Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2025, 12:55
Behavioral task
behavioral1
Sample
a75835a6dc893740b6dc0eea624727181e39265f3221148c1543e8aabc6e5633N.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
a75835a6dc893740b6dc0eea624727181e39265f3221148c1543e8aabc6e5633N.dll
Resource
win10v2004-20241007-en
General
-
Target
a75835a6dc893740b6dc0eea624727181e39265f3221148c1543e8aabc6e5633N.dll
-
Size
80KB
-
MD5
85c11b1f4a4d1292f48b119c63b56a90
-
SHA1
3fdbeb5acac2246055fad8a45e1df7ff05e3480c
-
SHA256
a75835a6dc893740b6dc0eea624727181e39265f3221148c1543e8aabc6e5633
-
SHA512
15e4b90ce117f6640fbadb38b01872cc91a1bd4b55241d6cf9ae88a5591ad272d1e61bdfa2f7603b9ef5348b017683d72be3dd253193e1c28cd0b85f149ee765
-
SSDEEP
1536:5POOhfbOjovgdVydUgoNrwBZXGDaZ1QIxrfItMgR7ZaO+fGxHZPEI9z:5dbwovEVyqgoZmZXWfIdQdRaefP1z
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
pid Process 1872 arp.exe 2132 arp.exe 816 arp.exe 4192 arp.exe 3496 arp.exe 1492 arp.exe 1976 arp.exe 3644 arp.exe 4468 arp.exe -
resource yara_rule behavioral2/memory/4992-0-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/4992-2-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 320 4992 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4992 rundll32.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1064 wrote to memory of 4992 1064 rundll32.exe 83 PID 1064 wrote to memory of 4992 1064 rundll32.exe 83 PID 1064 wrote to memory of 4992 1064 rundll32.exe 83 PID 4992 wrote to memory of 3644 4992 rundll32.exe 85 PID 4992 wrote to memory of 3644 4992 rundll32.exe 85 PID 4992 wrote to memory of 3644 4992 rundll32.exe 85 PID 4992 wrote to memory of 4468 4992 rundll32.exe 88 PID 4992 wrote to memory of 4468 4992 rundll32.exe 88 PID 4992 wrote to memory of 4468 4992 rundll32.exe 88 PID 4992 wrote to memory of 1872 4992 rundll32.exe 89 PID 4992 wrote to memory of 1872 4992 rundll32.exe 89 PID 4992 wrote to memory of 1872 4992 rundll32.exe 89 PID 4992 wrote to memory of 1976 4992 rundll32.exe 90 PID 4992 wrote to memory of 1976 4992 rundll32.exe 90 PID 4992 wrote to memory of 1976 4992 rundll32.exe 90 PID 4992 wrote to memory of 1492 4992 rundll32.exe 91 PID 4992 wrote to memory of 1492 4992 rundll32.exe 91 PID 4992 wrote to memory of 1492 4992 rundll32.exe 91 PID 4992 wrote to memory of 816 4992 rundll32.exe 92 PID 4992 wrote to memory of 816 4992 rundll32.exe 92 PID 4992 wrote to memory of 816 4992 rundll32.exe 92 PID 4992 wrote to memory of 3496 4992 rundll32.exe 93 PID 4992 wrote to memory of 3496 4992 rundll32.exe 93 PID 4992 wrote to memory of 3496 4992 rundll32.exe 93 PID 4992 wrote to memory of 4192 4992 rundll32.exe 94 PID 4992 wrote to memory of 4192 4992 rundll32.exe 94 PID 4992 wrote to memory of 4192 4992 rundll32.exe 94 PID 4992 wrote to memory of 2132 4992 rundll32.exe 95 PID 4992 wrote to memory of 2132 4992 rundll32.exe 95 PID 4992 wrote to memory of 2132 4992 rundll32.exe 95
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a75835a6dc893740b6dc0eea624727181e39265f3221148c1543e8aabc6e5633N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a75835a6dc893740b6dc0eea624727181e39265f3221148c1543e8aabc6e5633N.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\arp.exearp -a3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3644
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 32-2b-d4-91-c2-383⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4468
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 62-7f-21-97-b1-a33⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1872
-
-
C:\Windows\SysWOW64\arp.exearp -s 136.243.76.173 f6-c5-c2-a1-eb-f83⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1976
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 a6-6f-3a-49-15-623⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1492
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 e9-5b-ae-7a-00-ae3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:816
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 c3-6a-33-80-78-2f3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3496
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 37-2d-68-a7-38-ee3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4192
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 38-c0-57-c8-3c-ba3⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 7123⤵
- Program crash
PID:320
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4992 -ip 49921⤵PID:1544