Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    75s
  • max time network
    68s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 18:35

General

  • Target

    $PLUGINSDIR/MyNsisExtend.dll

  • Size

    596KB

  • MD5

    37e4e1ab9aee0596c2fa5888357a63b0

  • SHA1

    a5dba8c0a1bd936dca2b6a81f2dc9a3005f1a2b6

  • SHA256

    ff4b245fea98cedd881ca102468623a449a0b40df0c557dd8a6ea32e788d56fe

  • SHA512

    5cbab2872683079c6cc09423a2baf7107b5ac5731f336cd237fa93a4a4ee53a127963dc0ec0dbc6168b9b3d2c3a881c7663ce4ecd84d964628dd566395d49bb3

  • SSDEEP

    12288:1QXznhWxifqPG8yDAay0BQeMrtQW27ZJ6ObWTE5lqtmsVsIdj:1QXznYybPJnWTE5lqwsKG

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MyNsisExtend.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MyNsisExtend.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2128
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2636
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2684
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2548
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 240
        3⤵
        • Program crash
        PID:2944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3c1b948941abea8233fa7ae6fb7cfa31

    SHA1

    74b13f6d1b0ba1cccc3f42ae9c21429f8159d361

    SHA256

    3dd30764aff61dc3091c2cc8fcba78042fe9ea93ea0de0eba7c9b8eb455748dc

    SHA512

    43397ec6268b45780159e11d1cd5d14dd2dc2a43885a4328c09e5f5100088c826ac5d7ba135b802b8cf428a94319c1bff048d5ad28d57f97f0bf004ac2fe8597

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ca897f9a0447548ef5b5c4d2cf6fbedf

    SHA1

    df6794c2f4ac99b99a4b81cc928cec2b5e084b3e

    SHA256

    b0768d532970d716d602f50b6110c8120420ca5f4b9caa414d6c00204df3d62b

    SHA512

    e7b803cfa92a4c51dba05f4e50adb19f71cd4d104c11cffc43c8bba07c5d675be800e178c8824890167cdb67d63522cc33afe78f724cb4fd81e56854eafef414

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1c9dcdf0bc626b2ab7343e5110f2acd1

    SHA1

    7da40dcf4409710743f146fbfa57a4470810fd1b

    SHA256

    29b0923488fd7576a824f6ce74db846cc9ab1d44bbb306e659d8caa5065e57fd

    SHA512

    7be0959c6dd351e73d48a89fd0c53de762a220f43d43a858725733095a3ab5b5407e314aec56c5941f471a92877b7ae9434066c1fa4faea3dbda196414486070

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    64614789a05d157d367078cc8fd279f8

    SHA1

    45c662a828eb79229d691b99f89fb67c49150d77

    SHA256

    8baed15ded6de5ce29e71f71faeb38d91562df41fda6cb87b097e4b4d8d96dd2

    SHA512

    78e89b8a1f6ff16fb9cad368cd3da5f4185dd736eb04dcbf5737ceac91176ff3ed157c24582fecef5032fea1b758a170816ac25956ede06b1d8cc2b490704fa2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    13edde9f12477f06d416b3715c78fc75

    SHA1

    b1791c10d5a3ee7bb14e90356d40780b58b21e50

    SHA256

    655e45ef42e6150570eb368ba71cee3f6d82f9c70c14087e9dedd601becbbf4d

    SHA512

    0c5505914ae79e4d679891b7dcae7fc810025158ba051a3271f9f4a59cb2bc37c2a8e0de6a18a6df9ea550fd920c62e1649e76d3ae78808531dec5cda2f617b4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2f0f1f3fd4902ab7c80e9baf91f95081

    SHA1

    5d8f62bfae71caffe945b4cfc64d0e12cda73990

    SHA256

    8aa25d4416e6a7030a0dabec6bb5ef29d5334ab4ea6e2335dc1de10fdcadc795

    SHA512

    48ef239d75fd95df31c0469eda096d9542982262dd7a194d56e1eda9478c10bf0fa5e3556e4d05572f7f606d8c98b950aadf3f5fa5732076ff08f41d08ab6eb9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9a1fe423a118bd327f5a11e349233fc4

    SHA1

    ed31d582bae11032016838046ebc84dee9e1e8fd

    SHA256

    72d88af831fafca33c630d8084077424372b6098056842a25e4ffae2538ad8f0

    SHA512

    b74c2ecf25d620852d3a77497c230ba16118be933ab2470f07f8ceddcc38f10a707fda55a8ffc60adcf0fc8765d83ac4b7098be2836927d74dbb65a9a3da0ba6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    99530ca9c8214f3f328d860b01c84a38

    SHA1

    ef6dd07d40d5add61639705e21e11542701d04de

    SHA256

    5d380f2ad16158a3cb825dc908611cb2af51fbb48eb5cfea211300f38d3ebc61

    SHA512

    8ac37620d2266fa2e5f583263ed1aa0e9446a28f64f5e90c11ed8e2f8bd3e5ef4b71b75467a0e2e175c1855cc66445829158b31c18a96cdd6fbb10762cffad3c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c3d0511dbbbd6008fe4137616b6402d6

    SHA1

    edc049e698b5638f48e086f1ad28fd74876a0931

    SHA256

    10306acf39e00fb9c862a09b5322f3f98e142792b0274bf370beffac17208985

    SHA512

    3616cf6cb507c43217ff310f40c7b3445f647b5b9cea01d236d16009d9571fa119b5b8d8f38727cb5b02e6896aebde6871f984aed82622bb6bdee3e0200618ae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fb9e0e14413dbd88e82a68e63e7646c0

    SHA1

    aa371c0156475ab7fbe2bc3a962ce17822f2b70b

    SHA256

    a44677db9bcc9fc42a5e96ca11e89ba42937b86fcd8c651a7c66e1adc692874e

    SHA512

    fbc19d831188eb95d87871a5ff64af53ee7bb513833e36f3334fcd50a5cccb209647e847c7fd81622a25a4d7b5f6487b80805c4433d71cd6473f071fee7f0eff

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a1a879ae8888e56d2ea9f9aa93c67621

    SHA1

    a2478886ba6d57bae1cd7f6f9239bcdf38a5438e

    SHA256

    59f229ff96b06ae53fb525d2936d393e5734347325f86f8654598c478098a479

    SHA512

    e7fe3f6bc70f0d72c1bfe353bd34c33d7c88def425bb2c6ed5b1ad1821ef4946c3070b4d5c2a7a87e27dbc680e20eb6bdb02b93b82a64c9eb1b0ce42459cf18f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f46313ae3d26ae0b23ad68b6817286b6

    SHA1

    61b5380c22e150f07e859435fcbb7e9da09f1a0d

    SHA256

    8fd9b2c0c69dc0c26c14feb76baa70b159bcca45931d0a0833bf7b7619354a03

    SHA512

    82ce3231000f2a4218bd4f6bd6c34ce30d960c8848334f4a788c43a0b7c5519639b7f8e6fdd47f76fe44848784720cb78167bd5b92509e5454b94b862b663153

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ec139bd8439f2778e0eae996228ad438

    SHA1

    7a64873024f13ea3182590d5459cf2422af94e28

    SHA256

    e9df727c0e2202bec98c5edcd4bb1f9a1be6d7051b6bf8b67f2dcad0e89db7d0

    SHA512

    d79ab0c1ebd44ac7922e612784c11cb7ca142a4a27a1908e26e07a1ea2e8de2b4a2aee6ebb5b6a9a6e104d25a5db9ab1efa4534eac07faa0fff016b5ac893103

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1f04c7811c490b986f5d7ae8de811130

    SHA1

    1ba2354c714dd10fab2e46f9259729c9cfb8cef6

    SHA256

    49d9f90f792ad4e3e580bd69972289e42c33d6c594e57e39731ac694241555a8

    SHA512

    e3b8f533e506cbfb17a4e896310544c4b4953f5bcc0eab436995156bad2eb91ca30c803e13d41984ce729a861f3c616fe663ad2f2a417c7c368c37a14af34858

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6af6442d01c86840d91326c6d1f90e04

    SHA1

    cc627dacb535ccf557244e29969b7a3aaad616ea

    SHA256

    dad1502091398131a7d828eacd70360871fe6f628cdc311cb4b363ce5214599f

    SHA512

    e1f09aa5a983ae2f4cee77f715a1187b01e022338bfe9664fdce6167fd16553ed6a2bf820ed0462fb29ed389370a20c75de6a50a10c13232377a62585c66a012

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    48c99f89c1a13ea529107519800fe209

    SHA1

    bc4824c873d9212bdd2d3dfcc79418094450fb41

    SHA256

    f701916ef586ef1aa7b115a7b71df8835bf53ab59e162641cff3e299e47979cf

    SHA512

    e7b17c9cd6ee825af6c6f03b2e683e16977c814536547677f4d7de999c3bca2908bcaf193bf11a31e06e71d9a45047574edf1fc261a1e39de4777c15cae034a1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9d566c893707cfa20f972ebb97417682

    SHA1

    1daf5d81190e2f8b99f3cf4895efc2ff89bda6d5

    SHA256

    0d2067d43a4463d8f6c0bcd65e54094f22986ad32a55e776a5de7cc7b68ad659

    SHA512

    4d6b71da41ac8c95a2ae924f97c8e78f3dc86c89440306ada222bae1b43ea30436b8e61c771e48a76a4ea127069582a7d301e965af210456349f937bc682f1b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5cf86b3f8c5e7c1a03a22526c71e5b13

    SHA1

    54d0c95124fd0fb41cdfe3a26f7e0f3a1dd66ed1

    SHA256

    e03a8cce80b5fabe9c8d9eb2cf5f906da104df76b0fad2efc706538d2b300feb

    SHA512

    b3a296e3500bb057559d4e80f0d707abee9fddaa9d702c2b806494b426f58f5865070396e260043356245572932ca67b911e5459e8887a9c18def60f7a414990

  • C:\Users\Admin\AppData\Local\Temp\CabFAA5.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarFB65.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/2128-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2284-2-0x0000000010000000-0x000000001009A000-memory.dmp

    Filesize

    616KB

  • memory/2284-1-0x0000000010000000-0x000000001009A000-memory.dmp

    Filesize

    616KB

  • memory/2284-7-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2284-22-0x0000000010000000-0x000000001009A000-memory.dmp

    Filesize

    616KB

  • memory/2284-23-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2636-18-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2636-19-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2636-20-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2636-16-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB