Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

5

Maxon Cine...64.exe

windows7-x64

6

Maxon Cine...64.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 03:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Maxon Cinema 4D 2024.4.0 x64.exe

  • Size

    19.1MB

  • MD5

    3a5b5a4c669327a410bf354aac7a8e35

  • SHA1

    c5e8fbdb4f19a6cb85048879b24b6f3bee03b2ef

  • SHA256

    753a2b1227d1a89d29bcb9b9a6231f143d933e6cff86ab9b7e151d38873b7906

  • SHA512

    8292fbe0bf5377b91082ad9d5c2ee5f465a8f3319f8be05c8e13bc94f1e54d2e7d9c9367c3fc714804d2f6225e219b69bb31eae2ff09f3c15987b553c60aecd6

  • SSDEEP

    393216:X4SQMl42yHOc3CEMCmjaQOz/RbFn5ukQQqdyT:Xoy4tHl2jpG5b1hyyT

Score
6/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Maxon Cinema 4D 2024.4.0 x64.exe
    "C:\Users\Admin\AppData\Local\Temp\Maxon Cinema 4D 2024.4.0 x64.exe"
    1⤵
    • Enumerates connected drives
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell $ProgressPreference = 'SilentlyContinue';$r = (mount-diskimage -storagetype ISO -imagepath 'C:\Users\Admin\AppData\Local\Temp\Deploy.db' -passthru | get-volume).driveletter;Set-Clipboard $r
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3316
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4f8 0x2c0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
    Filesize

    256KB

    MD5

    0778cd387d38ec570411e5d210262d5f

    SHA1

    2d4f6361b12f0a36bd3c3fce05c802794ad91464

    SHA256

    0f06cda501ad115a17e4ee2ada9016f12345bb2374ef0e47a32df6617f279498

    SHA512

    cf729f3faf42ebf4410c4f3c35b5c1fcb56eaac02ebfb33adfccdd9ba5cc0de66554c4c492c6b9e0fa8d7290a50d9d76c057cba6dd17b1358735ea4c0791ae13

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xld45zmg.uk1.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\aut8647.tmp
    Filesize

    9.9MB

    MD5

    74baafec4842208637896ca7e7aa291e

    SHA1

    63fd9a182e4e78b76898d048a5e7ff56b94180fa

    SHA256

    58d546cd6ab0bffe18f99abe62ae6e251f8d68a0db7cbfdce7fefc0bad12ee6c

    SHA512

    13e48839489bcb2e02986c0ab51d7239a8a4b7a92b9ff2019240616d70e348d0c4e1a13de1ac222a85502e382afd1767360840e6fbc92f4b74ba340142e54dff

    Download Submit

  • memory/3316-36-0x000002C4731A0000-0x000002C4731C2000-memory.dmp

    Filesize

    136KB

    Download