Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/02/2023, 05:00
Static task
static1
Behavioral task
behavioral1
Sample
rbxfpsunlocker-x64.zip
Resource
win7-20221111-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
rbxfpsunlocker-x64.zip
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
rbxfpsunlocker.exe
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
rbxfpsunlocker.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
rbxfpsunlocker.exe
-
Size
501KB
-
MD5
f6722f9f28173138464a22fd516c0275
-
SHA1
247c828444f9ed61037704b4e2b6f5431f410a73
-
SHA256
19f11c65f6c8dc386e9e8fdc79326fd7580395d9931a5e952feac40d26a88907
-
SHA512
2ddff2df9e550e6dae9b3ece908e9887e4ab4a26d056d73a6f224b0f0ad981c499819c211701f953abbc79512c821725330e35f905ea743d9aeb3f23a1646c50
-
SSDEEP
6144:Ry2RPslBVptHpJA5mmWRTzSVRkzyNXf6tyRqgrOEqV7DIyohcqSHP4ooXHE:FPAJJBRaVS+NXGyRq/x7noCq+w/
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 rbxfpsunlocker.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde rbxfpsunlocker.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe 1532 rbxfpsunlocker.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1532 rbxfpsunlocker.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1532 rbxfpsunlocker.exe