Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
22/03/2023, 21:44
General
-
Target
FabFilter Total Bundle v2020.05.18 WIN/Setup FabFilter Total Bundle v2020.05.18.exe
-
Size
34.7MB
-
MD5
210b1ca457126bc2ae64c444efdd4fd7
-
SHA1
371713fb69fecc495e435db6ceb4b2f057ae39c1
-
SHA256
23770671feaf22bac335c523c15e875d89c80af6c6edb6294e134bedc4b4f823
-
SHA512
0e289cf570f35f2cefe6fcafb932eceae484a399f643b4631c8a1886c004b89b224b9d0db4d6d78538f675a40cc39c5c775298595ef61f977caeff569ee11112
-
SSDEEP
786432:BYu125JawuvFYRrQDXyW66yCsX0q+WpAgW2nHH11gQxeh:uuIHkviRrgiL6ybB79n11gQsh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 47 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FabFilter Total Bundle v2020.05.18 WIN\Setup FabFilter Total Bundle v2020.05.18.exe"C:\Users\Admin\AppData\Local\Temp\FabFilter Total Bundle v2020.05.18 WIN\Setup FabFilter Total Bundle v2020.05.18.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-K6L0L.tmp\Setup FabFilter Total Bundle v2020.05.18.tmp"C:\Users\Admin\AppData\Local\Temp\is-K6L0L.tmp\Setup FabFilter Total Bundle v2020.05.18.tmp" /SL5="$70122,35976789,407040,C:\Users\Admin\AppData\Local\Temp\FabFilter Total Bundle v2020.05.18 WIN\Setup FabFilter Total Bundle v2020.05.18.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5efca76c8036622c459a97a29fb999a4e
SHA1bf3f1aa664942f03fd8458f49a5fb92853ef836c
SHA256ad1b2414bd9bb475b2b6bdfea72c9be4cca50544ecffdd7298e9b47a2a01ceff
SHA512f051a1d32e0b39cac89d5de91802b70e81d5aba8e10601b0540f5bf0579b446f3080408cc39884508e390b58715c9a69b98e3575e9adc7ecde7e72b95b3c9636
-
Filesize
1.4MB
MD5efca76c8036622c459a97a29fb999a4e
SHA1bf3f1aa664942f03fd8458f49a5fb92853ef836c
SHA256ad1b2414bd9bb475b2b6bdfea72c9be4cca50544ecffdd7298e9b47a2a01ceff
SHA512f051a1d32e0b39cac89d5de91802b70e81d5aba8e10601b0540f5bf0579b446f3080408cc39884508e390b58715c9a69b98e3575e9adc7ecde7e72b95b3c9636
-
Filesize
1.4MB
MD5a7f26924d72ba01334b874d96befdf6f
SHA16a537a63453f3a2e7addc69020e1dfc7ec14a18e
SHA2567d38da59d6fddc6f4880a84aa7bf581503e0fd04e983ae801afcf839a6735416
SHA512275bb89e2452aed6dc488fdfec41cb0f50921dd3804150230bd7447748ef0d543074239ebc61799090d3036418d756430aa00d5c76afa1fff18de237d66ca01f
-
Filesize
1.4MB
MD5efca76c8036622c459a97a29fb999a4e
SHA1bf3f1aa664942f03fd8458f49a5fb92853ef836c
SHA256ad1b2414bd9bb475b2b6bdfea72c9be4cca50544ecffdd7298e9b47a2a01ceff
SHA512f051a1d32e0b39cac89d5de91802b70e81d5aba8e10601b0540f5bf0579b446f3080408cc39884508e390b58715c9a69b98e3575e9adc7ecde7e72b95b3c9636
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD50f8bbab51c5f70093b7ed7dd825d68e8
SHA1a96809560b3e9001124083937a339cf2453a94c8
SHA2567fc4fa7f5cea34df0a6733527081886cfb1c49b369df2db454de87cc4e70bdb5
SHA5127b824ad5d7ec786535106d98bc80c9350f35ac2b76d7ee20163e90becf076dfeaca4732c0ecbe2d3d84a2efef337c380d5548ca0123e69e66e30bb396f0b9b81
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
1.1MB
-
Filesize
388KB
-
Filesize
572KB
-
Filesize
1.4MB
-
Filesize
640KB
-
Filesize
628KB
-
Filesize
348KB
-
Filesize
12.3MB
-
Filesize
224KB
-
Filesize
1.1MB
-
Filesize
560KB
-
Filesize
168KB
-
Filesize
200KB
-
Filesize
980KB
-
Filesize
1.6MB
-
Filesize
388KB
-
Filesize
572KB
-
Filesize
1.4MB
-
Filesize
36KB
-
Filesize
640KB
-
Filesize
1.6MB
-
Filesize
348KB
-
Filesize
12.3MB
-
Filesize
492KB
-
Filesize
524KB
-
Filesize
224KB
-
Filesize
92KB
-
Filesize
388KB
-
Filesize
200KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
980KB
-
Filesize
492KB
-
Filesize
1.6MB
-
Filesize
572KB
-
Filesize
640KB
-
Filesize
628KB
-
Filesize
72KB
-
Filesize
1.6MB
-
Filesize
348KB
-
Filesize
216KB
-
Filesize
76KB
-
Filesize
524KB
-
Filesize
560KB
-
Filesize
200KB
-
Filesize
228KB
-
Filesize
980KB
-
Filesize
1.6MB
-
Filesize
156KB
-
Filesize
388KB
-
Filesize
640KB
-
Filesize
36KB
-
Filesize
72KB
-
Filesize
1.6MB
-
Filesize
348KB
-
Filesize
524KB
-
Filesize
560KB
-
Filesize
200KB
-
Filesize
228KB
-
Filesize
980KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
388KB
-
Filesize
436KB