Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Melonity.zip
windows7-x64
7Melonity.zip
windows10-2004-x64
1Melonity.exe
windows7-x64
7Melonity.exe
windows10-2004-x64
10Qt5WebEngineCore.dll
windows7-x64
1Qt5WebEngineCore.dll
windows10-2004-x64
1Source/Qt/...ltypes
windows7-x64
3Source/Qt/...ltypes
windows10-2004-x64
3Source/Qt/...qmldir
windows7-x64
1Source/Qt/...qmldir
windows10-2004-x64
1Source/Qt/...in.dll
windows7-x64
1Source/Qt/...in.dll
windows10-2004-x64
1Source/QtG...end.js
windows7-x64
3Source/QtG...end.js
windows10-2004-x64
3Source/QtG...st.qml
windows7-x64
3Source/QtG...st.qml
windows10-2004-x64
3Source/QtG...ay.qml
windows7-x64
3Source/QtG...ay.qml
windows10-2004-x64
3Source/QtG...ze.qml
windows7-x64
3Source/QtG...ze.qml
windows10-2004-x64
3Source/QtG...nt.qml
windows7-x64
3Source/QtG...nt.qml
windows10-2004-x64
3Source/QtG...lur.js
windows7-x64
3Source/QtG...lur.js
windows10-2004-x64
3Source/QtG...ce.qml
windows7-x64
3Source/QtG...ce.qml
windows10-2004-x64
3Source/QtG...ow.qml
windows7-x64
3Source/QtG...ow.qml
windows10-2004-x64
3Source/QtG...lur.js
windows7-x64
3Source/QtG...lur.js
windows10-2004-x64
3Source/QtG...lur.js
windows7-x64
3Source/QtG...lur.js
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 12:32
Static task
static1
Behavioral task
behavioral1
Sample
Melonity.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Melonity.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Melonity.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Melonity.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Qt5WebEngineCore.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Qt5WebEngineCore.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Source/Qt/labs/platform/plugins.qmltypes
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Source/Qt/labs/platform/plugins.qmltypes
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Source/Qt/labs/platform/qmldir
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
Source/Qt/labs/platform/qmldir
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Source/Qt/labs/platform/qtlabsplatformplugin.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Source/Qt/labs/platform/qtlabsplatformplugin.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Source/QtGraphicalEffects/Blend.js
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Source/QtGraphicalEffects/Blend.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Source/QtGraphicalEffects/BrightnessContrast.qml
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
Source/QtGraphicalEffects/BrightnessContrast.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Source/QtGraphicalEffects/ColorOverlay.qml
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Source/QtGraphicalEffects/ColorOverlay.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Source/QtGraphicalEffects/Colorize.qml
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Source/QtGraphicalEffects/Colorize.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Source/QtGraphicalEffects/ConicalGradient.qml
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Source/QtGraphicalEffects/ConicalGradient.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Source/QtGraphicalEffects/DirectionalBlur.js
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Source/QtGraphicalEffects/DirectionalBlur.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Source/QtGraphicalEffects/Displace.qml
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
Source/QtGraphicalEffects/Displace.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Source/QtGraphicalEffects/DropShadow.qml
Resource
win7-20241023-en
Behavioral task
behavioral28
Sample
Source/QtGraphicalEffects/DropShadow.qml
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Source/QtGraphicalEffects/FastBlur.js
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Source/QtGraphicalEffects/FastBlur.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Source/QtGraphicalEffects/GaussianBlur.js
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Source/QtGraphicalEffects/GaussianBlur.js
Resource
win10v2004-20241007-en
General
-
Target
Melonity.zip
-
Size
108.4MB
-
MD5
4b7a6685c322a80905f97dc48d5ddd63
-
SHA1
d73c47519789b7fc15617f456a226c037de098a0
-
SHA256
bc87c85e306f1da4f9d76d95628f7de1c85ed04d5fdf8b0b9c13793df4bd1b28
-
SHA512
1b72ce640f5d75748b7fa9646fa4ce46bf93c47ad14e13255871949e8e13bdd1f631a68214d9146652e3d94bd2d60c2108f5c33f98dbf676e42e54c73c98946e
-
SSDEEP
3145728:ZgfAMui7AZazd0/CZN/5ygfAMui7AZazd0/CZt5KJ:ZgruSAZs8SZYgruSAZs8S3KJ
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2620 Melonity.exe 2780 WeMod.exe 1112 Sirus.exe -
Loads dropped DLL 4 IoCs
pid Process 2620 Melonity.exe 2620 Melonity.exe 2620 Melonity.exe 2620 Melonity.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2780 WeMod.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Melonity.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2780 WeMod.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2528 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2528 7zFM.exe Token: 35 2528 7zFM.exe Token: SeSecurityPrivilege 2528 7zFM.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2528 7zFM.exe 2528 7zFM.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2780 2620 Melonity.exe 33 PID 2620 wrote to memory of 2780 2620 Melonity.exe 33 PID 2620 wrote to memory of 2780 2620 Melonity.exe 33 PID 2620 wrote to memory of 2780 2620 Melonity.exe 33 PID 2620 wrote to memory of 1112 2620 Melonity.exe 34 PID 2620 wrote to memory of 1112 2620 Melonity.exe 34 PID 2620 wrote to memory of 1112 2620 Melonity.exe 34 PID 2620 wrote to memory of 1112 2620 Melonity.exe 34
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Melonity.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2528
-
C:\Users\Admin\Desktop\Melonity.exe"C:\Users\Admin\Desktop\Melonity.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Roaming\WeMod.exeC:\Users\Admin\AppData\Roaming\WeMod.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2780
-
-
C:\Users\Admin\AppData\Roaming\Sirus.exeC:\Users\Admin\AppData\Roaming\Sirus.exe2⤵
- Executes dropped EXE
PID:1112
-