Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2025, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
85a56af735f134948a11fc9dd4065552e8e5e3c23e09c6d89b4ccffbb29f5976.dll
Resource
win7-20240903-en
General
-
Target
85a56af735f134948a11fc9dd4065552e8e5e3c23e09c6d89b4ccffbb29f5976.dll
-
Size
304KB
-
MD5
c8bf29e1bcdd4ec85ee09318b4568c4f
-
SHA1
c134445ae3d16d6729f41aab6aedae4e9888abc0
-
SHA256
85a56af735f134948a11fc9dd4065552e8e5e3c23e09c6d89b4ccffbb29f5976
-
SHA512
439e484cb9ff64f8b5fe00f409c818db0b75431e63766e6c9e61be01feac53456705ebde51b19b48854702b6abb0fe85a42cf87743018bd04e0e5fdfae75e880
-
SSDEEP
3072:PZmu9K33zShdJ/tqLtAPrLWoxdv8yD4wQLBvBt0M1qCWzJP0ruTTBaClHpspom7F:P8b33y4UrqMALBf0dJ5TTBZbspom7bXR
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List rundll32mgr.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile rundll32mgr.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications rundll32mgr.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32mgr.exe = "C:\\Windows\\SysWOW64\\rundll32mgr.exe:*:enabled:@shell32.dll,-1" rundll32mgr.exe -
Executes dropped EXE 1 IoCs
pid Process 4032 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/files/0x0008000000023c5f-3.dat upx behavioral2/memory/4032-5-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4032-14-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1204 4032 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4032 rundll32mgr.exe 4032 rundll32mgr.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe 4032 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4032 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 528 4996 rundll32.exe 84 PID 4996 wrote to memory of 528 4996 rundll32.exe 84 PID 4996 wrote to memory of 528 4996 rundll32.exe 84 PID 528 wrote to memory of 4032 528 rundll32.exe 85 PID 528 wrote to memory of 4032 528 rundll32.exe 85 PID 528 wrote to memory of 4032 528 rundll32.exe 85 PID 4032 wrote to memory of 616 4032 rundll32mgr.exe 5 PID 4032 wrote to memory of 616 4032 rundll32mgr.exe 5 PID 4032 wrote to memory of 616 4032 rundll32mgr.exe 5 PID 4032 wrote to memory of 616 4032 rundll32mgr.exe 5 PID 4032 wrote to memory of 616 4032 rundll32mgr.exe 5 PID 4032 wrote to memory of 616 4032 rundll32mgr.exe 5 PID 4032 wrote to memory of 664 4032 rundll32mgr.exe 7 PID 4032 wrote to memory of 664 4032 rundll32mgr.exe 7 PID 4032 wrote to memory of 664 4032 rundll32mgr.exe 7 PID 4032 wrote to memory of 664 4032 rundll32mgr.exe 7 PID 4032 wrote to memory of 664 4032 rundll32mgr.exe 7 PID 4032 wrote to memory of 664 4032 rundll32mgr.exe 7 PID 4032 wrote to memory of 780 4032 rundll32mgr.exe 8 PID 4032 wrote to memory of 780 4032 rundll32mgr.exe 8 PID 4032 wrote to memory of 780 4032 rundll32mgr.exe 8 PID 4032 wrote to memory of 780 4032 rundll32mgr.exe 8 PID 4032 wrote to memory of 780 4032 rundll32mgr.exe 8 PID 4032 wrote to memory of 780 4032 rundll32mgr.exe 8 PID 4032 wrote to memory of 788 4032 rundll32mgr.exe 9 PID 4032 wrote to memory of 788 4032 rundll32mgr.exe 9 PID 4032 wrote to memory of 788 4032 rundll32mgr.exe 9 PID 4032 wrote to memory of 788 4032 rundll32mgr.exe 9 PID 4032 wrote to memory of 788 4032 rundll32mgr.exe 9 PID 4032 wrote to memory of 788 4032 rundll32mgr.exe 9 PID 4032 wrote to memory of 804 4032 rundll32mgr.exe 10 PID 4032 wrote to memory of 804 4032 rundll32mgr.exe 10 PID 4032 wrote to memory of 804 4032 rundll32mgr.exe 10 PID 4032 wrote to memory of 804 4032 rundll32mgr.exe 10 PID 4032 wrote to memory of 804 4032 rundll32mgr.exe 10 PID 4032 wrote to memory of 804 4032 rundll32mgr.exe 10 PID 4032 wrote to memory of 908 4032 rundll32mgr.exe 11 PID 4032 wrote to memory of 908 4032 rundll32mgr.exe 11 PID 4032 wrote to memory of 908 4032 rundll32mgr.exe 11 PID 4032 wrote to memory of 908 4032 rundll32mgr.exe 11 PID 4032 wrote to memory of 908 4032 rundll32mgr.exe 11 PID 4032 wrote to memory of 908 4032 rundll32mgr.exe 11 PID 4032 wrote to memory of 956 4032 rundll32mgr.exe 12 PID 4032 wrote to memory of 956 4032 rundll32mgr.exe 12 PID 4032 wrote to memory of 956 4032 rundll32mgr.exe 12 PID 4032 wrote to memory of 956 4032 rundll32mgr.exe 12 PID 4032 wrote to memory of 956 4032 rundll32mgr.exe 12 PID 4032 wrote to memory of 956 4032 rundll32mgr.exe 12 PID 4032 wrote to memory of 384 4032 rundll32mgr.exe 13 PID 4032 wrote to memory of 384 4032 rundll32mgr.exe 13 PID 4032 wrote to memory of 384 4032 rundll32mgr.exe 13 PID 4032 wrote to memory of 384 4032 rundll32mgr.exe 13 PID 4032 wrote to memory of 384 4032 rundll32mgr.exe 13 PID 4032 wrote to memory of 384 4032 rundll32mgr.exe 13 PID 4032 wrote to memory of 744 4032 rundll32mgr.exe 14 PID 4032 wrote to memory of 744 4032 rundll32mgr.exe 14 PID 4032 wrote to memory of 744 4032 rundll32mgr.exe 14 PID 4032 wrote to memory of 744 4032 rundll32mgr.exe 14 PID 4032 wrote to memory of 744 4032 rundll32mgr.exe 14 PID 4032 wrote to memory of 744 4032 rundll32mgr.exe 14 PID 4032 wrote to memory of 1000 4032 rundll32mgr.exe 15 PID 4032 wrote to memory of 1000 4032 rundll32mgr.exe 15 PID 4032 wrote to memory of 1000 4032 rundll32mgr.exe 15 PID 4032 wrote to memory of 1000 4032 rundll32mgr.exe 15
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:780
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:384
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:664
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:804
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:3068
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3756
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3856
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3916
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:4004
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3460
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:2508
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:1200
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:3088
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3340
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:676
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:1948
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1048
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1068
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1104
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1172
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:3028
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:2452
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1272
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1448
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1468
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2876
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1668
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1732
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1832
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1852
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1964
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1972
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1980
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2024
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:1932
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2096
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2180
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2496
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2544
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2592
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3372
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\85a56af735f134948a11fc9dd4065552e8e5e3c23e09c6d89b4ccffbb29f5976.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\85a56af735f134948a11fc9dd4065552e8e5e3c23e09c6d89b4ccffbb29f5976.dll,#13⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Modifies firewall policy service
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 5125⤵
- Program crash
PID:1204
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:2532
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:5048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4692
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:3988
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:3956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4032 -ip 40321⤵PID:5108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159KB
MD58703c6aeb2e62da71e50db9698d91e35
SHA1cafceda794c5b1976b46a5d39949137aba8dc9e6
SHA256c3a332de99e2b195bbb3e5927f8ee4217f968bc373f8c499db45db0b3388d47d
SHA51248e45868929fcacfa06c5078de2e54d32cfab80e5dd00036b37f3d55b33269f0ee82f46b68e7a6adc2ec9aecad8672393a77602c1b995133876c2c4e6d15229a