Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2025, 05:35
Static task
static1
Behavioral task
behavioral1
Sample
7a29544a0e69d2f804a2ee90849a3e046fbaa9a61736137d54a89455f25e0d89.dll
Resource
win7-20240903-en
General
-
Target
7a29544a0e69d2f804a2ee90849a3e046fbaa9a61736137d54a89455f25e0d89.dll
-
Size
220KB
-
MD5
6c0c822681a58f69dca8efc7406c1be5
-
SHA1
5784a08c0b5ea71cefe94c5a36b027aaa035dfb4
-
SHA256
7a29544a0e69d2f804a2ee90849a3e046fbaa9a61736137d54a89455f25e0d89
-
SHA512
3f8626b3ccd918764417b86e331bfdd36ed2a1c1dc094bf5ba3757043ceac8308fe9214f38af31798cc785312f00808151480d66de73854d4f548e155e13fa9b
-
SSDEEP
3072:5n2Pxxt+TwV6XQLBvBt0M1qCWzJP0ruTTBaClHpspom7ffrAmpd:h9ALBf0dJ5TTBZbspom7bXj
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:enabled:@shell32.dll,-1" rundll32.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 8 2004 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 4432 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/files/0x000c000000023b9b-3.dat upx behavioral2/memory/4432-5-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4432-15-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1696 4432 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4432 rundll32mgr.exe 4432 rundll32mgr.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe 4432 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4432 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3668 wrote to memory of 2004 3668 rundll32.exe 83 PID 3668 wrote to memory of 2004 3668 rundll32.exe 83 PID 3668 wrote to memory of 2004 3668 rundll32.exe 83 PID 2004 wrote to memory of 4432 2004 rundll32.exe 84 PID 2004 wrote to memory of 4432 2004 rundll32.exe 84 PID 2004 wrote to memory of 4432 2004 rundll32.exe 84 PID 4432 wrote to memory of 612 4432 rundll32mgr.exe 5 PID 4432 wrote to memory of 612 4432 rundll32mgr.exe 5 PID 4432 wrote to memory of 612 4432 rundll32mgr.exe 5 PID 4432 wrote to memory of 612 4432 rundll32mgr.exe 5 PID 4432 wrote to memory of 612 4432 rundll32mgr.exe 5 PID 4432 wrote to memory of 612 4432 rundll32mgr.exe 5 PID 4432 wrote to memory of 672 4432 rundll32mgr.exe 7 PID 4432 wrote to memory of 672 4432 rundll32mgr.exe 7 PID 4432 wrote to memory of 672 4432 rundll32mgr.exe 7 PID 4432 wrote to memory of 672 4432 rundll32mgr.exe 7 PID 4432 wrote to memory of 672 4432 rundll32mgr.exe 7 PID 4432 wrote to memory of 672 4432 rundll32mgr.exe 7 PID 4432 wrote to memory of 776 4432 rundll32mgr.exe 8 PID 4432 wrote to memory of 776 4432 rundll32mgr.exe 8 PID 4432 wrote to memory of 776 4432 rundll32mgr.exe 8 PID 4432 wrote to memory of 776 4432 rundll32mgr.exe 8 PID 4432 wrote to memory of 776 4432 rundll32mgr.exe 8 PID 4432 wrote to memory of 776 4432 rundll32mgr.exe 8 PID 4432 wrote to memory of 784 4432 rundll32mgr.exe 9 PID 4432 wrote to memory of 784 4432 rundll32mgr.exe 9 PID 4432 wrote to memory of 784 4432 rundll32mgr.exe 9 PID 4432 wrote to memory of 784 4432 rundll32mgr.exe 9 PID 4432 wrote to memory of 784 4432 rundll32mgr.exe 9 PID 4432 wrote to memory of 784 4432 rundll32mgr.exe 9 PID 4432 wrote to memory of 796 4432 rundll32mgr.exe 10 PID 4432 wrote to memory of 796 4432 rundll32mgr.exe 10 PID 4432 wrote to memory of 796 4432 rundll32mgr.exe 10 PID 4432 wrote to memory of 796 4432 rundll32mgr.exe 10 PID 4432 wrote to memory of 796 4432 rundll32mgr.exe 10 PID 4432 wrote to memory of 796 4432 rundll32mgr.exe 10 PID 4432 wrote to memory of 900 4432 rundll32mgr.exe 11 PID 4432 wrote to memory of 900 4432 rundll32mgr.exe 11 PID 4432 wrote to memory of 900 4432 rundll32mgr.exe 11 PID 4432 wrote to memory of 900 4432 rundll32mgr.exe 11 PID 4432 wrote to memory of 900 4432 rundll32mgr.exe 11 PID 4432 wrote to memory of 900 4432 rundll32mgr.exe 11 PID 4432 wrote to memory of 948 4432 rundll32mgr.exe 12 PID 4432 wrote to memory of 948 4432 rundll32mgr.exe 12 PID 4432 wrote to memory of 948 4432 rundll32mgr.exe 12 PID 4432 wrote to memory of 948 4432 rundll32mgr.exe 12 PID 4432 wrote to memory of 948 4432 rundll32mgr.exe 12 PID 4432 wrote to memory of 948 4432 rundll32mgr.exe 12 PID 4432 wrote to memory of 336 4432 rundll32mgr.exe 13 PID 4432 wrote to memory of 336 4432 rundll32mgr.exe 13 PID 4432 wrote to memory of 336 4432 rundll32mgr.exe 13 PID 4432 wrote to memory of 336 4432 rundll32mgr.exe 13 PID 4432 wrote to memory of 336 4432 rundll32mgr.exe 13 PID 4432 wrote to memory of 336 4432 rundll32mgr.exe 13 PID 4432 wrote to memory of 392 4432 rundll32mgr.exe 14 PID 4432 wrote to memory of 392 4432 rundll32mgr.exe 14 PID 4432 wrote to memory of 392 4432 rundll32mgr.exe 14 PID 4432 wrote to memory of 392 4432 rundll32mgr.exe 14 PID 4432 wrote to memory of 392 4432 rundll32mgr.exe 14 PID 4432 wrote to memory of 392 4432 rundll32mgr.exe 14 PID 4432 wrote to memory of 868 4432 rundll32mgr.exe 15 PID 4432 wrote to memory of 868 4432 rundll32mgr.exe 15 PID 4432 wrote to memory of 868 4432 rundll32mgr.exe 15 PID 4432 wrote to memory of 868 4432 rundll32mgr.exe 15
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:784
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:336
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:672
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:796
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:1100
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3772
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3872
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3932
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:4024
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:2988
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:2172
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3500
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:4108
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3888
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:116
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:392
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1064
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1108
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1152
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1216
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:3056
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:3152
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1368
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1452
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2664
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1564
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1600
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1720
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1888
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1900
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1972
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1996
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2056
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2092
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2228
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2748
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2804
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2816
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3312
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3376
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7a29544a0e69d2f804a2ee90849a3e046fbaa9a61736137d54a89455f25e0d89.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7a29544a0e69d2f804a2ee90849a3e046fbaa9a61736137d54a89455f25e0d89.dll,#13⤵
- Modifies firewall policy service
- Blocklisted process makes network request
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 2725⤵
- Program crash
PID:1696
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3680
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:3948
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:2672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4432 -ip 44321⤵PID:4152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159KB
MD58703c6aeb2e62da71e50db9698d91e35
SHA1cafceda794c5b1976b46a5d39949137aba8dc9e6
SHA256c3a332de99e2b195bbb3e5927f8ee4217f968bc373f8c499db45db0b3388d47d
SHA51248e45868929fcacfa06c5078de2e54d32cfab80e5dd00036b37f3d55b33269f0ee82f46b68e7a6adc2ec9aecad8672393a77602c1b995133876c2c4e6d15229a