Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
27/06/2024, 16:47
General
-
Target
Setup Melodyne 5 v5.3.1.018.exe
-
Size
26.2MB
-
MD5
2584356e8819648ff3af649a0308ad2f
-
SHA1
56e79b43cfba771b1133ff34446d78e78b5b047f
-
SHA256
18cdf7ac320afc9ee28bff68478fd6f373b956873c82692bcb88c6db01a3809c
-
SHA512
01ae0d32ff1da04fee472b9b9c46d7e195a43d8dd1a92398a2cf237e2743490d706cc4dc84366ebe2657f9a33dd5233bfcdb485079b266ee7bcc8b4cb7f234ef
-
SSDEEP
786432:qBYwnSDSIyWc/fZhtq4H1xyXVPPzC5ujDZp3EuW:qVSDSF1qRVHz2ujDv3EuW
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 23 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 24 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup Melodyne 5 v5.3.1.018.exe"C:\Users\Admin\AppData\Local\Temp\Setup Melodyne 5 v5.3.1.018.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-R5S3N.tmp\Setup Melodyne 5 v5.3.1.018.tmp"C:\Users\Admin\AppData\Local\Temp\is-R5S3N.tmp\Setup Melodyne 5 v5.3.1.018.tmp" /SL5="$70122,27026197,121344,C:\Users\Admin\AppData\Local\Temp\Setup Melodyne 5 v5.3.1.018.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Program Files\Celemony\Melodyne 5\Melodyne.exe"C:\Program Files\Celemony\Melodyne 5\Melodyne.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\SndVol.exeSndVol.exe -f 45679771 25771⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD502b23694228b25bc01c9fbeb4ddd27cc
SHA156b240f5165df6cd7158173bca614fd443fb6de5
SHA256b13b16bd9e63db2f1445d2082cf2cc673be3231b867565f6a6469d8ee567ada0
SHA5121afc701d09646efbedbcd318aabecb552d83acb707e05525219bd3c9b4c6897a25b47bedeeef77c9ccebd49ce6ee120555ac4988cb810c84be249cae34cfb4ba
-
Filesize
2KB
MD51d5e11bd68dd8e895e67744116c0f540
SHA1ec9453a101b48f8006bc2a38ec185370f018b183
SHA256a25011f003d6e47ae3f032fc20fd56a7557ec2de6fb327eaa2ccc5bf78412185
SHA512c4ec2a16a3f6ac8fb7a27639465370e7833df5905db60f2604c529924c2283c722fb85b83bab4c989a06e2eab63cb3661c92e5ec4c681fd5f8cb144075c64ea9
-
Filesize
2KB
MD5f1fab0ea1e9188f6621947d091bfe96d
SHA158372e4780f68285737574a059f29701eeb1d8db
SHA25601951bf1c2be95d341e260c4ca1acd115530f629aecface090654f0e447ca202
SHA512e153c0ecd90ca546871d0ac323893e8f83c99b5a151d8cf34032e294837e470bb29950bc1922946faf50cbf8ba145d60b36d8e92337bad7a74507e9331f95c6a
-
Filesize
3KB
MD525e54e8fefe018b7f036edb0bbbb53d4
SHA1ccb571ff1cd8183006dca91544c87f0bdbf3b09a
SHA2563898e7fcd30d862bf366a9683464738b9ba7fd6bdd2e5f69547da5e7b0c40dd6
SHA51222c92cb540de8e63ea7b6773aac602380558d4f6f6769aef2ad35c1e03f8e852abdeee3c1cbec5afb33a077c1f65bd664d4000ba2f37536191e448ef1e8f887f
-
Filesize
1.5MB
MD52e3b53559229c2f9e0d1845e536f5a55
SHA1424a9e9e71f8b70b142c005c6fb67e17cc2f40dc
SHA256a17a106e90bd010dbdea66fff1d9f27db87c565c98637662c869473c7dff2ec2
SHA512ac9276e0437c9c9bd04c8e4993eec1e4d7f79a184b95a00fbeed6df2d8ccc349d92a2434470a9304518f9806ca389eb37865fd76973b9195b19a8fb0e4c01b37
-
Filesize
1.2MB
MD5aa38081196c06c97ffa2827898895e8f
SHA19842bbfea25dfc49147cc5b42ff4466341b64c7b
SHA2562822515882a6044703ea560a9124229c4791706c154ab6dea1162cd475298c4e
SHA5125d4cf8b0517f973cb2f1822f411d979f7acc043c1cf0c39ba9908349521f0697e0e05e0908eec467ead2bd6e90887b4050920234386da5684228771941b2d6ec
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD55df8ada84a16f5dfc24096ef90a5ce3a
SHA15e7e9c68119c3a0a1afc92c60674bc8714492823
SHA25648a9c8c332fde541b571d9d522d0e37834b452f55af8cbdc341b12222e78fb5b
SHA512661b5219c74dd6e3a8e899a1b1a3002689d148e337d7323a174519366c9548c284ee76e2faa2f9600cd483db21093ee62399f0d7403c39523c654266760191c2
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
160KB
-
Filesize
68KB
-
Filesize
1.6MB
-
Filesize
524KB
-
Filesize
348KB
-
Filesize
1.1MB
-
Filesize
12.3MB
-
Filesize
980KB
-
Filesize
200KB
-
Filesize
168KB
-
Filesize
560KB
-
Filesize
224KB
-
Filesize
36KB
-
Filesize
640KB
-
Filesize
1.4MB
-
Filesize
572KB
-
Filesize
388KB
-
Filesize
1.6MB
-
Filesize
12.3MB
-
Filesize
492KB
-
Filesize
348KB
-
Filesize
1.6MB
-
Filesize
200KB
-
Filesize
1.1MB
-
Filesize
92KB
-
Filesize
224KB
-
Filesize
1.4MB
-
Filesize
228KB
-
Filesize
1.6MB
-
Filesize
980KB
-
Filesize
228KB
-
Filesize
200KB
-
Filesize
560KB
-
Filesize
628KB
-
Filesize
348KB
-
Filesize
1.6MB
-
Filesize
72KB
-
Filesize
36KB
-
Filesize
640KB
-
Filesize
388KB
-
Filesize
156KB
-
Filesize
1.6MB
-
Filesize
980KB
-
Filesize
200KB
-
Filesize
524KB
-
Filesize
560KB
-
Filesize
76KB
-
Filesize
492KB
-
Filesize
348KB
-
Filesize
628KB
-
Filesize
1.6MB
-
Filesize
72KB
-
Filesize
640KB
-
Filesize
572KB
-
Filesize
388KB
-
Filesize
216KB
-
Filesize
980KB
-
Filesize
228KB
-
Filesize
640KB
-
Filesize
524KB
-
Filesize
1.2MB
-
Filesize
572KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
1.2MB