Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18/03/2024, 16:26

General

  • Target

    Setup Omnisphere v2.8.3d.exe

  • Size

    87.7MB

  • MD5

    a973e6da9ccc3649a81879fdd199c482

  • SHA1

    e4393a5beee6f5ae53676a66c91a527eeaa5f525

  • SHA256

    46c00cfc4d02286853bad0924b95f71714f9428d3453d6769d684d9b22bb2f43

  • SHA512

    8f13216378b55003f3e90eb06057352bff0f4a0872f752729acb40731e1b071101c565a0b8ece805a5c0ec55315be2a7059c081dcbc7cb47266c1ea3ee7c901d

  • SSDEEP

    1572864:eHgSQgnz4BZT+pHiYKVkVqUjRnOJTkIGmAAmPYOJRXjry4xmIid3TYT5wlbjYGQ+:eHgSLYTIBOq9JAmv/jG4xVTKl3YO7Lv

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup Omnisphere v2.8.3d.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup Omnisphere v2.8.3d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Users\Admin\AppData\Local\Temp\is-BMHOT.tmp\Setup Omnisphere v2.8.3d.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BMHOT.tmp\Setup Omnisphere v2.8.3d.tmp" /SL5="$70120,91503611,121344,C:\Users\Admin\AppData\Local\Temp\Setup Omnisphere v2.8.3d.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-BMHOT.tmp\Setup Omnisphere v2.8.3d.tmp

    Filesize

    1.1MB

    MD5

    34acc2bdb45a9c436181426828c4cb49

    SHA1

    5adaa1ac822e6128b8d4b59a54d19901880452ae

    SHA256

    9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07

    SHA512

    134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

  • \Users\Admin\AppData\Local\Temp\is-87VT9.tmp\ISSKINU.DLL

    Filesize

    357KB

    MD5

    f30afccd6fafc1cad4567ada824c9358

    SHA1

    60a65b72f208563f90fba0da6af013a36707caa9

    SHA256

    e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d

    SHA512

    59b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c

  • \Users\Admin\AppData\Local\Temp\is-87VT9.tmp\R2RINNO.dll

    Filesize

    4KB

    MD5

    59a1566097f670d5d036db472016ebcf

    SHA1

    52566f8f3ed696791263e377073e14fdc5b77e33

    SHA256

    5bffc47f810272b687fc89d48ece1c1a2fb794d18c80d804ee7491e309b9bc6b

    SHA512

    4bb3a22e991c3629ba73e606d175c984988150c120abe1ec92d4447c6f0c1c9bbd79313ac31d10e2301f914041b0cef70df2f984beee8c2c1ec2bc9925659e0b

  • \Users\Admin\AppData\Local\Temp\is-87VT9.tmp\SKIN.CJSTYLES

    Filesize

    813KB

    MD5

    5f87caf3f7cf63dde8e6af53bdf31289

    SHA1

    a2c3cc3d9d831acd797155b667db59a32000d7a8

    SHA256

    4731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940

    SHA512

    4875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d

  • \Users\Admin\AppData\Local\Temp\is-BMHOT.tmp\Setup Omnisphere v2.8.3d.tmp

    Filesize

    284KB

    MD5

    0827205aa9b381df3aac3fe9208eff4b

    SHA1

    0932f4ed8020f26963a79cb74a9bb165323d4789

    SHA256

    809318cd6aaa27967c38d8093453f374daa53afaf9c22ce5f3717a79700d4f84

    SHA512

    b2644db448aa037267a6ebbc49c2cc655446682df4c8b829cbb4170ac588e60ab8fc8ce13f82166f181f0882220f055a7b8dd1ddfd1d6cdd5d6a24e5f878b56d

  • memory/1176-0-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1176-278-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2016-48-0x0000000074BD0000-0x0000000074C09000-memory.dmp

    Filesize

    228KB

  • memory/2016-54-0x0000000077540000-0x00000000775E0000-memory.dmp

    Filesize

    640KB

  • memory/2016-20-0x00000000763D0000-0x000000007652C000-memory.dmp

    Filesize

    1.4MB

  • memory/2016-21-0x0000000077540000-0x00000000775E0000-memory.dmp

    Filesize

    640KB

  • memory/2016-22-0x0000000075F80000-0x000000007601D000-memory.dmp

    Filesize

    628KB

  • memory/2016-23-0x0000000076020000-0x0000000076077000-memory.dmp

    Filesize

    348KB

  • memory/2016-24-0x0000000076880000-0x00000000774CA000-memory.dmp

    Filesize

    12.3MB

  • memory/2016-25-0x0000000074EB0000-0x0000000074EE8000-memory.dmp

    Filesize

    224KB

  • memory/2016-26-0x0000000074D20000-0x0000000074E3F000-memory.dmp

    Filesize

    1.1MB

  • memory/2016-27-0x0000000074C90000-0x0000000074D1C000-memory.dmp

    Filesize

    560KB

  • memory/2016-28-0x00000000754D0000-0x00000000754FA000-memory.dmp

    Filesize

    168KB

  • memory/2016-29-0x0000000074C50000-0x0000000074C82000-memory.dmp

    Filesize

    200KB

  • memory/2016-30-0x0000000074AD0000-0x0000000074BC5000-memory.dmp

    Filesize

    980KB

  • memory/2016-31-0x0000000075DE0000-0x0000000075F7D000-memory.dmp

    Filesize

    1.6MB

  • memory/2016-32-0x0000000010000000-0x0000000010061000-memory.dmp

    Filesize

    388KB

  • memory/2016-33-0x0000000075A00000-0x0000000075A8F000-memory.dmp

    Filesize

    572KB

  • memory/2016-34-0x00000000763D0000-0x000000007652C000-memory.dmp

    Filesize

    1.4MB

  • memory/2016-35-0x0000000077540000-0x00000000775E0000-memory.dmp

    Filesize

    640KB

  • memory/2016-36-0x0000000075270000-0x0000000075279000-memory.dmp

    Filesize

    36KB

  • memory/2016-37-0x0000000075020000-0x00000000751BE000-memory.dmp

    Filesize

    1.6MB

  • memory/2016-38-0x0000000076020000-0x0000000076077000-memory.dmp

    Filesize

    348KB

  • memory/2016-39-0x0000000076880000-0x00000000774CA000-memory.dmp

    Filesize

    12.3MB

  • memory/2016-40-0x0000000075AA0000-0x0000000075B1B000-memory.dmp

    Filesize

    492KB

  • memory/2016-43-0x0000000075960000-0x00000000759E3000-memory.dmp

    Filesize

    524KB

  • memory/2016-44-0x0000000074EB0000-0x0000000074EE8000-memory.dmp

    Filesize

    224KB

  • memory/2016-45-0x0000000074E90000-0x0000000074EA7000-memory.dmp

    Filesize

    92KB

  • memory/2016-46-0x0000000074D20000-0x0000000074E3F000-memory.dmp

    Filesize

    1.1MB

  • memory/2016-15-0x0000000010000000-0x0000000010061000-memory.dmp

    Filesize

    388KB

  • memory/2016-47-0x0000000074C50000-0x0000000074C82000-memory.dmp

    Filesize

    200KB

  • memory/2016-49-0x0000000074AD0000-0x0000000074BC5000-memory.dmp

    Filesize

    980KB

  • memory/2016-19-0x0000000075A00000-0x0000000075A8F000-memory.dmp

    Filesize

    572KB

  • memory/2016-50-0x0000000075DE0000-0x0000000075F7D000-memory.dmp

    Filesize

    1.6MB

  • memory/2016-58-0x0000000076020000-0x0000000076077000-memory.dmp

    Filesize

    348KB

  • memory/2016-51-0x0000000074A40000-0x0000000074A76000-memory.dmp

    Filesize

    216KB

  • memory/2016-53-0x0000000075A00000-0x0000000075A8F000-memory.dmp

    Filesize

    572KB

  • memory/2016-55-0x0000000075F80000-0x000000007601D000-memory.dmp

    Filesize

    628KB

  • memory/2016-56-0x0000000074F30000-0x0000000074F42000-memory.dmp

    Filesize

    72KB

  • memory/2016-57-0x0000000075020000-0x00000000751BE000-memory.dmp

    Filesize

    1.6MB

  • memory/2016-59-0x0000000075AA0000-0x0000000075B1B000-memory.dmp

    Filesize

    492KB

  • memory/2016-61-0x0000000075280000-0x0000000075293000-memory.dmp

    Filesize

    76KB

  • memory/2016-52-0x0000000010000000-0x0000000010061000-memory.dmp

    Filesize

    388KB

  • memory/2016-62-0x0000000075960000-0x00000000759E3000-memory.dmp

    Filesize

    524KB

  • memory/2016-63-0x0000000074C90000-0x0000000074D1C000-memory.dmp

    Filesize

    560KB

  • memory/2016-65-0x0000000074BD0000-0x0000000074C09000-memory.dmp

    Filesize

    228KB

  • memory/2016-64-0x0000000074C50000-0x0000000074C82000-memory.dmp

    Filesize

    200KB

  • memory/2016-66-0x0000000074AD0000-0x0000000074BC5000-memory.dmp

    Filesize

    980KB

  • memory/2016-68-0x0000000076550000-0x0000000076577000-memory.dmp

    Filesize

    156KB

  • memory/2016-71-0x0000000075270000-0x0000000075279000-memory.dmp

    Filesize

    36KB

  • memory/2016-70-0x0000000077540000-0x00000000775E0000-memory.dmp

    Filesize

    640KB

  • memory/2016-69-0x0000000010000000-0x0000000010061000-memory.dmp

    Filesize

    388KB

  • memory/2016-67-0x0000000075DE0000-0x0000000075F7D000-memory.dmp

    Filesize

    1.6MB

  • memory/2016-72-0x0000000074F30000-0x0000000074F42000-memory.dmp

    Filesize

    72KB

  • memory/2016-73-0x0000000075020000-0x00000000751BE000-memory.dmp

    Filesize

    1.6MB

  • memory/2016-77-0x0000000074C90000-0x0000000074D1C000-memory.dmp

    Filesize

    560KB

  • memory/2016-79-0x0000000074BD0000-0x0000000074C09000-memory.dmp

    Filesize

    228KB

  • memory/2016-78-0x0000000074C50000-0x0000000074C82000-memory.dmp

    Filesize

    200KB

  • memory/2016-76-0x0000000075960000-0x00000000759E3000-memory.dmp

    Filesize

    524KB

  • memory/2016-74-0x0000000076020000-0x0000000076077000-memory.dmp

    Filesize

    348KB

  • memory/2016-80-0x0000000074AD0000-0x0000000074BC5000-memory.dmp

    Filesize

    980KB

  • memory/2016-81-0x0000000075DE0000-0x0000000075F7D000-memory.dmp

    Filesize

    1.6MB

  • memory/2016-82-0x0000000074A40000-0x0000000074A76000-memory.dmp

    Filesize

    216KB

  • memory/2016-83-0x0000000010000000-0x0000000010061000-memory.dmp

    Filesize

    388KB

  • memory/2016-7-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2016-279-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB