Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 02:21
Static task
static1
Behavioral task
behavioral1
Sample
dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe
-
Size
2.4MB
-
MD5
32b7d4dfc8b7d51c602cdbf1956eb445
-
SHA1
60fb3c6e8aa73b4ceb99cbfdf4cf34d4fcee81d5
-
SHA256
dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319
-
SHA512
7e17d658502c7f3aa0250a2a09b07e642ae1ef6cbd07768499e3907b11744dc6cbcdcd711cecd400ebf61eabcdbebfcec1439a99106c49a25f063534aebe9926
-
SSDEEP
49152:LKwdC2Uz6fIwlYXLRnTWjEwE71gmNTzsHWFgP476dDNlJwiSbKAL:LKaC2USIwl8pdmmZzk5PlxNlJwFK+
Score
9/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0009000000014138-56.dat acprotect -
Loads dropped DLL 2 IoCs
pid Process 520 dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe 520 dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\WaveToMidi 2.2\zlib.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\solo.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\w2m.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\options\guitarsolorecord.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\snack2.2\libsound.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\stop.png dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\uninstall.ini dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\CurrentSession.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\filebrowse.png dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\filebrowse.png dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\voice solo record.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\uninstall.exe dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\CurrentSession.cfg dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\CurrentSession.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\setupopt.cfg dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\snack2.2\libsnack.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\snack2.2\pkgIndex.tcl dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\start2.png dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\_ci_gentee_ dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\LLICENCIA STANDARD SOFT EN ANGLES.txt dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\options\guitar.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\record guitar2.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\options\live concert.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\piano.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\snack2.2\snackstub22.lib dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\img1283.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\LLICENCIA STANDARD SOFT EN ANGLES.txt dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\options\voice solo record.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\start2.png dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\tk83.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\options\guitar and voice.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\guitarsolorecord.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\tclmidi.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\play.png dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\snack2.2\pkgIndex.tcl dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\recordguitar.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\snack2.2\snack.tcl dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\snack2.2\libsnack.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\snack2.2\libsquare.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\tcl83.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\options\guitar solo.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\png.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\music with drums.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\voice solo.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\tclpip83.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\tk83.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\default.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\guitar solo.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\options\recordguitar.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\options\solo.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\snack2.2\libsound.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\WaveToMidi.exe dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\img1283.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\options\default.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\live concert.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\options\music with drums.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\uninstall.exe dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\WaveToMidi_Help.html dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\zlib.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File opened for modification C:\Program Files (x86)\WaveToMidi 2.2\CurrentSession.cfg dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\options\guitar.wmo dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\snack2.2\snackstub22.lib dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\tcl83.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe File created C:\Program Files (x86)\WaveToMidi 2.2\tclpip83.dll dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 520 dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe"C:\Users\Admin\AppData\Local\Temp\dbb2f397aa0d8c4597c85bfc3a3502cf7bb75ffca280960deeb5ef48e91cf319.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD54c765359ad026088738ad16be589f027
SHA13a947b1d2636a26a4fb100ffa9a42bab1252c5b0
SHA256304a1d9a196f2286933897cc7afc8ab52ef37e48abb65ecf792d3c5311a7e017
SHA5125994e65bfc0543ba02c612c7489fe1da3222f88ef39b8d000da50e342435078abc91b57844284914fc6a7e52386d510538a4492d2556e098ad2e5d23dc965a76
-
Filesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c