Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
23s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
15/03/2023, 00:37
General
-
Target
supervoicechanger-9-7-6-6.exe
-
Size
4.7MB
-
MD5
4b6b68dc27bc111303202b5984c7e4a7
-
SHA1
8bba5052ee13a9158a34892e4c8b1e9526d3b4cc
-
SHA256
1f99c907966636e8e0712d4171078ef3ad5f2fc838d690df1e17139e5744a20f
-
SHA512
047adf89ae49df27e14bbd8adf261c7fc631e02063fafa2a358fa178810c560254e58b21793074ba5b5defbc9ed2f91c0eb39739f4d777dc4bc3238a4f8b89a9
-
SSDEEP
98304:Z60sgkACFDbaIjl5ydTJEr0hIJ4xc789LgkbbLqeqO9CW1X:kDDFpA5JErJZw9L7P+TO9LB
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 3 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Program Files directory 60 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\supervoicechanger-9-7-6-6.exe"C:\Users\Admin\AppData\Local\Temp\supervoicechanger-9-7-6-6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TCS49.tmp\supervoicechanger-9-7-6-6.tmp"C:\Users\Admin\AppData\Local\Temp\is-TCS49.tmp\supervoicechanger-9-7-6-6.tmp" /SL5="$A006C,4665430,58368,C:\Users\Admin\AppData\Local\Temp\supervoicechanger-9-7-6-6.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\SuperVoiceChanger\9.7.6.6\SuperVoiceChanger.exe"C:\Program Files (x86)\SuperVoiceChanger\9.7.6.6\SuperVoiceChanger.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\SuperVoiceChanger\9.7.6.6\SoundHelper.exe"C:\Program Files (x86)\SuperVoiceChanger\9.7.6.6\SoundHelper.exe" -StartBySuperVoiceChanger4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x408 0x4781⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD507a0e51a874bd21799949da783dc8a2b
SHA15dc6bcd3b8cc5b064132d5e9ba318b3fcccdc0f0
SHA256705724176b658a64e9fc0dcd07ce33cb15e2364c6cb5f530c35541adb76e54b1
SHA512d342bbead9045c380ac9a7dbfb660c1bc7c84f39c18438fe863ffd6c2a595652e9075644986a0fbd974809c4e2af71ab3b3786d41d95d88da4c4c53d90248a9f
-
Filesize
64KB
MD507a0e51a874bd21799949da783dc8a2b
SHA15dc6bcd3b8cc5b064132d5e9ba318b3fcccdc0f0
SHA256705724176b658a64e9fc0dcd07ce33cb15e2364c6cb5f530c35541adb76e54b1
SHA512d342bbead9045c380ac9a7dbfb660c1bc7c84f39c18438fe863ffd6c2a595652e9075644986a0fbd974809c4e2af71ab3b3786d41d95d88da4c4c53d90248a9f
-
Filesize
2.0MB
MD5e4e7227128771ef7723f53a66595d87e
SHA1a8e90368e5cf914fde9d47f25118def13fb5cd71
SHA25699df6d720e26ad68cae894ede7e3ad67d558103bf53d124806ec56d96fa37a0f
SHA5128d391f547d5224136318cbdadbf0f6ee17f8ac5414a8b61b7efd7a1fdd8b4f95e7641c557f5942b885d16af2f6678956e4ef7c6d868558d4ab122df2bdea733d
-
Filesize
2.0MB
MD5e4e7227128771ef7723f53a66595d87e
SHA1a8e90368e5cf914fde9d47f25118def13fb5cd71
SHA25699df6d720e26ad68cae894ede7e3ad67d558103bf53d124806ec56d96fa37a0f
SHA5128d391f547d5224136318cbdadbf0f6ee17f8ac5414a8b61b7efd7a1fdd8b4f95e7641c557f5942b885d16af2f6678956e4ef7c6d868558d4ab122df2bdea733d
-
Filesize
456KB
MD53c0ac8c32b4f49b060b4f1bccb623864
SHA1cebd428c0b17a58a1a11b5e2ae0aea1500c9e42b
SHA2563297ad24c56b2f62e2b2ac564cc11cbbc1839e8ce073daf00b4b1a87540c8320
SHA51242dd25c71aff1ab538b2cd02301fc44d4b35f5cc1fb7de04ec051290e7ff1d117d23a329ed7055e7ef8b8092ffc7dba54d494c6db201b73614771686a5e1174c
-
Filesize
456KB
MD53c0ac8c32b4f49b060b4f1bccb623864
SHA1cebd428c0b17a58a1a11b5e2ae0aea1500c9e42b
SHA2563297ad24c56b2f62e2b2ac564cc11cbbc1839e8ce073daf00b4b1a87540c8320
SHA51242dd25c71aff1ab538b2cd02301fc44d4b35f5cc1fb7de04ec051290e7ff1d117d23a329ed7055e7ef8b8092ffc7dba54d494c6db201b73614771686a5e1174c
-
Filesize
456KB
MD53c0ac8c32b4f49b060b4f1bccb623864
SHA1cebd428c0b17a58a1a11b5e2ae0aea1500c9e42b
SHA2563297ad24c56b2f62e2b2ac564cc11cbbc1839e8ce073daf00b4b1a87540c8320
SHA51242dd25c71aff1ab538b2cd02301fc44d4b35f5cc1fb7de04ec051290e7ff1d117d23a329ed7055e7ef8b8092ffc7dba54d494c6db201b73614771686a5e1174c
-
Filesize
6KB
MD5ad3b141ea0b9dc5273c407105048701c
SHA1b3b70422b5cc1ddcea944854008591b81bdb6c27
SHA256ba091c817207369e7036a5452eeacce303caf62202cf2dfcfc61075b967f8cb6
SHA512e8b444064b7e67ac1647e154054f3b6b77b92d7253ca66e216e89401a9faddd71c3dd662d1c44d3fbef1da09c1e67a4439a15f6b541c6f872320a75911c98561
-
Filesize
2.0MB
MD5413434eb5e2b736889fea6115b6c4773
SHA176b9261ddf3a26df39805b16b9f996238982004a
SHA2565ad5f362151c40ac69f3a9dacdb9cc51d940761dfd64d9241dafc43cf240bb26
SHA512c397a13574c587810a5c4c053d3ad371d1ece9fc775696bf0fc2712dda3ae9f2a086be7ff53204ff9e9293247e8c4c123173878951ae1737868de248f5d7a208
-
Filesize
130KB
MD5888a0b6408b50905ba81c55731ad6a6f
SHA101db640791d53d6f72d638e2c6a3271c3341d708
SHA25688b542a658a00cdbbd6a2193af1b1143c8f1af4dccbd912978cbd4bfc420aac0
SHA5120c53d42684905205b4eb2d59a4306530a5e0da02827aefe1c25c8d9850922e97db4f5efad83246e460316c53140f38c9cee1da11a6d0f1b7414f3a9d735c5d57
-
Filesize
702KB
MD51afbd25db5c9a90fe05309f7c4fbcf09
SHA1baf330b5c249ca925b4ea19a52fe8b2c27e547fa
SHA2563bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
SHA5123a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
-
Filesize
702KB
MD51afbd25db5c9a90fe05309f7c4fbcf09
SHA1baf330b5c249ca925b4ea19a52fe8b2c27e547fa
SHA2563bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c
SHA5123a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
76KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
764KB
-
Filesize
84KB
-
Filesize
84KB