Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18/03/2024, 16:26
General
-
Target
Setup Omnisphere v2.8.3d.exe
-
Size
87.7MB
-
MD5
a973e6da9ccc3649a81879fdd199c482
-
SHA1
e4393a5beee6f5ae53676a66c91a527eeaa5f525
-
SHA256
46c00cfc4d02286853bad0924b95f71714f9428d3453d6769d684d9b22bb2f43
-
SHA512
8f13216378b55003f3e90eb06057352bff0f4a0872f752729acb40731e1b071101c565a0b8ece805a5c0ec55315be2a7059c081dcbc7cb47266c1ea3ee7c901d
-
SSDEEP
1572864:eHgSQgnz4BZT+pHiYKVkVqUjRnOJTkIGmAAmPYOJRXjry4xmIid3TYT5wlbjYGQ+:eHgSLYTIBOq9JAmv/jG4xVTKl3YO7Lv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup Omnisphere v2.8.3d.exe"C:\Users\Admin\AppData\Local\Temp\Setup Omnisphere v2.8.3d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SOS11.tmp\Setup Omnisphere v2.8.3d.tmp"C:\Users\Admin\AppData\Local\Temp\is-SOS11.tmp\Setup Omnisphere v2.8.3d.tmp" /SL5="$10006E,91503611,121344,C:\Users\Admin\AppData\Local\Temp\Setup Omnisphere v2.8.3d.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Spectrasonics\Omnisphere\Omnisphere.exe"C:\Program Files\Spectrasonics\Omnisphere\Omnisphere.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x494 0x5141⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5d28e1476591f73d3ea299a860083916e
SHA1920752d84f94faac5f81ef6803e8898db98d89a6
SHA256434d4eb226122a9d3548371290c73bff4b075afb75bdf07d9e334f6745b560e4
SHA512e053ca8a0fa2eff9ecb98f80527774530959c30d15e3ddfc6a07b3e06e689e44cb122e14bbc3212680b848c786282e8e9c0d320b6a7955ec08d1353aed5adffd
-
Filesize
46.4MB
MD52db60d45d805d0b73ca0b3f407280a69
SHA1e82df0174786f0dfd30147c7df86178f691b05e2
SHA2568c9076d12b51452dd7e124b07ef3346f8aa68689154af5bed9a80f2675a0c6c7
SHA51214185a2aa8a8023f33758b60073333f957d4b6beba10ff68bc9892999044455a8fdbdf1594d9807dbf266d9cdbcd3033c787f6501e83492f59c1e230a34696fd
-
Filesize
62.5MB
MD5531ba66946e699fafbda72b38a2af728
SHA193fd6eaf5cba0b9aab941b05d22fcdb487cc8692
SHA256d201567d1998e35166a35d372ddff60831d6503705e71d617dc30ad870cc8e0c
SHA512a0ab3faec8de18b148146c668a73694d022dc58186e8d3141efac323dcb0e8e829ba22bb14425ea79b601ab5284789f93db67ad8081311dbb84fab4a6bfaee0a
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD559a1566097f670d5d036db472016ebcf
SHA152566f8f3ed696791263e377073e14fdc5b77e33
SHA2565bffc47f810272b687fc89d48ece1c1a2fb794d18c80d804ee7491e309b9bc6b
SHA5124bb3a22e991c3629ba73e606d175c984988150c120abe1ec92d4447c6f0c1c9bbd79313ac31d10e2301f914041b0cef70df2f984beee8c2c1ec2bc9925659e0b
-
Filesize
573KB
MD528a286d3718a1987b17d38694b4f4d1a
SHA104a686920728a80a8035ac9813c4868de734eb9c
SHA256931f11a49d0395d434988a511923b71e0149b18e70bbd021e219e5e1cfde6e9d
SHA5123d98e9307bc5aa3e85c220dfc81275e89f4487e35f005356a2aa006e0408ed181ffa30f5281731cc4b2aaa7bf2823ad2c14e0ac3f781022b0296f820d24d3ee7
-
Filesize
719KB
MD5628840d116565bb2a5dd9cef0a6eef10
SHA15d6b94ffa1bf32448bf035cefa18100aa53b7789
SHA256975e5bd9d37a3c68d4a4b5e3002f41e6ae327be4acc25f88b1e3fcf92a35721a
SHA512757e5cbc4070273f4f47055b98eba2624aed770ddf1ac361fffb827aeff297e2f5e35e11cdeb3ecc09408498d15f7e2f9e190357677348226969d41754bdb534
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
330B
MD57e6f641dc16d76bb5248e32332d79782
SHA14154d97194b7fda6079afe87f16f7361ec8f99e7
SHA2566f73964c1ed4ad5a2018a9927b86de967aaae7167f591a1e54fa71f3d0f47d4f
SHA512e7a75cfbf5181a4f3e16ae1f1917e36ca244b924cb3c5dd8ab6f94601233b33af5d0a05cb124651899734e53e7f99df7713ae095d069985fbe04c3cf1be90ed7
-
Filesize
176B
MD56bdadd80da3f7d625e97f807edeffc31
SHA101fef5515e74e627cac2c7cd0d1d9c575786c5de
SHA256fc3d2a43a9bcbb7e6a781badd4c30adeba469f8f642105d0e207a66ee664aeaf
SHA5124e5efcab111928b1a3d7f255833f51a1b8dfb0c5deb7fc5b05ef8824c04460444adaa2f1e3efd3ca51b0679bff6329860e0524fd66aaecb4f3a542e0b4ca7492
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
464KB
-
Filesize
5.7MB
-
Filesize
148KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
148KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
148KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
192KB
-
Filesize
908KB
-
Filesize
5.7MB
-
Filesize
1.1MB
-
Filesize
908KB
-
Filesize
464KB
-
Filesize
5.7MB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
388KB
-
Filesize
1.1MB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
388KB
-
Filesize
148KB
-
Filesize
1.1MB
-
Filesize
700KB
-
Filesize
5.7MB
-
Filesize
464KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
700KB
-
Filesize
908KB
-
Filesize
880KB
-
Filesize
1.1MB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
5.7MB
-
Filesize
388KB
-
Filesize
2.1MB
-
Filesize
388KB
-
Filesize
1.1MB
-
Filesize
464KB
-
Filesize
2.1MB
-
Filesize
388KB
-
Filesize
464KB
-
Filesize
388KB
-
Filesize
1.1MB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
5.7MB
-
Filesize
880KB
-
Filesize
388KB
-
Filesize
2.1MB
-
Filesize
700KB
-
Filesize
488KB
-
Filesize
4KB
-
Filesize
388KB
-
Filesize
488KB
-
Filesize
388KB
-
Filesize
488KB
-
Filesize
388KB
-
Filesize
4KB