Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 18:35

General

  • Target

    $PLUGINSDIR/System.dll

  • Size

    67KB

  • MD5

    bd05feb8825b15dcdd9100d478f04e17

  • SHA1

    a67d82be96a439ce1c5400740da5c528f7f550e0

  • SHA256

    4972cca9555b7e5dcb6feef63605305193835ea63f343df78902bbcd432ba496

  • SHA512

    67f1894c79bbcef4c7fedd91e33ec48617d5d34c2d9ebcd700c935b7fe1b08971d4c68a71d5281abac97e62d6b8c8f318cc6ff15ea210ddcf21ff04a9e5a7f95

  • SSDEEP

    1536:2IfbmtOpUtoqoQvfDrghNT+2w8mbJ1/NfSttVx:bfi4GoqVvbaNXubJ1JI

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2352
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2872
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2828
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 224
        3⤵
        • Program crash
        PID:484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    24b0510cbf2f959da10d450f6f4fb0d0

    SHA1

    dcdca87f7017a04d124d9b64a18abd36cb404b91

    SHA256

    7a05ff159e3c0bf941431ab6413dc520335e0378a1984fb40d290cbb2237c97f

    SHA512

    876a2e6e298cbfe0855b5ade6dca9c9f509250bd98d6890de1594eb309f94c5ec77978ad843cc45d9f0a7baba07fc404ef2fbcfa7c30f5f2aa8fbdd22ef0f6e7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ae4522161cbbf9f60f4a3267713adaa9

    SHA1

    8e6c5173fca7ee52b9c7935c594e6b20f6b53aa0

    SHA256

    41b4cdc6f3764a79ace04724b0e4b7615a3715328943c4f12e6f01b3d95e91ae

    SHA512

    62ac98107b5efa730a261b9b329280ffc12f820b1c28dbc01e6e4f1cdc729a62bf8f3da5f74373e690c6197fae2b937316ee94c91e7d48e8470ebb9f13adb8eb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fd932bab6c9f3298cf9509b4477cc2d2

    SHA1

    19a9e7303ceb7f7c35e239da9eb69409d4efbf4c

    SHA256

    5e2907a3714201957a5b6e2d0f23e74c00ac9689b68145b242634995e62ec152

    SHA512

    c611e09a0bf3a98433892775f2fc9b4459526a8574c9ddc1abbcfb01dbcb713d588d6171883cbaf8ebbf18dbaa9b0361a8afb1384e3c64fbffcea4ccff0c23cb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b918ded028b4d66ff9d4c28d9054eb80

    SHA1

    ca7fae193b104679e8df7cc43bc0daef3f11b228

    SHA256

    20bf313c31918afebbab41ca32ee84b4a38f1dcc6245ab7163e30c51a33a37e8

    SHA512

    f46e0d79dba68a6022a8811a52b122f1a893af0cd9b5b68ea5a970bb267ab18c15c7bd5625abc566926a506d18d85b0b46dfc922070c756bdee36ae88f926a3d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a959dcb8cf3b56f0c73fcc914d05bd33

    SHA1

    7c422bbc1074af606fcb59b3df483a80b63f84b4

    SHA256

    77f58560e967a02f27067a1cffe6b69680eddca8776bd40d5bb558a1e63add9a

    SHA512

    7ba986aeaf96855793dd21d1605777780647f1d8020f8b1a5904d1a2184d406f120494f4a7f189693b3a8837c1cca892e19fdefedf9a5f89695d92d12ab88b60

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2e689a21684925afff9d7df49d46f048

    SHA1

    bc6c957d9a747f58fed1a0efefd4f9c163b5bcd8

    SHA256

    6d7ac3119984e5fbb31e9f7e8087fa2d39e8d541a58caa635b88e2ee809c8228

    SHA512

    180f300a9aad65a1085ad831449496e2d8781f3d0635e591c2c48c05970368d37fada61f4bdf4bf66ae9681bd586496c02962ba27bbb9985cef7acbc87bcfa0a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1ed75385c994fcec99a627f482b9133f

    SHA1

    87d534ecbae7cc6a5ed6347d76282f249b29994b

    SHA256

    c6c0a6673dbb5ae0b765f0ddb953a3b38f735e71df3ad73ca5462c8e31095283

    SHA512

    823f5cb39e6e4fce60465c8625084d4cadd21bb987430bc13740953ccf44ded0bcf892690d2fc9c5ebb3198f2522e2c1d368281c6cb9af18b11fafd7d400a76f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    57ce81b6bc68a6b66e1a797fb60b1c24

    SHA1

    df28bf6123322ccfc685f43ffb21ffa52e389328

    SHA256

    e4aa2e9954cda0e3ef4363c17da39bb7908e78419ee0750af8dcb37fa90b7db7

    SHA512

    e88e62d91fa71c20a758cf0a8ffd9f5fd03cb3bbea3bfba4b68146f80c1ba220339f21e59f7fd3d4a88fa38fa6f7151666dfaa59d7e851e7715560444cd099fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cd1214c9e82a5cb01f330f8db0d73382

    SHA1

    4db6c51fed99d3fe0eb609750bbd7f2e6797b0ea

    SHA256

    8c7812cbeb163496752e1e1c2405bdbdd5ec3bf6788c8837f95a7bfacfb9ff4c

    SHA512

    f23f0877bd77fa7bb638af6c7990fc9f8b3226cc3ccdcb5e7ec663fd5e5fdcf2f0296e8c73eb2dea0902ba9daf190500f0eb94f5cd438ab2f5e129635ce2effa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1732dc9279d1dadc06a1dfdbf14cc6bf

    SHA1

    10bb0db17fbabbfb1efecafa3fba7906eb86a620

    SHA256

    9b1b6e6031be86c55215eba914dba213804de98bb82badde03aa68cb5ba93769

    SHA512

    5b39d52955b2abd5379bcc40e75bd0c668f8bee04ab6d778122a40d8ca327c3d9ea8c81e916751177922eedcd48aa6fc3076fad0f941b3081628149e2461fbd4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    39d59511d87ba8100a7928f93f121676

    SHA1

    1466dc1258abdf61338f9117a6c2a8a4dc5f7e79

    SHA256

    0b7c493e9844e6884b413f0dc85383c8ea653330dc29d20f546c4161879d35c4

    SHA512

    b7c8fa0ffc2e43ed701438be8c6fb230ea77b671f294c20848654a02b730500cd982e245bc5a3b35474b60dc936948a4a1c5b4a049c4ba7b773a5e38dac249ad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c2282bd5f29eead609ff1d05e3fc3d28

    SHA1

    9e525137372d714bf262d8a5e0a6654a66097182

    SHA256

    b431ec2aeb830e4ab07bb908b29b5fac1f03ab34a19ea305952080619fb76da4

    SHA512

    519fad419f12e3e4e9a8b65f85f29c4b3c244678abfc2c9bbd06525c84ea5c39089a7a51204329b4d61568fbde643a2b4c7298b075ae38403bafddd4704d2bac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c6f6916f786f9daffc3c4b675b2e7940

    SHA1

    56ffb7489494b6f04427ed47a49adf26492d1c8b

    SHA256

    4a905967c49dc15864a6f41a9416048a9edb683456db1672d726f2a653ffb55d

    SHA512

    3d795f27809d3dcc6b9a12e9b710f40a3fd2df60ee59505a2eb06826595f6e36a6c51bddef62e04fca0c280fac81d7848ed826f8af1fc9e513651e89896a0c5a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e184dff1313f2cc45129f443e000e76c

    SHA1

    e2633bf4f7976b345bc5730cfe84188542c55251

    SHA256

    75aa1153041c5adc0337285c8f041cba0dc02e53f85535465eef85d3d7c66d64

    SHA512

    2ac5d8af7fde348df275aed32c6092bee60278edad1024ffdb5b6d37acd982fd031be16282a643eb701104f966ea08dd69947cd93017f3ffeeac80b629a87b57

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f8060b3ade19e5fdd3c8311a8fb206d9

    SHA1

    6d405a0edda3e0385d9079e39264f76306a8b176

    SHA256

    aea721c833f9e7ea16bf267013e07be6176f107cc263f8ea548ef1bacdf7cf97

    SHA512

    92c88fd60c69952ba02b488f155c73d2d60e4444e5e11b4cf42adcd37a2e4e38c8fe27f2fe7724d2b72798ee20f40083e11570aac0c9b0826a58b3c63033b5bf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a5939d7dda19d5066c3c75f9835cc744

    SHA1

    e0f39fa88c8fb76ea693f741ca66c0f2e226c7a5

    SHA256

    2975542669e3abf6cb5db078840d5e237f855c8cff1d3aa4d3fb29c8a4c8a1b6

    SHA512

    54c12f0a9415ba8bbcd2b1596173a8d59efbbae5c65373fae97edcfa0b40ab41f8ed40aee189222807fc087927ddabfd189e885211da9db3705c59c702b86fae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2d940957ce9e063a865d221dcb8af000

    SHA1

    bd63ed9e7269dc4f1240ad162ec77f75d23a6a54

    SHA256

    dec915559d7d76e0a029e4d2358e959074ad6ba93e0db014ed83e969d425adbc

    SHA512

    5f14778b4dfbc608fd880e53ea482b1bbd14cc9eebfebb1624065af09187ca0fde2a10c757d653fd47edaed42ad7664cf6f0d8b54d20531543e459be26e99bac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6d12fe84ca4112e37cbc7f9e1a3f6b3c

    SHA1

    35447dcbc258a4983a9791adc658ab4b58737845

    SHA256

    29867619f70758c2556533d2a4091a2ef2cb86427008fb32be33766e8e78d9e0

    SHA512

    654671ce94ef04bff99133190736e2ffcbfa60929e519ddfeb6334c049488ea32344da309e6db7fad992cc2eb8f919cd28283a54c4ea798a2409edae083b31bd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e1183f9a07eda4dcf3394cbd1c223ddf

    SHA1

    49797e0a59443e4e62f2e16e7da74183a45ac77e

    SHA256

    77a6f969d8f2d5143249c03dc262772bf9b445f55e5b5d0e3ecc75bc8807d005

    SHA512

    1e27e771c42d98320577499ebdb8a5cf9e661abf611f5e3fb435718f03f3138fed060a6c41e9a6958b0808a1a69d477721ce79fb88a62bae659b488e6bc1cc1e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    04d030da1608f18a2f0dde62ff358fba

    SHA1

    58254dd569d1b8bf68b906937c0ae9dddfc5e2c5

    SHA256

    c15b4cfb469014662f7a7edd2747c6861ddfc47a07a7dfd9d983b93cea2cbaff

    SHA512

    b22b9706503835913e0d39b948f6fd0774e1501542a00e3195ea1dd41730660da05387d57f2e2e7d764001fbc4377080935b6c523186b94d2ada55e1aead57de

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ba8659283c29585ad304ec63e51e82ff

    SHA1

    1bfa11924c4a5a4ee0015d670ec466e4d8102fc5

    SHA256

    78ef77253f06ee08fd4103279ba11aaa37899ec6b25d9276377f373822cf293b

    SHA512

    48765cf565ac98028c01b0f130b1d05cddbfa2f9663a70f8c49b70c8b873aae5ac3f93a4df032961c742937c4f25c7122d4cecf450d4714b68fd9d6034912c8e

  • C:\Users\Admin\AppData\Local\Temp\CabFBEF.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarFC9D.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/2336-10-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2336-7-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2336-8-0x0000000000230000-0x000000000023F000-memory.dmp

    Filesize

    60KB

  • memory/2336-16-0x00000000002E0000-0x000000000030E000-memory.dmp

    Filesize

    184KB

  • memory/2352-25-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2352-18-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2352-20-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2352-23-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2352-21-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2868-5-0x0000000000130000-0x000000000015E000-memory.dmp

    Filesize

    184KB

  • memory/2868-1-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB

  • memory/2868-22-0x0000000010000000-0x0000000010015000-memory.dmp

    Filesize

    84KB