Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    67s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23/01/2025, 05:09

General

  • Target

    f8cad76a653837a541e26bfb3ce14b38c21e9218a09cf7154385027b2af0ae7eN.dll

  • Size

    496KB

  • MD5

    adcb3e216c87862db28252eef8504930

  • SHA1

    3df8b7c553a07b69263aade2259c44fe2fe647e9

  • SHA256

    f8cad76a653837a541e26bfb3ce14b38c21e9218a09cf7154385027b2af0ae7e

  • SHA512

    2a6c091e9e39afb674c8af9d9da597a3fe0f5b40434030a09e959e1a9057e82bd6f919082c443dfe7fdde1130fc0ede4e13c17fe9d9ffb187844a4b2d197d3e2

  • SSDEEP

    12288:5ehnaNPpSVZmNxRCwnwm3W3OHIIf5xSkzCoIgIv:5eh0PpS6NxNnwYeOHXrRJIn

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8cad76a653837a541e26bfb3ce14b38c21e9218a09cf7154385027b2af0ae7eN.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8cad76a653837a541e26bfb3ce14b38c21e9218a09cf7154385027b2af0ae7eN.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2796
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2700
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3036
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 224
        3⤵
        • Program crash
        PID:2444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    364d4b5e37579b84f4cff2f3ffb517b0

    SHA1

    e072edc4bc04b704734ab8b62808112044c0fc14

    SHA256

    cf7e09c9639bd214ab955fc635d8344d528f116ce2ec3570d7101e7ce6115b21

    SHA512

    bc4135e9b7a0e55b93e8405a02092ac1c0c3debba2146155c4a0c2b38ddbbe720d9703aeca963ac72a07face90dd777affb480e37806760efcde923c10de6975

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    eb9bd168143709477d919ec0f7da1d2a

    SHA1

    3c74cb3a4b2bc7c307efe99db49830e0681b4f62

    SHA256

    218810ad46548ea366a5e8e0f2e34ef8b1923d040898812025288a7e3dcc2f87

    SHA512

    28a028ab3a495d142d8282090e2727794e1069e0d95e97d6bd60700ef7f63583d30757e24648b7d5b0f66d35840b8bcd4b18e05868c342ccd12e337ecf89ae19

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    54213b2dbbf1908ebc37b5baee5a3aff

    SHA1

    073ec00307bba9bb1fe0fa69bb36a0e1794b65d8

    SHA256

    a4da82de7e3a9c068e2070e3ff8ac20f2988a27c091ada4584f7567f1608e58b

    SHA512

    0bbdfc623255c70eab98a7c71316c40450da218d38073d6f9dd57ec38919cddea071f4105db41224c5a3a9eff9868b505476c9fd0f1c970807c6cd77e76aa5e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    391c3b7688cf0b7d4a34452850fdd1a2

    SHA1

    53b0bad167a481d798f7e3a3d5b9d6c8cb0286e2

    SHA256

    63692827061dc52267bf240e5387cca61604ff4f15c896c0f7bdd2e2d1214fb6

    SHA512

    e3572b199026310491a6d0081cbd3641281f230751db272dbf7c5cf374089bb27b797a756f52a9bec729bf6946e85b67fbfe67bcedc943519f5a8542909b96ea

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    06b6ad24c6413505acf8f48b0188a3d8

    SHA1

    7f82570245ecf1dd65c6cade275265d23ce129f1

    SHA256

    17318ede5365ee416f67cbcb071a36683114c6fe40786865f4eb670570e98727

    SHA512

    817bb9e0546eb56d991bd73ad48744704d9e11e64cecff7f9adf7b9df5b4d140049973ce7c789ff2e80f1d5a9fc059e3d25a3d69fc3a041edfe23a5eabe289e7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b01af4f63037395628d3e9dcc8f9de5e

    SHA1

    4cab1dace095ad612990452fb684b482e4264bf3

    SHA256

    d5a9a3bf5e7f121b813773b8632c1be8b027730c36ac7af0500d989b117b7321

    SHA512

    65a3d7395857834fd0ae251dacfb911804e941de0263443bc0b3bd412cedd5d153c906ab29cb73ccd2b2f07cd9736f50c10f53c7da446241d7b51b461c203142

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    49a02688a41a7d7e65d46c359c37af7f

    SHA1

    0d5b4f38a35695f667a2a578f320144df132ba29

    SHA256

    01c6deaf4b11d7e0a8ebc84b2a27bcae6ad41553a35261940d885413cc16c20d

    SHA512

    61fff9612b5106a409a75b860c47638ae37f57824c67a624a7ca2cf116e0871677490590226cd8dc7da9e242511c946bd8a2ba5e7bb8d059dcef22ebed242eae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8c2de7af2d29deead81a09adf3e3a375

    SHA1

    d07019833d75ecb2147852836c75ecee272d4a45

    SHA256

    b23e01efcd59605cf9e90ad00ec1e06109bb183dcdb23b8576cfa7ffb66f3a48

    SHA512

    6badd6e9af788b8cda854b81fef97970136045286621b4d330820a374cf7dcdecd213a2eeb6fd3db87e8e067ab8bccd8a8b577d4bdbbc5e93d0f4529a9307b5d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d3caaf36d264595f4a8c9191f0cdfeac

    SHA1

    74ad53fdb42cf61406442472325b66e72bd9e26d

    SHA256

    6c2028ab50a0526c0323a12bc56f027ddfe561cfa8cd25a27566f8cee11d33b1

    SHA512

    6015bb80901bf18b2597e7e087fcb532be3a42ac849bf035ffaca759eae4cbc3debab185017837a9d3138c0d79b94d48c3cbf3ca5bfb7de07428027213d45b57

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f4c503bde1c3266144f115f3934ab29e

    SHA1

    83562b3330c74902b215249b732799bc71e8cbd3

    SHA256

    3dd8fb585d3b4706760f68b5069d28f19a3b20784960d2ff2bf4ba8d67c79efe

    SHA512

    d11ffe6118568046ede1d6f65ff7a00a19e56b3eaa3276d794a8c570f6fab7ea818bbcd7569979f3918bc2b160fdf9c220f702cad89be91180152525641e4130

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    141dc923185e15c2cced28b2d74377d1

    SHA1

    db2c02b1376454c7c063655a477e86c7caf1615a

    SHA256

    c1c798ca7c6c82d8620534a618be03e3a8e9b87e2001c3191b4beafc37a23e0d

    SHA512

    5282849c2478ee7b0d56f3983944b892d50ee8cf92dc3d4831bf59019362d46cad1a29829642b686abe7b4f53fb30601bc04c0d1dd28f2bb9e4bdd4701424837

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    418aee115b46cb7f1842a9638e7a847a

    SHA1

    42f8384c1b75ea4e7e53a9bda7220ef4f584ac40

    SHA256

    e80c89d30b538ffe0dbd7a1b713833c56d68ecd722276c5bddad73ad29852314

    SHA512

    b6f32e24f22d66bb664cd795a1d65faa6dbb7429cd6895ad150140a5b261347a2de036d9b5ab34a95f289bffd11cf972c625fe9d5b3289300653cff565458304

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6aec9fa2fcc4b49c1d293f3b920cdc58

    SHA1

    08bf5ed8a26c79b10e93eec68c03faa3a7a2d34b

    SHA256

    694046aa92aa376eb7258ff1af90ca1affc79239517a7b0b4aa492234568456c

    SHA512

    06746463e0b8dc5d3a5d89aa18788c90a3a65893fb80e819dbec427135c8bcc6f061dabaf26b8dd5778fdfbf8011a39d14dca8940744c3d5082214854cd9c09f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1e92659d6543576ba6d2c26d2692ab26

    SHA1

    d7ec10c1bab130916161033ea95e6c71d9499cc9

    SHA256

    e2f341726ab436c07b7cb09838b5b63a8302b37016f416007bda69a46927e67b

    SHA512

    73b6f8de020c74bb54131a1befe724971c05ab15a79103a1d6f49d9092a67cd9a0fffe13ce5c7067e002625a900a6668c8bbf118b49a1282356a69727f883a8e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6c70911eba3ee73b01fd0bda72a234e8

    SHA1

    a8ca79a58a6cf732d359e1279a8e770b126ea74e

    SHA256

    f614c82a1690796a5e3469f493de273aa444b990a0f87fa3f69cef4226fc05d9

    SHA512

    3c6cccd1bcb47dc7cccbe617e70b541ce417a35c20a22a6589df188dc77234443e5675c5fdc65f76c8fc535ec8d17d78beff432e69e06e35e9eba0c4b37fe782

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2333d08058cf2b50eda78671c5e632cf

    SHA1

    ff24a8f4baf7a15bbc9a8802b05cdf026e754776

    SHA256

    4ac836e6970336e401fd9d8e53aaaefb91080679918f9201f182a19baef074f1

    SHA512

    cf7700f6b9bcb1a6c95d567c8ca7f4a6443a8d6fe8eabb9cc20aea66deff27b05001674ee2232a75d559d6705eacc88cb1ced17b229afe16a1925007229f1b91

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0c697dc87ce8c9b2a814cb0aed4a34a7

    SHA1

    bf7a06febb30d3d114bae67fbf18e43806a93fdd

    SHA256

    d784f402f78bdf032bc76837a853d2c15ce4db153dc92e009f2d26c61513b5cf

    SHA512

    9dc77bf3060b17c8a9ec1568c22663452ab18866e324256b48958035c4f5af0943ee516e3e021892b73dd630cf440bc2da20e40a45bf5faf6e58c6f6de639d28

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    82dd5baaff083450cac15a4f858eeaec

    SHA1

    ca9afb18165aa76981f2fe908e9b777d03cc3588

    SHA256

    d72c4aa801d80397610286f68aaf3b3dd2f7885986dd6696262063fc8c06ea5d

    SHA512

    432dd62f87ca9f4d3bbe918107d5bfe1db1d288b0e1ea71bbce958a69bf813231543d4e3ea7fce4c248768c4f606683d0bef0a61360e2c4194a9dea422485013

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    853d5410b14fccab4db6a6cf9d2f90e6

    SHA1

    f13249fe246fef2eca4eb17975efc6a4453eb54f

    SHA256

    409f25ea7cb6c0dd4303c0bb0129807f16b162aa6acbbba6cce370660bdf72ba

    SHA512

    15d2e4f689afe36fb0478b1887ecaac34af9f7746f7853af82a3dd2cb8a49abe225dbcda0ae2858ea5d06690bc9da2e6af35e7fc8320508261d70047ac0e08fa

  • C:\Users\Admin\AppData\Local\Temp\Cab8AB4.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar8B26.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32Srv.exe

    Filesize

    111KB

    MD5

    9f179e646fb978a30b2aa0885e78c50f

    SHA1

    48314dd692a9494c44a90c6a4586775e9fee613e

    SHA256

    f3838d7a76e03d0488392389e8b9ba12e020dd765d9396ec584e546ad989a9b9

    SHA512

    eec10d1b634d9615902814616f89cfa7af31b575e84ec27db90a5f5376b186559ea2ec7faadd9ba95568ee90a7ef37d1363247828716fb4ae5fc25cfe88be10b

  • memory/2700-18-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2700-22-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2700-24-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2700-21-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2700-20-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2724-8-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2724-1-0x0000000010000000-0x000000001007E000-memory.dmp

    Filesize

    504KB

  • memory/2724-6-0x0000000010000000-0x000000001007E000-memory.dmp

    Filesize

    504KB

  • memory/2796-15-0x0000000000240000-0x000000000026E000-memory.dmp

    Filesize

    184KB

  • memory/2796-10-0x0000000000230000-0x000000000023F000-memory.dmp

    Filesize

    60KB

  • memory/2796-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB