Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    68s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 18:35

General

  • Target

    $PLUGINSDIR/xml.dll

  • Size

    175KB

  • MD5

    0ad70d0ebf9562e53f2fd9518c3b04a3

  • SHA1

    4de4487e4d1e87b782eceb3b74d9510cc28b0c70

  • SHA256

    3bd4a099f0e0eefeaacfdba6c0ab760b6e9250167ba6a30eafaa668ca53ce5e9

  • SHA512

    f75e089f7eb44071f227cd9705b8e44982429f889f93230e98095aac60afc1bdd39a010787235c171cd9fb9ead8023043b147022ab007e8cf1c3204064905719

  • SSDEEP

    3072:vzjLkarn7O+n9z2L6whFtGF42bKgGoqVvbaNXubJ1JI:vzP7n7O7L6K2lqVvWIdjI

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1524
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3000
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2936
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2784
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 224
        3⤵
        • Program crash
        PID:2016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dcaf6c2ae302ed9d8db1e7b50c7cd7b7

    SHA1

    297157f00b1e74dbbb2406f28eb54a1737202b60

    SHA256

    6d290bf0050ab51115d4c3e2bcc9e512bcae32643c116449889e7f3fb4abde23

    SHA512

    7a296c954ac5bfc0f98149225fed72c64270be81ea86ea6e60d199c42fd91356db06d035a8f3577e544046419816cc86c9f497ba560a930319618d3ead0c4629

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fcd079b95da9df11d2a630a7c0d98b01

    SHA1

    9699f844de86a6850a646100a2a1afb7c79624b5

    SHA256

    b6afe30afd75a17868aab5b5ad39cbf913bffa3efbeff3ae14dca3b826a8b2d7

    SHA512

    e33216441844c1359b31cd5e241cfc13165639698b1ba2db6617dd1250dbbb32b61fc25003e5de9d9e10808d86adc040357ba8f79b453c7b42188c896b162091

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    04765f8b5006e0fd53bec112bcc21cb1

    SHA1

    f6b8a2f3600d708494faa3c762f33768b1eb8d90

    SHA256

    7c35f63b2cf71e4ff9013dacb9b17c94ab0c8474b9e66a84a6aee7a45c828b53

    SHA512

    e01cfb68579069e9e1f510bce6c81c804d9303deb457a3a5412853b4e965ea53e7b569833eef509d96046beebea036eadd9206c49713b61d3e89e4e1753300e2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d38be9c41ada819602cb01fb1f32a5b6

    SHA1

    2045a2dc2d64dd276bb01dcb6be5ff15da962367

    SHA256

    8c8a644ad4849d08b44f07796e91a61c17f08f960d10af2fd75b87c5615c78a4

    SHA512

    3cd30b6b043bbd737336e4f635cf6a633e34882aec05b0e3e8f1157eff97b56cd3744882faacc1727f32d4fee7e8a744faa37da743eb15e262b92779c3241e45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    995c5b7366fa1f5a12a74963d23644a6

    SHA1

    284a81b9f6b7ebc5bafd407008fb88d17b25d526

    SHA256

    c4a67b55dac274e0718e0683487d0d993857a8df467c16f7bcd71838b8a9d483

    SHA512

    6541917ac286dbc01567f9fc16be218fc7d6192516e9f0ccfe610d832da1f442a3337f2bf405d15c291fc6e3e69e7987bb28051a1a2cdb6060506ddfb1793639

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1199a790d8a79df56319032b581b6996

    SHA1

    785bb32be62888b76a5b1feeb40403f4f81c95bb

    SHA256

    3c07da87fe8a709d698da75cb9c63d66fa2e4cc405e7ad24c02a9e9489586bfa

    SHA512

    e75f99b6024966bf6d9f0c3d21da99ba2e68674a3f8eebe450b2bcb86c84bd5f2f869a8ff45885d259cbc9d2c1758373e5821d721c93e8f35ac936885daea313

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    30496aa0059fc3b2c0c93fbd1db7b2cb

    SHA1

    f377471724c0d3d4e3cb1210c9623cbece86faf8

    SHA256

    aecaee514099c1c6c51191d54290d4e47c6574b241b8d1f7d31fc95739c50ef2

    SHA512

    43e13f278f0ba719b4f9bd77d9881aef866a749a0ffcc4d419f837695fd0bc890b0b51f1e3a9f7081852b8397a60615c6ec5b47e755b99241efadca50d50fb43

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9b5dca588dac83bca64f4ba9989e760a

    SHA1

    6ffd17dcc5f7482fd016484354a9dcbf7ac0b91d

    SHA256

    9570f002d6dcf21be19ccee7ff974e19b5a08be492d1027c01c43b104a5c48dd

    SHA512

    8a67eed6b368586a462597240b8420a3078428338b6cbcf3dccf806c5debf051dfa3ad5bf8367ad232e1c956dc2c9353670052b2746900d7cc58c94f84067c2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    671d861a50b57e890ddaf773ce245851

    SHA1

    0d7b117f7a7ee5c00b9935aafbfb74e930ddb8fe

    SHA256

    e8bc1011774829a4c114808e604d89ae4caf92f0580d17cde5f94696c6b64669

    SHA512

    f682bbe1557def0695dc051cfcfda6e3a82591b0f8029ba234576ce8f459a95462fca6603525ca7481810d089323479a998f1ae1e70d81955ba7531330a87d28

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a8a48e7360eeff826654da5ae0c278b6

    SHA1

    62dc9890e830bbd6206780064337f3a56e737b71

    SHA256

    7bcabeadb8155179baaca813992dceb15c39656ce6413f18adcf9907c1f9f5f5

    SHA512

    142495725967cb75d89b63f61a9393a7e3a51a6b5cdd202e6ad10e3775f1c2fd0e03d0a2c6433f09eee8b8d430bfd669a75f6794703db8f445b92c7ea4c5b524

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    be1f7bb76bbff3578191125958ed909c

    SHA1

    66175fd1bf4a007cff03895d6c2ef0440b9c26d0

    SHA256

    fe5b4100b06cfd211a380b327e7d9b99084ddf2ee929574adaed7ea57141472a

    SHA512

    01d73b5a9e263931fd6f8e4f1998e45a7934c702ef278aabe976df9ca805e3b0481f08520ce41c494e81e1be40ad98462d860907f8be37c92d23b859e56f94ed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    933b4906006db54661b1842078fa6cb2

    SHA1

    7d131393cd5a5c9931abe5ec9ad1e42c084b2a26

    SHA256

    8b8d579ba4146f702a12d9c75c6eb6d1d38480eb7a1ff0763fa4f4b6ae60ff4c

    SHA512

    85c8fdc2f69e66694d3962cce2c44823cc232dfc4f16021745a5424923a6a65819c469c16c6540b3a86b32afec46a5142c8a771f38f5f2fed23ca16fca73fa01

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9944ac7a48c79369f6f23be052345c60

    SHA1

    c8a079e9d8eed9ecf817b811936f41ef9e49242b

    SHA256

    8773a3c2495e8de32878d3edb81e5783b321ac1e207a3feac7419e73f1a2b370

    SHA512

    542ac796342b24919e7dfebbef8d6a6b2ac3bbc151ff27a8e4e03f493a46f5c1f815550ec16c17868b29b37b3b210bcf892aec4df440ea82e8f972e7a57a0fc9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9775dc95c368e9b04f4b24976124508e

    SHA1

    cf5d6845e7826b385ed9f6ed2cfb86ba39ce936d

    SHA256

    cde6377cdc9ae420d9ad890641b48a447139f576ddfe99cbce4d94db5cc054ed

    SHA512

    aba2e8636f8c5a56a2749385aa02d70631e9cd2242cd87bb1be5053a9f53127dae4126f951fe4cf2a298df11d357fabe35a28de6dd386ff446ad9f13f3767a76

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    51ee8711369c4365e5de389d2ba15d27

    SHA1

    6890cece9a38bb44e24e198aa4dfd6214ca4053d

    SHA256

    37481e62c4b994cc777ea35b7d1afee9fad249c8eb1f820e633c77110bd582d8

    SHA512

    488b46fd100b8d770f0e9866cace8f959d723d7d4fc4553754f86741a9f4b3976369f81df47644bf0f092e93fd3e3d5e73ed4879225bea2b7c21dbb777c4cbcc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    63d7d1c7e3f0db55f5688bb5862d61dd

    SHA1

    b8d41db82e544f55049c2be18c2c3d1161780541

    SHA256

    a38bb54ab9dc8c620ed307e21d244ac9410146fc9d275af3e9aea9484b5cc4a1

    SHA512

    0d3ffc8dc4a3c9aed653a1766489440a8639f6ad8cfa52a633a58d46ce0ed8e5858e244aa53e3e9c2d3652bc2ca3e30cdd262234c3cf8acda5449e5f42719fe9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7be904a386e120883b78e6b9ac62d88f

    SHA1

    ccdad45ce6db6eee2666c11264f35aa55e14e53f

    SHA256

    5b7dd62d9c376bf31259d4620c49b257d8428b382c1b7f67f312393bcd0533ff

    SHA512

    ac1741ebb2c5e70dd203b1ec9fe32c748e0a59fa3d674db2365bce35847784edf795c1bc8b1cddb05feff72719e93789750e0c8ce11364166a75c3a45f76a651

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d0ddae140e7f2a1e960dc5118fcff5cc

    SHA1

    cb067490ac5e672a368d291b2cda4833132b2547

    SHA256

    7ff76b8fd56de44146420628b4a7e2fa8dad98884204d67f6d3c3c1c4ecae2bc

    SHA512

    82c5e3441f8073b5af969a5d56f317c5e8c95c5304f270a1855b6e0418e5c757f7d4e325ee769352fa3ac4206be71ee94ab4e92a28e86aeca24f95493f13268c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    472602ac9640dfdbbeca190e9dac0ff6

    SHA1

    e0ad194c11ce195cd653c5278f513a3919f12d0f

    SHA256

    b6e0ad7c9444fcf110145eb3ea6701b6d9c98c9a1d3b8484afc2f7e7699d0a86

    SHA512

    8f66b83b1a071ebbb78cec0e847f06815be1d29514b9ae57c50dcaa090862eb672d98440d09924cea464f841ad58a37986e6cb2aef26ecd64a20009e70d77614

  • C:\Users\Admin\AppData\Local\Temp\CabE4C6.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarE5A4.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/1524-12-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1524-8-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1524-11-0x0000000000230000-0x000000000023F000-memory.dmp

    Filesize

    60KB

  • memory/2656-25-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2656-22-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2656-6-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2656-2-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2656-1-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/3000-23-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3000-21-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3000-20-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/3000-19-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB