Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20/04/2023, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
Fortnite_Hack_v3.2.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Fortnite_Hack_v3.2.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10v2004-20230220-en
General
-
Target
Fortnite_Hack_v3.2.rar
-
Size
6.7MB
-
MD5
10a84dd13e051cc5c8a725346a059116
-
SHA1
968a8eb11cda8e8c32ad8cb981147d4ea7b19e3e
-
SHA256
c2797dd833c4aafa1ea8be296491d30088e246367ed18cfeb9fbc5b2a6ee323e
-
SHA512
5c66701cdd1b9d897207ba185e6b761bf09ceeeb9975265e1d379695c6ebcac8ad18133a62d82093494270fda6e3d02444fd8c00ecd5db6640760bdb806b5e3c
-
SSDEEP
196608:5I9NUu7xtnnF1h18TI0ZuYANl4gEOnrM9BR:5GNn9tnF1HmHLiFa
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1704 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1704 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1704 vlc.exe 1704 vlc.exe 1704 vlc.exe 1704 vlc.exe 1704 vlc.exe 1704 vlc.exe 1704 vlc.exe 1704 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1704 vlc.exe 1704 vlc.exe 1704 vlc.exe 1704 vlc.exe 1704 vlc.exe 1704 vlc.exe 1704 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1704 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1484 wrote to memory of 1688 1484 cmd.exe 28 PID 1484 wrote to memory of 1688 1484 cmd.exe 28 PID 1484 wrote to memory of 1688 1484 cmd.exe 28 PID 1688 wrote to memory of 1704 1688 rundll32.exe 29 PID 1688 wrote to memory of 1704 1688 rundll32.exe 29 PID 1688 wrote to memory of 1704 1688 rundll32.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Fortnite_Hack_v3.2.rar1⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Fortnite_Hack_v3.2.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Fortnite_Hack_v3.2.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1704
-
-