Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
74s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/08/2024, 00:24
Static task
static1
Behavioral task
behavioral1
Sample
FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe
-
Size
8.2MB
-
MD5
e3b14eb23cfd1bc602b59aba03a18876
-
SHA1
f03490d4c4bbb2e50177b08418276483d9b5732e
-
SHA256
9b31e2402cb27c76d56f252e3d6e1bbb4d82526eb93a0ffab7b25193f25de072
-
SHA512
7779be7e7f1944e8d9579a6650f62cf882c511a3521e877c9f156fef43ad65098e694e1f433da9ae47ad9c592a0063a0048c6614277ad7fd068b56cbc26d547c
-
SSDEEP
196608:v3whhv+OyNIAYTG3Bc8WOaEreiQpu1svc6482OQcUjEWwzd5txa:hhrImBc8W7Ew8KKjEWwzd5txa
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2088 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp -
Loads dropped DLL 1 IoCs
pid Process 2424 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files\FFmpeg For Audacity\avformat-59.dll FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File created C:\Program Files\FFmpeg For Audacity\unins000.dat FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File created C:\Program Files\FFmpeg For Audacity\is-MDUV7.tmp FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File created C:\Program Files\FFmpeg For Audacity\is-2NTSA.tmp FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File created C:\Program Files\FFmpeg For Audacity\is-IQGN1.tmp FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File opened for modification C:\Program Files\FFmpeg For Audacity\unins000.dat FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File opened for modification C:\Program Files\FFmpeg For Audacity\avutil-57.dll FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File created C:\Program Files\FFmpeg For Audacity\is-ROPE8.tmp FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File created C:\Program Files\FFmpeg For Audacity\is-LCGAT.tmp FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File created C:\Program Files\FFmpeg For Audacity\is-9REA4.tmp FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File created C:\Program Files\FFmpeg For Audacity\is-LKDT4.tmp FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File opened for modification C:\Program Files\FFmpeg For Audacity\avcodec-59.dll FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp File created C:\Program Files\FFmpeg For Audacity\is-GLTLH.tmp FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2088 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp 2088 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2844 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2844 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2088 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe 2844 taskmgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2088 2424 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe 30 PID 2424 wrote to memory of 2088 2424 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe 30 PID 2424 wrote to memory of 2088 2424 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe 30 PID 2424 wrote to memory of 2088 2424 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe 30 PID 2424 wrote to memory of 2088 2424 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe 30 PID 2424 wrote to memory of 2088 2424 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe 30 PID 2424 wrote to memory of 2088 2424 FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe"C:\Users\Admin\AppData\Local\Temp\FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\is-GSIFS.tmp\FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp"C:\Users\Admin\AppData\Local\Temp\is-GSIFS.tmp\FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp" /SL5="$50150,7726391,831488,C:\Users\Admin\AppData\Local\Temp\FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2088
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5b7b68701fda6f9f8ca9aa987647e2e45
SHA140cc2fff3b2ed1b9480aa0422748ef87729154c5
SHA256633bb75dd6bb3712c00e9746aa69a755c64c1ed4402bc5ba01b443e9437fff86
SHA512467b5d3fd0e718f39cc33b45fff2486fdc7ae93d7d8ce57ab23e9f07812223be44f4cd63e34e9142d6961f791ef881d5a4b04baf8b86a0d826ba552420cc6f18