Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 16:15
General
-
Target
HellifyBoosterV3.rar
-
Size
5.4MB
-
MD5
2b5b6d173559a5b7f3057c9ccd6f824d
-
SHA1
089c2ec5758f6797b858268b114a51f01d9dc6a0
-
SHA256
0d24c4b8cd59d7ee3425ae01a4d8120ea96568098ec1daea5ee62162c586957f
-
SHA512
5db79772bb1e746df738b09e8cc7c6721ebd59f004295f3a14e41e66c56d2f3b0378d8c4daf466af0dff097d34dfe0f14d7b545873c40cd76a7f74a1b056f607
-
SSDEEP
98304:H1qGZwV5ecfIm+HaqefYQ/TR4/Gs4glSm7d/YdoRxqcvN6F7OZ:ViV5eyhQteQQL24Nm13XnF6F7OZ
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 25 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\HellifyBoosterV3.rar1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\HellifyBoosterV3.rar2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵