff42f4

    SHA512

    50e94d10884d7aa2b597ed2e797f88ec589fee8e4ec835e871fad3eb9b237a0d0fbcc8732ad6a26b527ed3d17390ae1a3cfe5894d8b29436573d55aeef07b98c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ef2f92a238e9926bf99e4fee56e996f9

    SHA1

    e92864527db038f7396c86df7c0023e62d57c56b

    SHA256

    9cce709ac82a4bcebb954940acabbce0d943dadfc7217ac035f8da2f793c7c15

    SHA512

    5cc849f233475c905f908db2f93aacfcdfc806bdd165af9d47f1e96cf2296a5099b2fb9e2492844e9ea39320bbc4e57434cf858b911de5ccc9e3d6ef5526aeef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9dde36cc62b45e152f54c23043275220

    SHA1

    ca0b316834ffbfed54c79ca8f09d999765c6ede3

    SHA256

    9c7ff02c5f831808bbe009a7a590482b82b4956afb6bfd35a2303368fed9482b

    SHA512

    b32f2b87ba89ac52163a26da03f346c6f391ee86366e1abbb5625fc566fc63f30f79df90723c12ebe1dbfaeb8d225887666e2ab3519094d8219b4765b37da69a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    311f6a246aa1926443de9977e9e1718e

    SHA1

    d3a1768f140c44b7001ddf5e385604805b3949d2

    SHA256

    507a42322db7f3db30f3ce2dbdcc1dc27e8e643e8405247e21a732128683ef0c

    SHA512

    c6ddb8f6267519c0c652996157d652405862ff80111e248c6638443a37fd6932b20d54ab3a959c5ba18adad214fb670ed11b5fb39df3bb3c4aa4a7e1e5d42d81

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    23ec97b537d0d8a3657bbd3d098751fd

    SHA1

    8fdf19d7dab53c7d2fe284cf7148b1414e6b8c8c

    SHA256

    e0ced640ae2f04712be48d6f26dd4dcc0b1965819797047f285997049f188934

    SHA512

    5b6a1ac51097f6cb9fc9c19b8877696883af7a755e31fd7929d408fc9e6e5438307b104637e3310ed029e55c625661dfd8bed410546185f11bb2da861078c79b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ed64f3d4cf20a85268edbb2c6d8a87de

    SHA1

    3f3b589e45afb1a102483b463f5c5bccf004e17f

    SHA256

    6c3cc688b2708e77b9b20e499c697d987756488946c97de3463c17c632d19eea

    SHA512

    e8a6265281bec0654e172aa325931cbdff0a8cebefd3d03522042dee725d5a19810148d2812265674b79750488ef023f46b35726b1f3877cf751b75825488ee6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fe09e560921219b363a6f9848903c67e

    SHA1

    2abd8a57cb5c2a0fb8d3dfe06370c7e6de875d22

    SHA256

    47a4acc29297647ccdc5b0a782126b86dbe572a22d35d6dc387e5ed9b01764d5

    SHA512

    e798870f245a5af13ef590d1717f23c6cf4668fd21a5c0a8233f47ee2a8bc468bd68860ebb24198ddb079c16028be568679aef08423c8a226430325b15c8d869

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b2b7da04dd0bc244b449d50a7d044983

    SHA1

    ced4af248e3b2f8bb1cc51d503fc85ce044c25ff

    SHA256

    fb71520f7fba6ffc29278b50fd410ebba7ce5c6cc4609090b09af25ae99a7ce4

    SHA512

    0934fa22e187d0afef3369b014809aa01d0039ecdc512ed06c1ca0f15f298788afd8a63ab6e46ccdde0cf210bcc0604c0c390a6b4699fc9e73fb0c6cb24e6ac9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fd7344ab1d3567e419b767d767ca89ce

    SHA1

    fbe2d32c9f0bf9409f6da62a91d9721d70a85c76

    SHA256

    7e965a32fc6ecc5ca8866aa0af5adc71f6163f882ff519e9ca94134993e49273

    SHA512

    487043507f1c4914f78d5a45e7596776c21bfd5f1c6a135ce82a52608f3905012404218564452432d7bf4fc6ff18ed072ea07401fa7e80e57c2b838b71ad8aed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d9965d97437ac6a0fa9ee88b6c762738

    SHA1

    eff420f1e36441c5f2846cb5d010b6ffb0fea7b1

    SHA256

    c063a350fa91af612526e8ca663c820ee11ad89537a8f4b32bdf236778ace4b7

    SHA512

    8c655ea20e7ae1abe602e4b0d605d1f15917602822b264dd1df7390bb5ef5092e270261f90f4bb722005e8c1f034b549639dad8af6dcf35672864495ad20d1a8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5cc589893733a42cb32085a4bbb780f5

    SHA1

    9506139f05a051d0f2d4041b31d8ddc1b9531599

    SHA256

    7a85ec60be9a02b64b0942dcfe998e298bde86bab59d1d077d4a68504ecad93c

    SHA512

    109d371de186bd9a3350d44e1c13ed79cc8b0d15393b0ca8b8268131ebc0d4d26d3802a52c8b6a11a5d68971a0cdf3a971d5fb5c6c54e92624f273278c26680b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e659951922dfa5d920c289effce54225

    SHA1

    c31309ba1414524334fecde9b8ff5904e0ccb805

    SHA256

    3c8224898d1796439730facb6a86afa6c3657b83cf7c7cf8f3865ac38e84fb98

    SHA512

    5b8acae7f60a2c74d63f243dc1c86c2d8b7def06f7df04b1cd5e12d6a7e64bafb50ecf3c9a093893eff2bbf9a254433c12e0068426df7b55eb4854d4204bce5d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    91a6775d861179ba4e8c8a617d5a7cef

    SHA1

    2d79c36b2e00347a98dab77a6a2df00ba67b3054

    SHA256

    15e9a74d6ec767dd0c87ffb85408bfa0016680388fe368c7bbc875a8d08ee436

    SHA512

    8cd701362fb38b540638a71d5b0810e47e7c4fc97d3c6aaa0ac30520ebfe2bf15a68d900fddb0937f27b1d7ecbf71d6f7567bfe71bd783f79ccd06e3e90d9d66

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9ef61faba3cbd96d7f8cc05612f4464d

    SHA1

    98a7a831e6ec2e9952960c331c93698317921867

    SHA256

    4c143d660eaa181840be4c317f3115d2d22d8c62246a1ad582e8616a1228979a

    SHA512

    b7a8de5ec5078fdc46079841879cefd2122edf5d609f11db02efb1127f5335ac77bbe223f8d96b93f7dac897ef822fcc2f41eceaa2138f28ce18d754b8febaa1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    28b4135aafceb6ea4262ef960d18e7f3

    SHA1

    da1e9de536cd67d451dee6fd78a72a703221d52e

    SHA256

    b2e3793244762ffdef1cf6295562ff4a8a737ead4ff76d4d62822f0a08ade286

    SHA512

    77276bcdbd972ee4be2f3125c69851600d509aaf3597fc3abd419344cc80476029a0abc501d8992ce6ba0972362af9edf04dce5a4bc7025442d9210b99b55f2a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4b056677f76c06b6c2449674f6ffb19c

    SHA1

    c09c8b1911b80772131735aa5cdc52584f087f54

    SHA256

    1170af675f5ac3ca3aac84ff65bb6430a4bcea08a10e0832bc4b686e68160fc6

    SHA512

    4a21f3823bb458caf4efdedc30c9b09ec8a6efd4b505e0076e04dbf95d5943a8900384321eb1af9c0f57355acd987157571ed33ac12d9f8600d54f02defbd5f8

  • C:\Users\Admin\AppData\Local\Temp\CabD404.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarD4A3.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/1728-11-0x0000000000230000-0x000000000023F000-memory.dmp

    Filesize

    60KB

  • memory/1728-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1728-13-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2148-1-0x00000000749F0000-0x0000000074A78000-memory.dmp

    Filesize

    544KB

  • memory/2148-6-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2148-2-0x0000000074960000-0x00000000749E8000-memory.dmp

    Filesize

    544KB

  • memory/2148-3-0x00000000749F0000-0x0000000074A78000-memory.dmp

    Filesize

    544KB

  • memory/2148-24-0x0000000074960000-0x00000000749E8000-memory.dmp

    Filesize

    544KB

  • memory/2496-20-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2496-23-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2496-21-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB