Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    68s
  • max time network
    70s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 09:23

General

  • Target

    5eb5f7b19bd13bf6fa6f0ff969f9d5c9dbdcd8988bba8bb829f9813c2dcb14ab.dll

  • Size

    232KB

  • MD5

    ce8fd08c0e26a1299ef9d74267e4c171

  • SHA1

    7f26c06759ff9e52f3453e423665d9abf62c389c

  • SHA256

    5eb5f7b19bd13bf6fa6f0ff969f9d5c9dbdcd8988bba8bb829f9813c2dcb14ab

  • SHA512

    fa294a33bac6d6f699e857a2b9b1228034da5654c0e98f559ae62dcf65b3acdfec200e96631c47083dc779ece702430be134fae952b5e671ae833803587d1118

  • SSDEEP

    3072:x/U9HG4s/LSPqWHx34+jSc39XtxZSiSq8uv3LlsAEQiw0p9dJ6f:xOmzSPqWHB4+uy91S1uv3h5riPbdJc

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\5eb5f7b19bd13bf6fa6f0ff969f9d5c9dbdcd8988bba8bb829f9813c2dcb14ab.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\5eb5f7b19bd13bf6fa6f0ff969f9d5c9dbdcd8988bba8bb829f9813c2dcb14ab.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2744
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2596
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ea1fe12f80f045ff5fea1dbde19825fe

    SHA1

    96218f59bbd34c1588ec108fd5f13e598a43bcdb

    SHA256

    82712f198c794ef4414596b2c69a2dedbde56b4dcb04fe2bc511d564b210773b

    SHA512

    0d5632589f0b205bc8c1c2f0c7985d698f9e197e779ae81e6edb07c37bdc9094f0de2b4a61d9aa5b3878ea32f9300c075dd69c4dc14499ccac3130a32772027c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ff72e0937a62df5bf51a65f72b78e33e

    SHA1

    b5396b5c2e81bed0bfbf4fdf1e0b36f7316ad210

    SHA256

    55d8898a9190c41e38e557cd57e08572cf6b48cf93d79154369d3e4d21048340

    SHA512

    1abde0ba72f9bfe90d168ba9d83bfd2e903cd2e092277cbc29792374a0e1ba44df54ab98adfe1402ed2e64b93e5c10391f54c804be577a5bac806624fbefa41b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2cdcbd6c1d6dbcab6d0009149a254d7e

    SHA1

    242a5fc136957898a3c4bd11b9c4db61f3b92ec2

    SHA256

    13944a6b6e283ab5ff7c4ffec1bfe96064abf68e3850a67b713e1c0d765af2e9

    SHA512

    0906755fd1932295880b17bb98fd3e3a6562f4bc7b0380b694095e490ab55434abfc5fa65926f919bc52fa22baf90a6e12331513a1e64e40611bdcd623512d47

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e514e7e64d9ab56b013e53d77719c383

    SHA1

    d50cc2b58a042ae4261a6c9ec5f2d7499605b957

    SHA256

    b80decfa5b09961ecf8915cc82186431be56a8df6cfa77233065342af74c4696

    SHA512

    09525065b5663743d90d31e231afa73de50c2e7bfa9e56acf1794eed3068eb82338e028385adfc82d79ac0fa8c38024f4b96d445c4eca216af010a5de34433bd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f88b901e913275790228b8c96ec83908

    SHA1

    f80047df9bd3c4d1932fa5180d4717dcb326cb10

    SHA256

    c71eced79019fbcb103312005ae91c1c64c0e382347b97da725a8c959af63417

    SHA512

    15fe904dc9622d7eed128d0f6b84ae9ae104350daac5235a6c5b6ef9ed8d3822fbe05df37d5b077aa64c23765bce9c3242a93879a8589adb120ac7ce62730498

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5f067c301f9d5768b234b733635d1e7b

    SHA1

    5551e2ba8254ef2e6bade4f872f11e145fbd454c

    SHA256

    fb9cbacd862ad46328a55f31be1ffc0e9a8b65fe44ae1fd5b418620a20aaecea

    SHA512

    d7c3906209579099cc0c55da4073b536a25d5151d61c2577442457d5738f5573802fd6848577f5f2ae10e990648ed2b7fcda78d4b07d7328bfbb683ec6b72151

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fac57a579b9b3594bdad1bd44aff5569

    SHA1

    1b13c2b612f2fae9c00dd8f556ee82da24e8af3f

    SHA256

    13344bba1dddc4367ceeef538698522759c89ab97fbdd58cc83b58820736df60

    SHA512

    08f9bad421c25d025f4fe0b4bdbefdb4193bc6c505d180ffccbabd720823cf06973ab972c77adeb8ef69dfdbda0c4d1c10cdc9d8008bf3322332359f903774b8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    78398f30db42431a3fe8bda3d746dd7f

    SHA1

    e5344dda3a5909551761e539ea06bf3e686c16d5

    SHA256

    cd629e94f2e1d43555b270d5af87d116aa0e23d52ae1993ab053b18f4104b9cb

    SHA512

    fcc096cbcfe51391cc1c3d747ef396c24256ad78f45afe62e1eca97c760b158b2e9612e0e31c1973f95cbed5f223bce05ce004e28bc9415e22b32eed241996be

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    021076c61753698d10571420a2b29153

    SHA1

    0e770ea89fb131e51bb31363515ee79ead9d1720

    SHA256

    5c8eb272c33a68b1a5ab268602a77f01011f54cf94c8aff2bb4c2f3306ce6452

    SHA512

    d5ca3f695493bbc89fabbc3b6d1dd6153ce615b8852b0172780149a7e26dd9c8f1e26d0bb48eb3fc6198599dca060fb06f19fb2bbef5304a7fb4911d4a31d2e4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9bf4733e0c50584208c93c0941e953e0

    SHA1

    bea92bb2cbec40a22c8cee0654644e610243f262

    SHA256

    70c841e29362d35cd171264968f2d247bd900c63ce82d9e55e1cf765183b7904

    SHA512

    d9ed6f3f1065ec3501874aa52c5cf4b90e69a2d8fbff29aa1745304dee26e5c45b5fc69ac95153e07e8f1de7758c7e7c6bcbdf762f5c63f1383dd4d1f8fef528

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3ee935291e95bac60e0940e009fe1a70

    SHA1

    00c8fd07575ba4d60d7803f6150100a0a31750ca

    SHA256

    c4e79fb881f458ba24ca336c430c13e1dd1955b43e8d753dbb96a21b176719ff

    SHA512

    a3c8ea1b6a853dadf7db2bd3544da7690a939b7dcd2c1aa0d9399cc3df4aa38777beb60aaaf976d8566908cee7714d8064adda4aa56c48b22bd7f6ce09e653c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    addf460cd8992ebeaf1808ccfea265b6

    SHA1

    5caffe5a1b197d7f2ee0297d7cbbf0c211dfc9f7

    SHA256

    26075661d57ce924fad3e843fa1c329518aa7eb679391cb20e1190605d8389c6

    SHA512

    a552d6e8390e16a69b537976f275453122ee624ade23048bef80e80e2ab9b01adabea10273ebf89074029c62493f720fe954eb9f37f7c53109f28eb9926bf2f8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5727024246e12bb71f397fbcd93da5ce

    SHA1

    45161eade5a49bcba864718b8dfb5fb9fd83811c

    SHA256

    e9d821437f616b5b78c82d2c0572ca134b475cc51fda08c48e6ae7de51de9ddd

    SHA512

    91c51dad9c5d13167fa3f267ed1fcc8ff4c79aae64ad126b27840532a0f6139bd02f0651e57a6c314ec1d31b0e71717d5df28f07045e4c712c9ce5e0d299ff7a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4125e015c13ad47bc606f88c7112ad55

    SHA1

    2ccac012ee6e59d55ecdb9588c3955ba09e0d3ce

    SHA256

    0d31b2410f9b8e1bd2df06247ae688895feea66589cffc2e0a798663c05c3bf6

    SHA512

    c81d6a8b64d449287fce85052fa33ad1666bd3b32435cba7e556e622a8f095ba6b9097ea80fd1dedb52a95467f755d7989e854e02cc6e8d7d068f04d41ea0107

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1f890e41755f19072c35172808d57cd9

    SHA1

    79206d18fbe8b6b17f3239a491f0e5a4c7fccab0

    SHA256

    4f9d84b2c067fccef143ddba696b665597d6b7629546c5d74259a50f1958fb97

    SHA512

    5b8163574b4d9b40c84ed6cdbf9b10ff25b83f9c7b72f367656364ed9943deb5c496d4118ea8b575d69ae579d46e46e85252112687a9f8e4d1a8399579f84b50

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    997d31f4eb98e48ba2638fe1fb97b41e

    SHA1

    d08b73be95c6de984fa3996cb6169654ed1fbcba

    SHA256

    f20e9926d14d305809c113059d100bf90712bc80dd1fb65f99ef6155bd1fa418

    SHA512

    98106adf84365e89c7e2113cf1b273ec7448e5d839542a5de6f26fa1bc8339929b7944278d1a62302fbfcecbd1ba45d966c2b19095e3379559642fc84ad0ab13

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    454f2e22b5ac0b5db67edfca842c5732

    SHA1

    667ba1a68d6a417a71309300020a6b70e55f24ec

    SHA256

    468fcb51a7af5c0d55d4b60c5f736f4c59ca65fd4e2a8157b23e4d8310ea9a4f

    SHA512

    12592d326d86e01bec7f88c58def8920e1c9be0f7d64af9b6a530834bd475889c8a5b92f1aa966698c1897c7587b8026c614e52090ef79117c49bdc8ebbe2eeb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    66917fab54946c221496de49438b9f50

    SHA1

    634df9d1e26b8a7ad9a63c0a6b40f3bbcdff8f73

    SHA256

    b2246c975f30c4dca5314346ded9edcf0b0eacb96af4e6baf76a9b825289953c

    SHA512

    8a04c3691fcbdeb4c269f072453bc1f9f2fca6054670ccb182b8663b51d0c4f27392ef16d93141fc1c13379fdba5f9f799055da9844014ebb2208afb33948e5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d9eb10fb71a5622d9a6db8e6d6ccd476

    SHA1

    ecc4153a12e83113c09c645a9433a90958ebbd75

    SHA256

    933ce9d606e1397c536e17aa7e887a945d1f413e7607804a28d9963f34c15974

    SHA512

    b98f3a66d9daa4e18b4c5ed4eee258ee965d9d942fe797ecdf06cd0bc5f4b6635598d3a93a06b20af42473e572af922c48b54bc95b1d1e8be512fea8d268eda1

  • C:\Users\Admin\AppData\Local\Temp\CabD5B.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarE0B.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/2732-3-0x0000000010000000-0x000000001003B000-memory.dmp

    Filesize

    236KB

  • memory/2732-6-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2732-1-0x0000000010000000-0x000000001003B000-memory.dmp

    Filesize

    236KB

  • memory/2732-8-0x0000000010000000-0x000000001003B000-memory.dmp

    Filesize

    236KB

  • memory/2740-11-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2740-10-0x00000000001C0000-0x00000000001CF000-memory.dmp

    Filesize

    60KB

  • memory/2744-19-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2744-21-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB