Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
8announce.exe
windows10-2004-x64
1filterscri...se.vbs
windows10-2004-x64
1filterscri...ip.vbs
windows10-2004-x64
1filterscri...as.vbs
windows10-2004-x64
1filterscri...el.vbs
windows10-2004-x64
1filterscri...ug.vbs
windows10-2004-x64
1filterscri...rn.vbs
windows10-2004-x64
1filterscri...s1.vbs
windows10-2004-x64
1filterscri...de.vbs
windows10-2004-x64
1filterscri...or.vbs
windows10-2004-x64
1filterscri...ll.vbs
windows10-2004-x64
1filterscri...ls.vbs
windows10-2004-x64
1filterscri...go.vbs
windows10-2004-x64
1filterscri...er.vbs
windows10-2004-x64
1filterscri...ip.vbs
windows10-2004-x64
1filterscri...ed.vbs
windows10-2004-x64
1filterscri...g1.vbs
windows10-2004-x64
1filterscri...ch.vbs
windows10-2004-x64
1filterscri...ds.vbs
windows10-2004-x64
1gamemodes/...ll.vbs
windows10-2004-x64
1pawno/incl...ts.vbs
windows10-2004-x64
1pawno/libpawnc.dll
windows10-2004-x64
1pawno/pawnc.dll
windows10-2004-x64
1pawno/pawncc.exe
windows10-2004-x64
1pawno/pawno.exe
windows10-2004-x64
8samp-npc.exe
windows10-2004-x64
1samp-server.exe
windows10-2004-x64
1Resubmissions
29/12/2022, 21:53
221229-1rvknaec49 8Analysis
-
max time kernel
126s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2022, 21:53
Behavioral task
behavioral1
Sample
announce.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral2
Sample
filterscripts/a51_base.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
filterscripts/cargoship.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral4
Sample
filterscripts/dillimore_gas.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
filterscripts/ferriswheel.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral6
Sample
filterscripts/fsdebug.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
filterscripts/kylies_barn.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral8
Sample
filterscripts/ls_apartments1.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
filterscripts/ls_beachside.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral10
Sample
filterscripts/ls_elevator.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
filterscripts/ls_mall.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral12
Sample
filterscripts/ls_prisonwalls.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
filterscripts/ls_wellsfargo.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral14
Sample
filterscripts/ospawner.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
filterscripts/pirateship.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral16
Sample
filterscripts/safe_animated.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
filterscripts/sf_building1.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral18
Sample
filterscripts/sf_zombotech.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
filterscripts/test_cmds.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral20
Sample
gamemodes/rivershell.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
pawno/include/a_objects.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral22
Sample
pawno/libpawnc.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
pawno/pawnc.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral24
Sample
pawno/pawncc.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
pawno/pawno.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral26
Sample
samp-npc.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
samp-server.exe
Resource
win10v2004-20220812-en
General
-
Target
pawno/pawno.exe
-
Size
297KB
-
MD5
325558d389c149c420a2753e0d163d09
-
SHA1
3d1ac2fafe3ce5f5348a77c891074551a51e8fda
-
SHA256
796a94ddcdb41b32d32bee020ca85371cf6bbeb968036448d0e3b0b559d7e90b
-
SHA512
182358763d3565c4d29b51479eafeeee060b876a3884d7636caa47152d0edee1b531db955664f14e5b03e1820d960a2a532444b33702acb1a6b23b1bc450ce8e
-
SSDEEP
6144:8qV54oUeSsMY3j0cI8rdYEylF2EHJ8Sj6vzHrh8wDVU3wMs9ZFW:8qV5dU7oTWKYEEF5J87vzLh8aVJS
Malware Config
Signatures
-
resource yara_rule behavioral25/memory/4252-132-0x0000000000400000-0x00000000004D3000-memory.dmp upx behavioral25/memory/4252-133-0x0000000000400000-0x00000000004D3000-memory.dmp upx -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawno\\pawno.exe \"%1\"" pawno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pwn pawno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pwn\ = "PAWN.Script" pawno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script pawno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open\command pawno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell pawno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\ = "Open" pawno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open pawno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\DefaultIcon pawno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawno\\pawno.exe,1" pawno.exe