Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13/09/2024, 03:01

General

  • Target

    Maxon Cinema 4D 2024.4.0 x64.exe

  • Size

    19.1MB

  • MD5

    3a5b5a4c669327a410bf354aac7a8e35

  • SHA1

    c5e8fbdb4f19a6cb85048879b24b6f3bee03b2ef

  • SHA256

    753a2b1227d1a89d29bcb9b9a6231f143d933e6cff86ab9b7e151d38873b7906

  • SHA512

    8292fbe0bf5377b91082ad9d5c2ee5f465a8f3319f8be05c8e13bc94f1e54d2e7d9c9367c3fc714804d2f6225e219b69bb31eae2ff09f3c15987b553c60aecd6

  • SSDEEP

    393216:X4SQMl42yHOc3CEMCmjaQOz/RbFn5ukQQqdyT:Xoy4tHl2jpG5b1hyyT

Score
6/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Maxon Cinema 4D 2024.4.0 x64.exe
    "C:\Users\Admin\AppData\Local\Temp\Maxon Cinema 4D 2024.4.0 x64.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell $ProgressPreference = 'SilentlyContinue';$r = (mount-diskimage -storagetype ISO -imagepath 'C:\Users\Admin\AppData\Local\Temp\Deploy.db' -passthru | get-volume).driveletter;Set-Clipboard $r
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Temp\Temp_1\restfiles\vidbanner.mp4

    Filesize

    9.9MB

    MD5

    74baafec4842208637896ca7e7aa291e

    SHA1

    63fd9a182e4e78b76898d048a5e7ff56b94180fa

    SHA256

    58d546cd6ab0bffe18f99abe62ae6e251f8d68a0db7cbfdce7fefc0bad12ee6c

    SHA512

    13e48839489bcb2e02986c0ab51d7239a8a4b7a92b9ff2019240616d70e348d0c4e1a13de1ac222a85502e382afd1767360840e6fbc92f4b74ba340142e54dff

  • memory/1920-47-0x00000000024F0000-0x00000000024FA000-memory.dmp

    Filesize

    40KB

  • memory/1920-12-0x00000000024D0000-0x00000000024DA000-memory.dmp

    Filesize

    40KB

  • memory/1920-11-0x00000000024D0000-0x00000000024DA000-memory.dmp

    Filesize

    40KB

  • memory/1920-14-0x00000000024D0000-0x00000000024DA000-memory.dmp

    Filesize

    40KB

  • memory/1920-15-0x00000000024D0000-0x00000000024DA000-memory.dmp

    Filesize

    40KB

  • memory/1920-13-0x00000000024D0000-0x00000000024DA000-memory.dmp

    Filesize

    40KB

  • memory/1920-33-0x000007FEF5390000-0x000007FEF5781000-memory.dmp

    Filesize

    3.9MB

  • memory/1920-30-0x000007FEF5390000-0x000007FEF5781000-memory.dmp

    Filesize

    3.9MB

  • memory/1920-32-0x0000000002460000-0x0000000002461000-memory.dmp

    Filesize

    4KB

  • memory/1920-31-0x00000000024F0000-0x00000000024FA000-memory.dmp

    Filesize

    40KB

  • memory/1920-10-0x000007FEF572C000-0x000007FEF5737000-memory.dmp

    Filesize

    44KB

  • memory/1920-56-0x000007FEF572C000-0x000007FEF5737000-memory.dmp

    Filesize

    44KB

  • memory/1920-46-0x00000000024D0000-0x00000000024DA000-memory.dmp

    Filesize

    40KB

  • memory/1920-43-0x000007FEF572C000-0x000007FEF5737000-memory.dmp

    Filesize

    44KB

  • memory/1920-44-0x00000000024D0000-0x00000000024DA000-memory.dmp

    Filesize

    40KB

  • memory/1920-45-0x00000000024D0000-0x00000000024DA000-memory.dmp

    Filesize

    40KB

  • memory/1920-57-0x000007FEF5390000-0x000007FEF5781000-memory.dmp

    Filesize

    3.9MB

  • memory/1920-6-0x0000000002460000-0x0000000002461000-memory.dmp

    Filesize

    4KB

  • memory/1920-49-0x00000000024F0000-0x00000000024FA000-memory.dmp

    Filesize

    40KB

  • memory/1920-50-0x000007FEF5390000-0x000007FEF5781000-memory.dmp

    Filesize

    3.9MB

  • memory/1920-51-0x00000000024F0000-0x00000000024FA000-memory.dmp

    Filesize

    40KB

  • memory/1920-52-0x000007FEF5390000-0x000007FEF5781000-memory.dmp

    Filesize

    3.9MB

  • memory/2956-38-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

    Filesize

    2.9MB

  • memory/2956-39-0x0000000000300000-0x0000000000308000-memory.dmp

    Filesize

    32KB