Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

ML_Sound_L...A].exe

windows7-x64

7

ML_Sound_L...A].exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2024, 17:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ML_Sound_Lab_Amped_-_Fluff_2C_1.0.0_WiN_[MOCHA].exe

  • Size

    20.3MB

  • MD5

    388c5d8dfc0b014496434bdab68ead65

  • SHA1

    186e63395d47d6b60fbf5b22a3afc17ff7ab9f4a

  • SHA256

    8807e02e98ee46320cfeb677bdb1b16ad01c6d28243a338061de9363f1a138a1

  • SHA512

    7d0ab1660e4e9767a16389efa6aa7c05d8e066f357aab42126a8c93c42dc1a88915a10c429f6ac608de68a24b6cd58618ea4aef90ed57250f7034626f132fbfe

  • SSDEEP

    393216:DUdN8+/ZQMj/QFnC+o27aWo/LjCK8W01jFBn0nubEXFfsj/e3zx04K/tWaehGlu:D45RQZnC+KXzZFeFBncsuN01tWaIGc

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ML_Sound_Lab_Amped_-_Fluff_2C_1.0.0_WiN_[MOCHA].exe
    "C:\Users\Admin\AppData\Local\Temp\ML_Sound_Lab_Amped_-_Fluff_2C_1.0.0_WiN_[MOCHA].exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Users\Admin\AppData\Local\Temp\is-NR419.tmp\ML_Sound_Lab_Amped_-_Fluff_2C_1.0.0_WiN_[MOCHA].tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NR419.tmp\ML_Sound_Lab_Amped_-_Fluff_2C_1.0.0_WiN_[MOCHA].tmp" /SL5="$40150,20434655,898560,C:\Users\Admin\AppData\Local\Temp\ML_Sound_Lab_Amped_-_Fluff_2C_1.0.0_WiN_[MOCHA].exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-NR419.tmp\ML_Sound_Lab_Amped_-_Fluff_2C_1.0.0_WiN_[MOCHA].tmp
    Filesize

    470KB

    MD5

    eb0f57c45678f38f2eb9fab4d7ecdb00

    SHA1

    df633167aafda59dea4aca786c51afd6681f77dd

    SHA256

    9b1439a7b38a824d807c8317939876ff4424754c1fbc4703258aa4dcfc22c7c7

    SHA512

    971603fe94608ed1486f98b0c5a605deb0ff33d9666d3996f3f99e88d74bb8681e1933ee2b6840ee11ae7b0b2e06605a3a32607a045e0061806716d2cb9b39e8

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-NR419.tmp\ML_Sound_Lab_Amped_-_Fluff_2C_1.0.0_WiN_[MOCHA].tmp
    Filesize

    1.1MB

    MD5

    8eea675547a9cf88bd9e45a8f43061ed

    SHA1

    1cf05da29656887776e066cf2ab92f8a209c01b9

    SHA256

    2078f0c0f5f0c0b08caeab80f1077ac6169e3440645ae3430f1be828b1816be6

    SHA512

    a0b10cfe18b625d56caafc516f1e502a0a30c43e2ad2945eff3a60e2b2eaef968ae43128359aee49fbd082c19ee307eeec1966723e4692589f2fa705521ef71c

    Download Submit

  • memory/1104-1-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download

  • memory/1104-10-0x0000000000400000-0x00000000004E9000-memory.dmp

    Filesize

    932KB

    Download

  • memory/1664-8-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1664-11-0x0000000000400000-0x0000000000724000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/1664-14-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

    Download