Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/01/2023, 23:39

230112-3njebsbh47 8

12/01/2023, 23:33

230112-3j92gsbh26 8

Analysis

  • max time kernel
    63s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2023, 23:33

General

  • Target

    Counter-Strike.exe

  • Size

    265.2MB

  • MD5

    37667601ee4b53183145118c5751330e

  • SHA1

    f42d970dc4b239ebb34277f96dea5b0a941d6ca9

  • SHA256

    0d7bc42c56b0f0ee4bbf6e2178db5adbf145295ba4e5dee7532e1c0858ea3fe3

  • SHA512

    6c7bd24eac7d5e0474ecb5583f8d66c98b5bad91cd5c2a6b26d06142a5ce0404ab0314f095ccf9751f04db27337a42b21634265364524e55689c92ce46aecf48

  • SSDEEP

    3145728:9fjTxdljCmzc15qJPPZOnJlMKbAhMslm88ayBurKCGk1NxRJg8jKxePjAxxHfOnp:d1D8qJ3EAhHmbFBXk1nXPuAjYeKt79O

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Counter-Strike.exe
    "C:\Users\Admin\AppData\Local\Temp\Counter-Strike.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1360
    • C:\Users\Admin\AppData\Local\Temp\is-S8VN4.tmp\Counter-Strike.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-S8VN4.tmp\Counter-Strike.tmp" /SL5="$60120,277524654,60928,C:\Users\Admin\AppData\Local\Temp\Counter-Strike.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:996

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-S8VN4.tmp\Counter-Strike.tmp

    Filesize

    700KB

    MD5

    ccd2afcc8b78a187d60d2fd9e26e2fe1

    SHA1

    db2c8cff0e12ad35faffa8d181de31eb916e5315

    SHA256

    4c37ea9342587b6cc9a2c64018a518fe3d8b7018550b8726f3f4377cfa0a9671

    SHA512

    b567ea1a95586e757afe573658ff25fa19ba80977e36cb2c557afe254a9d1dd427005a3b98e01d87e63bbffa451ba618c6b951cbc0e47d68f476efaaf4f8e0b9

  • \Games\Counter-Strike WaRzOnE\CS16Launcher.exe

    Filesize

    219KB

    MD5

    002569d719a892cefdee47b40fb9de9d

    SHA1

    c87baaf1db6f143eafceafb0e10be366a729cff7

    SHA256

    a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746

    SHA512

    00f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321

  • \Games\Counter-Strike WaRzOnE\CS16Launcher.exe

    Filesize

    219KB

    MD5

    002569d719a892cefdee47b40fb9de9d

    SHA1

    c87baaf1db6f143eafceafb0e10be366a729cff7

    SHA256

    a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746

    SHA512

    00f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321

  • \Games\Counter-Strike WaRzOnE\CS16Launcher.exe

    Filesize

    219KB

    MD5

    002569d719a892cefdee47b40fb9de9d

    SHA1

    c87baaf1db6f143eafceafb0e10be366a729cff7

    SHA256

    a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746

    SHA512

    00f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321

  • \Games\Counter-Strike WaRzOnE\hl.exe

    Filesize

    84KB

    MD5

    2098ccf443433129b556c2849fe99e26

    SHA1

    074ddbaff48c88b3b5c8f881c35d2be2bb19a249

    SHA256

    4a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af

    SHA512

    fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10

  • \Games\Counter-Strike WaRzOnE\hlds.exe

    Filesize

    397KB

    MD5

    3745840b996a56366857e83cd4244d5f

    SHA1

    fbdcc19e19aad2dadeb020447344c4c97982bc37

    SHA256

    e4496e39b112e655b0d2f37489a3bd76c2ec72ba83c4605c3e379619e666d8ad

    SHA512

    d35ff2980776235896bb00cdfe8d08c236787e36f55100aaebe597f4a7dde9fc5d0999792c2554398c90ad72a2e82c7c276d37f7ff32e1d00cfae703aa6170fe

  • \Users\Admin\AppData\Local\Temp\is-S8VN4.tmp\Counter-Strike.tmp

    Filesize

    700KB

    MD5

    ccd2afcc8b78a187d60d2fd9e26e2fe1

    SHA1

    db2c8cff0e12ad35faffa8d181de31eb916e5315

    SHA256

    4c37ea9342587b6cc9a2c64018a518fe3d8b7018550b8726f3f4377cfa0a9671

    SHA512

    b567ea1a95586e757afe573658ff25fa19ba80977e36cb2c557afe254a9d1dd427005a3b98e01d87e63bbffa451ba618c6b951cbc0e47d68f476efaaf4f8e0b9

  • memory/1360-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

    Filesize

    8KB

  • memory/1360-55-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/1360-61-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/1360-67-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB