Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
66s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
HellifyBoosterV3.rar
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
HellifyBoosterV3.rar
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
HellifyBoosterV3.rar
-
Size
5.4MB
-
MD5
2b5b6d173559a5b7f3057c9ccd6f824d
-
SHA1
089c2ec5758f6797b858268b114a51f01d9dc6a0
-
SHA256
0d24c4b8cd59d7ee3425ae01a4d8120ea96568098ec1daea5ee62162c586957f
-
SHA512
5db79772bb1e746df738b09e8cc7c6721ebd59f004295f3a14e41e66c56d2f3b0378d8c4daf466af0dff097d34dfe0f14d7b545873c40cd76a7f74a1b056f607
-
SSDEEP
98304:H1qGZwV5ecfIm+HaqefYQ/TR4/Gs4glSm7d/YdoRxqcvN6F7OZ:ViV5eyhQteQQL24Nm13XnF6F7OZ
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1952 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2560 rundll32.exe 1952 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 328 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 328 AUDIODG.EXE Token: 33 328 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 328 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1952 vlc.exe 1952 vlc.exe 1952 vlc.exe 1952 vlc.exe 1952 vlc.exe 1952 vlc.exe 1952 vlc.exe 1952 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1952 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2560 2748 cmd.exe 32 PID 2748 wrote to memory of 2560 2748 cmd.exe 32 PID 2748 wrote to memory of 2560 2748 cmd.exe 32 PID 2560 wrote to memory of 2580 2560 rundll32.exe 33 PID 2560 wrote to memory of 2580 2560 rundll32.exe 33 PID 2560 wrote to memory of 2580 2560 rundll32.exe 33 PID 2580 wrote to memory of 1952 2580 rundll32.exe 35 PID 2580 wrote to memory of 1952 2580 rundll32.exe 35 PID 2580 wrote to memory of 1952 2580 rundll32.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\HellifyBoosterV3.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\HellifyBoosterV3.rar2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\HellifyBoosterV3.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\HellifyBoosterV3.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2364
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5101⤵
- Suspicious use of AdjustPrivilegeToken
PID:328
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1468