Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 10:19
Static task
static1
Behavioral task
behavioral1
Sample
MelonLoader.Installer.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
MelonLoader.Installer.exe
Resource
win10v2004-20240802-en
General
-
Target
MelonLoader.Installer.exe
-
Size
721KB
-
MD5
54dff09cc998adac8e2b325fd2714230
-
SHA1
31592045226b7546cebc871b13941dce602dce3b
-
SHA256
ad3015fcf72af7fa32386e2d584ddc00ba10fef82e84b4f57adafb6183177542
-
SHA512
2e1c61e674144b96bf7bd76f260b532610f9745b8f653e9036e1c71fb6f61123ef57285503c3fc893783b89f8943558ca647e31c4fd53cbdb70de7f4da91f2f0
-
SSDEEP
12288:LL2odKsoH3msuTmlOIq76xb35zdtKTKKpKKMp:lO5gEMWx35p
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MelonLoader.Installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor DllHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DllHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DllHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor DllHost.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0 = 750500004505811914101b0520000000006000000000000000000000000000000000000000000000000000010000490000003153505330f125b7ef471a10a5f102608c9eebac2d0000000a000000001f0000000d000000530061006d0070006c00650020004d00750073006900630000000000000000003100000031535053b1166d44ad8d7048a748402ea43d788c15000000640000000015000000cc06e22d8cf1288a000000002900000031535053f4767d7a30b6d74b95ff37cc51a975c90d00000002000000000100000000000000a802000031535053a66a63283d95d211b5d600c04fd918d0110000001900000000130000007f018070290200002000000000111000001502000014001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000007400310000000000e55873491100557365727300600008000400efbeee3a851ae55873492a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d00320031003800310033000000140078003100000000008c3e854311005075626c69630000620008000400efbeee3a851a8c3e85432a0000007c0200000000010000000000000000003800000000005000750062006c0069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003600000016007400310000000000ee3acd2611004d7573696300600008000400efbeee3a851aee3acc262a000000820200000000010000000000000000003600000000004d007500730069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380030003300000014008600310000000000ee3acd26110053414d504c457e3100006e0008000400efbeee3a142cee3a142c2a00000083020000000001000000000000000000440000000000530061006d0070006c00650020004d007500730069006300000040007300680065006c006c00330032002e0064006c006c002c002d00320031003800300036000000180000000000002d00000018000000001f0000000d000000530061006d0070006c00650020004d00750073006900630000000000250000000b000000001f0000000a0000004400690072006500630074006f00720079000000000000002d00000031535053901c6949177e1a10a91c08002b2ecda9110000000300000000030000000000000000000000200100003153505340e83e1e2bbc6c4782372acd1a839b225900000008000000001f0000002300000043003a005c00550073006500720073005c005000750062006c00690063005c004d0075007300690063005c00530061006d0070006c00650020004d007500730069006300000000002500000003000000001f100000010000000700000066006f006c006400650072000000000011000000140000000003000000010000007500000011000000001f000000310000007b00310036003800350044003400410042002d0041003500310042002d0034004100460031002d0041003400450035002d004300450045003800370030003000320034003300310044007d002e004d006500720067006500200041006e00790000000000000000002900000031535053fcb3b4b9512b424ab5d8324146afcf250d0000000800000000010000000000000029000000315350533c0af1e4e6495d408288a23bd4eeaa6c0d000000640000000001000000000000002d00000031535053c0e85bcf6c23d34abacecd608a2748d71100000064000000000b000000ffff0000000000000000000000002a0000000000efbed70e8e97d692ec4c9b593135b9c49ccf8207ba827a5b6945b5d7ec83085f08cc4b050000 MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\TV_TopViewVersion = "0" MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000010000000300000002000000ffffffff MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupView = "0" MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\IconSize = "48" MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3 MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\MRUListEx = ffffffff MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9} MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\FFlags = "1092616257" MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell MelonLoader.Installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_FolderType = "{978E0ED7-92D6-4CEC-9B59-3135B9C49CCF}" MelonLoader.Installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\FFlags = "1" MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 740000001a00eebbfe23000010000aab12216ac8fe4fa3680de96e47012e00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000001900efbea7722a3ffa99db4da5a8c604edf61d6b8207ba827a5b6945b5d7ec83085f08cc20000000 MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\0 = 5e0f00002e0f81191410040f200000000060000000000000000000000000000000000000000000000000000000009d0000003153505330f125b7ef471a10a5f102608c9eebac310000000a000000001f000000100000005000750062006c00690063002000500069006300740075007200650073000000150000000f000000004000000000514ffe3104ca01110000000d000000001300000011000000150000000e0000000040000000006d8c293f04ca011500000010000000004000000000405b283f04ca01000000003100000031535053b1166d44ad8d7048a748402ea43d788c150000006400000000150000002a4d0a3a6e3fae4d00000000ac0d000031535053a66a63283d95d211b5d600c04fd918d0110000001900000000130000007d018070350d0000200000000011100000220d000014001f4225481e03947bc34db131e946b44c8dd5510000004b00eebbfe23310010009fae90a93ba0804e94bc9912d75041042d00000031535053c3c9b880bb619f43bb1ff78a43982377110000000200000000130000000100000000000000000000000000bb0c0000b50c4c69624caa0c0100002d000000315350537fb6765d3d9bbb44b6ae25da4f638a671100000005000000000b000000ffff000000000000410000003153505302d5cdd59c2e1b10939708002b2cf9ae250000000f000000001f0000000a0000004d006900630072006f0073006f0066007400000000000000a600000031535053a66a63283d95d211b5d600c04fd918d0110000001a0000000003000000010000007900000018000000001f000000330000006b006e006f0077006e0066006f006c006400650072003a007b00420036004500420046004200380036002d0036003900300037002d0034003100330043002d0039004100460037002d003400460043003200410042004600300037004300430035007d0000000000000000007e00000031535053537def0c64fad111a2030000f81fedee2100000007000000001f00000008000000570069006e0064006f007700730000004100000003000000001f000000170000005000750062006c0069006300200050006900630074007500720065007300200046006f006c006400650072000000000000000000c90100003153505381fa9f1fa65e3d4c86415bc57c84cd68ad0100000200000000111000009901000014001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000007400310000000000e55873491100557365727300600008000400efbeee3a851ae55873492a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d00320031003800310033000000140078003100000000008c3e854311005075626c69630000620008000400efbeee3a851a8c3e85432a0000007c0200000000010000000000000000003800000000005000750062006c0069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003600000016007e00310000000000ee3acd26110050696374757265730000660008000400efbeee3a851aee3acc262a000000840200000000010000000000000000003c000000000050006900630074007500720065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380030003200000018000000000000000000004b0900003153505305d5cdd59c2e1b10939708002b2cf9ae2f0900001e00000000730065007200690061006c0069007a00650064004c0069006e006b0000001f0000007f0400004d004200410041004100450041004600430041004100410041004100410041004100440041004100410041004100410041005900300067004100410051004200520041004100410041007700330078007700320066004d0045006f00630041007500720066004c006f003800440042004b00480051006d005100720049004b002f005100670079004200410041004100410041004100410041004100410041004200410041004100410041004100410041004100410041004100410041004100410041004100410041006b005a0041005500410077004800510042002b005400510044006900360036006b0047004500690069004e0043004100730043004d00770030005a004700410038007900510036007700460041004100410041004100410041004100410041004100410041004100410041004100410041004100410041004100410041003000420051004d004100410041004100410041005100350059004e005800530052004100510056007a0056006d0063007a00420041005900410067004100410045004100770037002b00360075004f00460071005200350059004e00580053007100410041004100410059006500410041004100410041004100450041004100410041004100410041004100410041004100410067004e004100410041004100410041005100560041004d00480041006c0042006700630041004d0048004100410041004100510041004d00480041006f00420051005a0041007700470041007300420077004d0041004900440041007500410041005a0041007700470041007300420041004c0041003000430041007900410051004d0041006700440041007800410077004d004100410041004100550041004100650041004500440041004100410041004100410077006f00500046004f0055004500410041005600640069007800570061006a00420041004100690042004100430041005100410041007600370072003700360055006f0047004d0036005400680044007000430041004100410041006600430041004100410041004100510041004100410041004100410041004100410041004100410041003400410041004100410041004100410051004200510064004100490047004100730042005100610041004d0047004100410041004100510041004d00480041006f00420051005a0041007700470041007300420077004d0041004900440041007500410041005a0041007700470041007300420041004c0041003000430041007900410051004d0041006700440041007800410067004e0041004100410041005700410067006600410045004400410041004100410041004100340075004f004e0062005300450041004100560061006a0052005800640079005600320063004100410067005a00410067004100410045004100770037002b00360075004f0046007100680037003600770073004a007100410041004100410051006f004100410041004100410041004500410041004100410041004100410041004100410041004100410050004100410041004100410041004100550041006b00470041006a0042004100640041005500480041007900420051005a0041004d0048004100410041004100510041004d00480041006f00420051005a0041007700470041007300420077004d0041004900440041007500410041005a0041007700470041007300420041004c0041003000430041007900410051004d0041006700440041007700410067004d0041004100410041005900410041004100410034004500410041004100410048004100410041004100420041004100410041007700420041004100410041004e0041004100410041004100410041004100410030004500410041004100410047004100410041004100440041004100410041007300700041005800670043004500410041004100410058006c006d0062006b003900320064007a0042007700510036007700560056007a0056006d0063007a0078004600550031004a004700620070004e004700580051006c0032005900300056006e0063006c004e0048004100410041004200410041004100510042004100410041006f003200410041004100410063005a004100410041004100480041004100410041004c004100410041006700610034002b0072006200370042007000780054005100610065002f005400430076004b0038003800560038006c0042004100410041005a0043004100410041006b00410041004100410061006a00410041004100410078004d004600550054004a007500690059005a00450076004d0068007a005100370079002f0045005400610043006d0074003500630063004100410041004100450041004100410041004100770048004100410041004100760041004100410041004d00460041007400410051004d0041003000430041003100410051004c0041004900440041007800410051004c0041004500440041007a00410041004f0041005500440041003400410041004f0041004d00440041007900410041004f0041006700440041007400410077004d0041004100440041003000410067004d0041006700440041003000410041004d0041004d00440041003200410051004e0041003000430041007900410077004e0041004d00440041003000410067004d0041005100440041003500410077004d0041005500440041007800410051004c0041004500440041007700410041004d0041004100440041004100410041004100410041004100410041004100410041004100410041004100670042004100410041004d0041004100410041004b005700410041004100410041004100410041004100490048006300340039003200590078004a006e005a0041004100410041004100410041004100410041006700780050002b00550041006a0055004b0056004e005a00620048003000330051004c00730041006c0043006a0047002b0062005000520044006300650048006800740031004200510048004a006f00760057006300590038006a0050004600770049006c0053005600540032003200420039004e00300043004c005100700077006f0068002f0032005400300041006e0033005200590062006400410030005200430036007200460048004100410041004100410041000000000000000000000000000000000000002500000018000000001f000000090000005000690063007400750072006500730000000000250000000b000000001f0000000a0000004400690072006500630074006f0072007900000000000000860000003153505340e83e1e2bbc6c4782372acd1a839b224500000008000000001f0000001900000043003a005c00550073006500720073005c005000750062006c00690063005c0050006900630074007500720065007300000000002500000003000000001f100000010000000700000066006f006c0064006500720000000000000000000000000000002a0000000000efbe9f33f8c112f3974cb1c6ecdf5910c5c08207ba827a5b6945b5d7ec83085f08cc340f0000 MelonLoader.Installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{3F2A72A7-99FA-4DDB-A5A8-C604EDF61D6B}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\0 MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{3F2A72A7-99FA-4DDB-A5A8-C604EDF61D6B}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_TopViewVersion = "0" MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\NodeSlot = "4" MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 MelonLoader.Installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "96" MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings MelonLoader.Installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\LogicalViewMode = "2" MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{3F2A72A7-99FA-4DDB-A5A8-C604EDF61D6B}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a00000002e37a3569cced2119f0e006097c686f602000000780000002e37a3569cced2119f0e006097c686f604000000800000002e37a3569cced2119f0e006097c686f60700000028000000e0859ff2f94f6810ab9108002b27b3d90200000090000000 MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0 MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a0000000e0859ff2f94f6810ab9108002b27b3d9050000005800000030f125b7ef471a10a5f102608c9eebac0c00000050000000920444648b4cd1118b70080036b11a030900000060000000 MelonLoader.Installer.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 9e0000001a00eebbfe23000010000aab12216ac8fe4fa3680de96e47012e00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbea7722a3ffa99db4da5a8c604edf61d6b8207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff MelonLoader.Installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{3F2A72A7-99FA-4DDB-A5A8-C604EDF61D6B}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{0B2BAAEB-0042-4DCA-AA4D-3EE8648D03E5}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\GroupByKey:PID = "100" MelonLoader.Installer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3 = 9e0000001a00eebbfe23000010009fae90a93ba0804e94bc9912d750410400002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbeebaa2b0b4200ca4daa4d3ee8648d03e58207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 03000000020000000100000000000000ffffffff MelonLoader.Installer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 01000000030000000200000000000000ffffffff MelonLoader.Installer.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MelonLoader.Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MelonLoader.Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MelonLoader.Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MelonLoader.Installer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2584 MelonLoader.Installer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2584 MelonLoader.Installer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2584 MelonLoader.Installer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2584 MelonLoader.Installer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MelonLoader.Installer.exe"C:\Users\Admin\AppData\Local\Temp\MelonLoader.Installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2584
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:1276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
6KB
MD5fac195f7dfb557b4695c4205cedef08b
SHA1c1eaa917564d0ad9579ea21663e43979cdfd6a5d
SHA256e44bf71f86ffbf35469e94a684ffa513f8662af507dc0d125ea80ed8a51cbd4d
SHA512f7eb9e7c203cd7545f5682e6c1a4e8c6412827daf042849c098511ee657ab9dafe7023e2e2768ac8782b7115839397150e923f57a58c66bdca970c0b3ccdf535