Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    68s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 18:35

General

  • Target

    $PLUGINSDIR/PackageAssist.dll

  • Size

    204KB

  • MD5

    3ad657fc9507467d770e297803473d66

  • SHA1

    0d33fba778b0e91ebc503a3686cf1903d1b80266

  • SHA256

    1a8e33f27002549ad3bd44e0032028a4f84ffb7ce07889605f5a9219aea9691e

  • SHA512

    a6a06c103d5f8e19b139071f24c640ebe77a17bb249de6b64321d9a28ace5a6c37582701db90b8754f9db523f3085cb71271c84dd4dbb609e9c40b06a3aa35fe

  • SSDEEP

    3072:iOHvt3fbTYYout98liJICstj3GDijRGoqVvbaNXubJ1JI:5Hvt3fwYollgq24LqVvWIdjI

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Ramnit family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PackageAssist.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PackageAssist.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\SysWOW64\rundll32Srv.exe
        C:\Windows\SysWOW64\rundll32Srv.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:316
        • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
          "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2340
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2164
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
              6⤵
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    10ffa8a147135650905b981e851aef27

    SHA1

    348f2a8bdb40dec59e49314d8c21bf0d0925d375

    SHA256

    5f265fb658dee0f4532332ecd6da0d5a489ea21a16f901cb528603c50169a06a

    SHA512

    9df7ec2019eea66b06547922b8d6bd3c2068c2361027ba24fe2bdc6682064fa3753314bd22e38d0db05b79b81d373fc6ac0939b35b445f485022740b66833102

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    984498c37d42ad9008fe7a34b968cbcc

    SHA1

    e1a1ced0edc4c0b891e5faf773c421c375ee9a14

    SHA256

    3c46ff062408250ef9a45353ec647b22cb9c8b8b43065f63e7aa1061c6052879

    SHA512

    20b2593590ec609644647def0b733cff20626f9bc0e9eaad5a5e93bd089caf41bee5b37e0a9f409ca5c77cbb8a2a31e78325165132af87255d351dc8a10489bf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5a46fde009794ecca666ce12daeab5c9

    SHA1

    09e537d619662c2680933009bf5affca0afef34d

    SHA256

    24169d58c128b42fbb64980d98977e03187aabbaa9ac9b00c9b72c2318de5790

    SHA512

    70b791640c6f44a4d044e1389b10fdec81bf563e03f4092a15f83e39e997d5871a433b0746422b0c0a6e863f0081d10d4e0c9c7627832d5e5f86f61f67814121

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3a2dad5729f01e45fa92665c2812cbc4

    SHA1

    e271217418c80ac154be55f36a73f88dbe9487bb

    SHA256

    fba4c922d414f8b78593499028759ee0f06a937385dbaa8d3f7bd330b00874d0

    SHA512

    309fc8366d47012d0936e1a20c4473d6fd2c82a384b1fdc45019e9fd47523e6704ce70b0fb21975dc3930f4dd82c2f7ec98adffbd3f52f221586981b897a6a53

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f51d4ae241cd868331adc09bc24c2054

    SHA1

    95b57de1a44b8f6150bda482ac318d85f70082a4

    SHA256

    d0bbbf1d70510bfdec934e0bd77eff19b89b7da021b379c806cd0555069af395

    SHA512

    87d529cf83b9f6f5e58e82b92ba45df09dc9bb9f40d07c15a00f24a36e04956b9e6917388b293c5e094301a79bee10404fd864d180b18e22e06f5930b658c6bc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    91dea51e461904a87a07545361537165

    SHA1

    7e0535c7a93d0fa58cf6fa7f8c5f03618bf80ccf

    SHA256

    516e7520252cd79894ba41b9ea71ebedf3090e67b26e1b85361116f3e60d7a71

    SHA512

    b80276c4e28066935e6fa8d97b182f83b836c8e514dee52ca819d5e703d204b4d4bfbd73466a0e90daea9ee13844170044300cc820cb63091b34bcfba1517f82

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bb56f975153975540674f40b944a885e

    SHA1

    00f22daa741b59e36c7c13cdb3e3c3dadc022550

    SHA256

    36913b2b77c59344f47622445b10b08142b236887bcfc06dd56290d6b1b22b35

    SHA512

    5f54b70393e863c5fa7d67cbec8d73bed0e3d0dcd091effc0cfa4ba3a0081497db6e5f9bc28a87e097ab720f94f00143eb4b1b56a0ccdc855a5c626a2775e195

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7951e437ac0f751882179f35e76ab0ab

    SHA1

    d62fefcebee7f267a8ea9f294bfd658f5e896168

    SHA256

    5f47ed7a6da319d6796a1f6e2df63ffcacd50d4ebb65fa3fdab7821a062a6974

    SHA512

    e85a235645b60a69fcdf1c9d7eb8bb95fd6e6ca0655c9a6fcaeb42ebbc83aaba16bb144b6415eafe31157a543324696cd6210662018194c17559488e3764824f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bdb6c48fad42d56ab5636ce135e61cda

    SHA1

    d5ea68956f31d549cb5615042f86494048c2b327

    SHA256

    4333be4349792761ed4c6a893b4138bfcc8c53165003bec879d595beb178ddd3

    SHA512

    88373588ddaa73d84174b0488807da7a619102bdfaa97944ac1711cf7a862e903ee082d3083a5a2263739f420e44d7a279d16aa4a65a6c1849bd7e424d890861

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b898358ae7a7f7f8347293baa870f5b8

    SHA1

    a590610bee062bdc08314cf6716fd1b542a27348

    SHA256

    546cef591b8c38e33b4ab235cb2119e1808c81749a216eb89300afc6cb1ef3dd

    SHA512

    923558382b661e8d65eb17139ed11655458c0b4a734244b2b782c5b5e3413597fb3483e79407df77d270f06ca8b32365d4063eaf6c1ee3a3e86e8c11197949b8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    57b7d29951609f8ee31c65101284007e

    SHA1

    0eb6e5cefac370ec8cac67ca0d49948283df21dd

    SHA256

    6e5196c775963920a32131194c34bec680cb17c572066fa43a19c2bedfec7fae

    SHA512

    f5fb68899945b7c37ee52cee008a7693180580619e9776643910e493a2e7eaa01336daf21472ea08a30e20b4b8e70bfcd26c0b088f0c66da64544dc8969910a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3b36b9de1712137dbef7cff19c94b0ad

    SHA1

    2bdf74d801ed28b821c45049a85ccb89e2a57689

    SHA256

    c79625c3872a859f20ae10e685a6c87286a2f759e83fc7e43ee948d046e25f82

    SHA512

    65dc4b72f14bd7f7f342562b00b7b581e76b0ff3cad5f1444f90c97c7092206e911b604eab43aa74d59338c99ba788d51ee388ceb5ce4904a24919474eb9b8dd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    deee2b2ee8134550c307f863cda963d2

    SHA1

    4bbae694fe54c26ba48f23ddb10c6a01decfbfd4

    SHA256

    5bd9a5dfe68464d05441bd1652d7ca11f06e78d44e538fb0a05db7fbce5672af

    SHA512

    227e22149cc944f1087146d0c9175bbd213918f51fd223e580acd1f5c293e93b8f4bd4ebb3265232307e71faee325a9505ee9e0dcb5dc842237755e5cf9e3efe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1c6e2e7b19241f130e204e8a161531f8

    SHA1

    2a226860ad9577f4d45f82934d640582acb99cdf

    SHA256

    9d6ad224ee2e66d02f1ee0d41e0169e88361f7e5c174a386569fad60a469a63e

    SHA512

    8337208d4a27ea89fa75a83732a2ae651972d982af2e2c8585197dabf9cd83a1e2068ff4ecb391491cc12f5f6fdb4bce0f438af541ba1dccd838146dde0ee8f2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    63c88740874c103379e64832032449ec

    SHA1

    61f396b4846bec2fb750daa65fbda934be0e1090

    SHA256

    9aaf852fbdeef4f40321c89ed16d943acad991a25a7b3ed6b0b4ef51aa94a3c0

    SHA512

    62a17536ffa69e9a0666feba470c6ea73caf0f3989d6b5024309c793bb0536452f36de3d2f68ef6cf6153b7e91e19b93d536a81b9ab3c17fed27e1b7948bbf60

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4e786adf69b177f83b607630aea2c2be

    SHA1

    36f1fb69b838c8960b052041608802224ba880d4

    SHA256

    2ca9a8bdd8ebe38553b087853841b6ec1aa9746db76b283ebec405d8b4dd99e9

    SHA512

    9319d19c2b1a754271c7c79d41c0a2d5d979c94d9013cbbd9a1cc618b6c52b99615d4899d7e7bb37f22a575c1853d8a6410ea90e396a53b99a005033f133e6d7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e8065c8fe55d8f1f61fb897b379251b9

    SHA1

    4aa617127ca362f5792e2961c1f3afec34a44fc1

    SHA256

    769dbb3b32750cc4ea1921627429cb3b83e38044fb16fedf2ef03c0560551ef9

    SHA512

    0c83ff37a370d738aa62886a3c4451eb327629a13d095cf8f2337cecb5c59902a77e1d7c88e91ed05c40693097556bae1738012c7b5b6adacc9fa182bbf2771f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2ed7c43b7e46780f3aadaa36faffea8c

    SHA1

    7c21d1ef0ae83416691cecdc941d69747b1b2693

    SHA256

    7a8a6dda0576ef991b10cf0d31753c0bee0317047d71e05a26e01d0842feac23

    SHA512

    55b52d755331840533b5542376775334cf60bccdca5e686a92a9f16742ad2b773e5a3b5e2eb733ba9afc5e0a39a986615da7c9db347a0a84f26e3464afc94c41

  • C:\Users\Admin\AppData\Local\Temp\Cab3CB.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar42C.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Windows\SysWOW64\rundll32Srv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/316-8-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/316-15-0x0000000000240000-0x000000000026E000-memory.dmp

    Filesize

    184KB

  • memory/316-11-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/316-10-0x0000000000230000-0x000000000023F000-memory.dmp

    Filesize

    60KB

  • memory/1692-5-0x0000000010000000-0x0000000010035000-memory.dmp

    Filesize

    212KB

  • memory/1692-6-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/1692-1-0x0000000010000000-0x0000000010035000-memory.dmp

    Filesize

    212KB

  • memory/2340-22-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2340-23-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2340-20-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB