Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 21:27

General

  • Target

    Native.Instruments.Guitar.Rig.7.v7.0.2.Incl.Patched.and.Keygen.REPACK-R2R/r2r13428.rar

  • Size

    47.7MB

  • MD5

    d2c965c1fd500104e9ea1c22fd1ac1dd

  • SHA1

    e3cd9e59d55a847672e56bfb9bf8b655e0aecb27

  • SHA256

    0926179fd09b448cd6895385b79aa3fe277012a4f84219f60a2c358af1b37024

  • SHA512

    2f5952c32f965f5bcce66a3046ea0c5ffa9a1a906e07f595dbb19e1aa7cfe87092c20e682f45a0f68faeda3f0f151aeeb79a6f698919e25fc66d9dacdbcfcd10

  • SSDEEP

    786432:S5HYH8l709mnJTjE8xhty2/12I/d3YCmekBaAJOEnmR/d1VXzm+fWoY+IYUqVQ:SNle8JU8E/I1YCm3wOOOmRhzm+fWCI5

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Native.Instruments.Guitar.Rig.7.v7.0.2.Incl.Patched.and.Keygen.REPACK-R2R\r2r13428.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Native.Instruments.Guitar.Rig.7.v7.0.2.Incl.Patched.and.Keygen.REPACK-R2R\r2r13428.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Native.Instruments.Guitar.Rig.7.v7.0.2.Incl.Patched.and.Keygen.REPACK-R2R\r2r13428.rar
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2732
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Native.Instruments.Guitar.Rig.7.v7.0.2.Incl.Patched.and.Keygen.REPACK-R2R\r2r13428.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2220-30-0x000007FEFB370000-0x000007FEFB3A4000-memory.dmp

    Filesize

    208KB

  • memory/2220-29-0x000000013F370000-0x000000013F468000-memory.dmp

    Filesize

    992KB

  • memory/2220-32-0x000007FEFB350000-0x000007FEFB368000-memory.dmp

    Filesize

    96KB

  • memory/2220-33-0x000007FEFB330000-0x000007FEFB347000-memory.dmp

    Filesize

    92KB

  • memory/2220-34-0x000007FEFB310000-0x000007FEFB321000-memory.dmp

    Filesize

    68KB

  • memory/2220-35-0x000007FEFB2F0000-0x000007FEFB307000-memory.dmp

    Filesize

    92KB

  • memory/2220-36-0x000007FEFABE0000-0x000007FEFABF1000-memory.dmp

    Filesize

    68KB

  • memory/2220-31-0x000007FEF69D0000-0x000007FEF6C86000-memory.dmp

    Filesize

    2.7MB

  • memory/2220-37-0x000007FEF8470000-0x000007FEF848D000-memory.dmp

    Filesize

    116KB

  • memory/2220-38-0x000007FEF76B0000-0x000007FEF76C1000-memory.dmp

    Filesize

    68KB

  • memory/2220-46-0x000007FEF7120000-0x000007FEF7131000-memory.dmp

    Filesize

    68KB

  • memory/2220-40-0x000007FEF6540000-0x000007FEF674B000-memory.dmp

    Filesize

    2.0MB

  • memory/2220-41-0x000007FEF7660000-0x000007FEF76A1000-memory.dmp

    Filesize

    260KB

  • memory/2220-43-0x000007FEF7610000-0x000007FEF7628000-memory.dmp

    Filesize

    96KB

  • memory/2220-45-0x000007FEF7140000-0x000007FEF7151000-memory.dmp

    Filesize

    68KB

  • memory/2220-44-0x000007FEF7160000-0x000007FEF7171000-memory.dmp

    Filesize

    68KB

  • memory/2220-48-0x000007FEF6F70000-0x000007FEF6F81000-memory.dmp

    Filesize

    68KB

  • memory/2220-50-0x000007FEF6F20000-0x000007FEF6F50000-memory.dmp

    Filesize

    192KB

  • memory/2220-49-0x000007FEF6F50000-0x000007FEF6F68000-memory.dmp

    Filesize

    96KB

  • memory/2220-47-0x000007FEF7100000-0x000007FEF711B000-memory.dmp

    Filesize

    108KB

  • memory/2220-58-0x000007FEF6430000-0x000007FEF6453000-memory.dmp

    Filesize

    140KB

  • memory/2220-60-0x000007FEF63F0000-0x000007FEF6402000-memory.dmp

    Filesize

    72KB

  • memory/2220-59-0x000007FEF6410000-0x000007FEF6421000-memory.dmp

    Filesize

    68KB

  • memory/2220-57-0x000007FEF6460000-0x000007FEF6478000-memory.dmp

    Filesize

    96KB

  • memory/2220-56-0x000007FEF6480000-0x000007FEF64A4000-memory.dmp

    Filesize

    144KB

  • memory/2220-55-0x000007FEF64B0000-0x000007FEF64D8000-memory.dmp

    Filesize

    160KB

  • memory/2220-54-0x000007FEF64E0000-0x000007FEF6537000-memory.dmp

    Filesize

    348KB

  • memory/2220-53-0x000007FEF6DA0000-0x000007FEF6DB1000-memory.dmp

    Filesize

    68KB

  • memory/2220-52-0x000007FEF6DC0000-0x000007FEF6E3C000-memory.dmp

    Filesize

    496KB

  • memory/2220-51-0x000007FEF6E40000-0x000007FEF6EA7000-memory.dmp

    Filesize

    412KB

  • memory/2220-42-0x000007FEF7630000-0x000007FEF7651000-memory.dmp

    Filesize

    132KB

  • memory/2220-39-0x000007FEF4CB0000-0x000007FEF5D60000-memory.dmp

    Filesize

    16.7MB