Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2025, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
5e5e0ed014f836749b4652ca7de765340b5e122f22fff1a982604500b0223454N.dll
Resource
win7-20240903-en
General
-
Target
5e5e0ed014f836749b4652ca7de765340b5e122f22fff1a982604500b0223454N.dll
-
Size
216KB
-
MD5
e35b79f86c57b2927f5f906eb35ec3c0
-
SHA1
50a5e5355d4dfbd3f8d77ce301b0f240c406f13f
-
SHA256
5e5e0ed014f836749b4652ca7de765340b5e122f22fff1a982604500b0223454
-
SHA512
5a3e184f9197ecedc19403c7001308908473252bc68268bd3a5550b87d72f88c59514ea0624ab28072490b8739969c8972e254228bf3c5808ef679702a36acc2
-
SSDEEP
3072:dn2PxxtNKMQLBvBt0M1qCWzJP0ruTTBaClHpspom7ffrAmpe:lbHLBf0dJ5TTBZbspom7bXw
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:enabled:@shell32.dll,-1" rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile rundll32.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 6 3024 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 4560 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/files/0x000c000000023b5f-3.dat upx behavioral2/memory/4560-5-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4560-14-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1668 4560 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4560 rundll32mgr.exe 4560 rundll32mgr.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe 4560 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4560 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4636 wrote to memory of 3024 4636 rundll32.exe 83 PID 4636 wrote to memory of 3024 4636 rundll32.exe 83 PID 4636 wrote to memory of 3024 4636 rundll32.exe 83 PID 3024 wrote to memory of 4560 3024 rundll32.exe 84 PID 3024 wrote to memory of 4560 3024 rundll32.exe 84 PID 3024 wrote to memory of 4560 3024 rundll32.exe 84 PID 4560 wrote to memory of 632 4560 rundll32mgr.exe 5 PID 4560 wrote to memory of 632 4560 rundll32mgr.exe 5 PID 4560 wrote to memory of 632 4560 rundll32mgr.exe 5 PID 4560 wrote to memory of 632 4560 rundll32mgr.exe 5 PID 4560 wrote to memory of 632 4560 rundll32mgr.exe 5 PID 4560 wrote to memory of 632 4560 rundll32mgr.exe 5 PID 4560 wrote to memory of 688 4560 rundll32mgr.exe 7 PID 4560 wrote to memory of 688 4560 rundll32mgr.exe 7 PID 4560 wrote to memory of 688 4560 rundll32mgr.exe 7 PID 4560 wrote to memory of 688 4560 rundll32mgr.exe 7 PID 4560 wrote to memory of 688 4560 rundll32mgr.exe 7 PID 4560 wrote to memory of 688 4560 rundll32mgr.exe 7 PID 4560 wrote to memory of 796 4560 rundll32mgr.exe 8 PID 4560 wrote to memory of 796 4560 rundll32mgr.exe 8 PID 4560 wrote to memory of 796 4560 rundll32mgr.exe 8 PID 4560 wrote to memory of 796 4560 rundll32mgr.exe 8 PID 4560 wrote to memory of 796 4560 rundll32mgr.exe 8 PID 4560 wrote to memory of 796 4560 rundll32mgr.exe 8 PID 4560 wrote to memory of 800 4560 rundll32mgr.exe 9 PID 4560 wrote to memory of 800 4560 rundll32mgr.exe 9 PID 4560 wrote to memory of 800 4560 rundll32mgr.exe 9 PID 4560 wrote to memory of 800 4560 rundll32mgr.exe 9 PID 4560 wrote to memory of 800 4560 rundll32mgr.exe 9 PID 4560 wrote to memory of 800 4560 rundll32mgr.exe 9 PID 4560 wrote to memory of 816 4560 rundll32mgr.exe 10 PID 4560 wrote to memory of 816 4560 rundll32mgr.exe 10 PID 4560 wrote to memory of 816 4560 rundll32mgr.exe 10 PID 4560 wrote to memory of 816 4560 rundll32mgr.exe 10 PID 4560 wrote to memory of 816 4560 rundll32mgr.exe 10 PID 4560 wrote to memory of 816 4560 rundll32mgr.exe 10 PID 4560 wrote to memory of 912 4560 rundll32mgr.exe 11 PID 4560 wrote to memory of 912 4560 rundll32mgr.exe 11 PID 4560 wrote to memory of 912 4560 rundll32mgr.exe 11 PID 4560 wrote to memory of 912 4560 rundll32mgr.exe 11 PID 4560 wrote to memory of 912 4560 rundll32mgr.exe 11 PID 4560 wrote to memory of 912 4560 rundll32mgr.exe 11 PID 4560 wrote to memory of 968 4560 rundll32mgr.exe 12 PID 4560 wrote to memory of 968 4560 rundll32mgr.exe 12 PID 4560 wrote to memory of 968 4560 rundll32mgr.exe 12 PID 4560 wrote to memory of 968 4560 rundll32mgr.exe 12 PID 4560 wrote to memory of 968 4560 rundll32mgr.exe 12 PID 4560 wrote to memory of 968 4560 rundll32mgr.exe 12 PID 4560 wrote to memory of 388 4560 rundll32mgr.exe 13 PID 4560 wrote to memory of 388 4560 rundll32mgr.exe 13 PID 4560 wrote to memory of 388 4560 rundll32mgr.exe 13 PID 4560 wrote to memory of 388 4560 rundll32mgr.exe 13 PID 4560 wrote to memory of 388 4560 rundll32mgr.exe 13 PID 4560 wrote to memory of 388 4560 rundll32mgr.exe 13 PID 4560 wrote to memory of 392 4560 rundll32mgr.exe 14 PID 4560 wrote to memory of 392 4560 rundll32mgr.exe 14 PID 4560 wrote to memory of 392 4560 rundll32mgr.exe 14 PID 4560 wrote to memory of 392 4560 rundll32mgr.exe 14 PID 4560 wrote to memory of 392 4560 rundll32mgr.exe 14 PID 4560 wrote to memory of 392 4560 rundll32mgr.exe 14 PID 4560 wrote to memory of 752 4560 rundll32mgr.exe 15 PID 4560 wrote to memory of 752 4560 rundll32mgr.exe 15 PID 4560 wrote to memory of 752 4560 rundll32mgr.exe 15 PID 4560 wrote to memory of 752 4560 rundll32mgr.exe 15
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:632
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:796
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:388
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:688
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:816
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:704
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3724
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3812
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3880
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3972
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4100
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:2660
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:2588
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:3732
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4452
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4880
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:392
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:752
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:532
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1096
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2684
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:1148
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1192
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1228
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1320
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1328
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2420
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1372
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1560
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1628
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1672
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1852
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1908
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1972
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2056
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2132
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2496
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2700
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2712
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3328
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3412
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e5e0ed014f836749b4652ca7de765340b5e122f22fff1a982604500b0223454N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e5e0ed014f836749b4652ca7de765340b5e122f22fff1a982604500b0223454N.dll,#13⤵
- Modifies firewall policy service
- Blocklisted process makes network request
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 2765⤵
- Program crash
PID:1668
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:5004
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:1904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:1572
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4460
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:3388
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:4020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4560 -ip 45601⤵PID:3064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159KB
MD58703c6aeb2e62da71e50db9698d91e35
SHA1cafceda794c5b1976b46a5d39949137aba8dc9e6
SHA256c3a332de99e2b195bbb3e5927f8ee4217f968bc373f8c499db45db0b3388d47d
SHA51248e45868929fcacfa06c5078de2e54d32cfab80e5dd00036b37f3d55b33269f0ee82f46b68e7a6adc2ec9aecad8672393a77602c1b995133876c2c4e6d15229a