Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1Halo (1749...5).rar
windows7-x64
3Halo (1749...5).rar
windows10-2004-x64
3Halo (1749..._store
windows7-x64
Halo (1749..._store
windows10-2004-x64
3Halo (1749...ui.map
windows7-x64
3Halo (1749...ui.map
windows10-2004-x64
3Halo (1749...rd.map
windows7-x64
3Halo (1749...rd.map
windows10-2004-x64
Analysis
-
max time kernel
236s -
max time network
661s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09/05/2023, 23:05
Static task
static1
Behavioral task
behavioral1
Sample
Halo (1749 2001-08-15).rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Halo (1749 2001-08-15).rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Halo (1749 2001-08-15)/.ds_store
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Halo (1749 2001-08-15)/.ds_store
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Halo (1749 2001-08-15)/maps/ui.map
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Halo (1749 2001-08-15)/maps/ui.map
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Halo (1749 2001-08-15)/maps/wizard.map
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Halo (1749 2001-08-15)/maps/wizard.map
Resource
win10v2004-20230221-en
General
-
Target
Halo (1749 2001-08-15).rar
-
Size
992.4MB
-
MD5
8c73bb52549d7dec604f63ccf78597db
-
SHA1
9843a5c422b37fcef6f65d54b9bdb40529460827
-
SHA256
8352abaefabf7e4d8f07059c74677ea1645cdb69def14f219230e845c4e2c908
-
SHA512
9c00a2cb852c2c23f859c2d078de1538bda16a6722f30ac3d02abb3f89497965380581f6dc00407601c4f939e6e047f2094c3f63bf6908d61ef48a36db43a30a
-
SSDEEP
25165824:F00YANZ2CWBOem3uXaBpd2Y45XJt5aNtbrV8EU6zoyYlBX2H:FBNZdSOejqBpzO3sHnq9Wodla
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 900 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 900 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 900 vlc.exe 900 vlc.exe 900 vlc.exe 900 vlc.exe 900 vlc.exe 900 vlc.exe 900 vlc.exe 900 vlc.exe 900 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 900 vlc.exe 900 vlc.exe 900 vlc.exe 900 vlc.exe 900 vlc.exe 900 vlc.exe 900 vlc.exe 900 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 900 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 328 wrote to memory of 2032 328 cmd.exe 27 PID 328 wrote to memory of 2032 328 cmd.exe 27 PID 328 wrote to memory of 2032 328 cmd.exe 27 PID 2032 wrote to memory of 900 2032 rundll32.exe 28 PID 2032 wrote to memory of 900 2032 rundll32.exe 28 PID 2032 wrote to memory of 900 2032 rundll32.exe 28
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Halo (1749 2001-08-15).rar"1⤵
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Halo (1749 2001-08-15).rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Halo (1749 2001-08-15).rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:900
-
-