Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2023, 05:33

General

  • Target

    Fortnite_Hack_v3.2.rar

  • Size

    6.7MB

  • MD5

    10a84dd13e051cc5c8a725346a059116

  • SHA1

    968a8eb11cda8e8c32ad8cb981147d4ea7b19e3e

  • SHA256

    c2797dd833c4aafa1ea8be296491d30088e246367ed18cfeb9fbc5b2a6ee323e

  • SHA512

    5c66701cdd1b9d897207ba185e6b761bf09ceeeb9975265e1d379695c6ebcac8ad18133a62d82093494270fda6e3d02444fd8c00ecd5db6640760bdb806b5e3c

  • SSDEEP

    196608:5I9NUu7xtnnF1h18TI0ZuYANl4gEOnrM9BR:5GNn9tnF1HmHLiFa

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Fortnite_Hack_v3.2.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Fortnite_Hack_v3.2.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Fortnite_Hack_v3.2.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1704

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1704-83-0x000000013F710000-0x000000013F808000-memory.dmp

    Filesize

    992KB

  • memory/1704-84-0x000007FEFB6B0000-0x000007FEFB6E4000-memory.dmp

    Filesize

    208KB

  • memory/1704-85-0x000007FEF6AC0000-0x000007FEF6D74000-memory.dmp

    Filesize

    2.7MB

  • memory/1704-86-0x000007FEFBC30000-0x000007FEFBC48000-memory.dmp

    Filesize

    96KB

  • memory/1704-87-0x000007FEFB690000-0x000007FEFB6A7000-memory.dmp

    Filesize

    92KB

  • memory/1704-88-0x000007FEFB670000-0x000007FEFB681000-memory.dmp

    Filesize

    68KB

  • memory/1704-89-0x000007FEFB650000-0x000007FEFB667000-memory.dmp

    Filesize

    92KB

  • memory/1704-90-0x000007FEFB630000-0x000007FEFB641000-memory.dmp

    Filesize

    68KB

  • memory/1704-91-0x000007FEFB610000-0x000007FEFB62D000-memory.dmp

    Filesize

    116KB

  • memory/1704-92-0x000007FEFB420000-0x000007FEFB431000-memory.dmp

    Filesize

    68KB

  • memory/1704-93-0x000007FEF5970000-0x000007FEF6A1B000-memory.dmp

    Filesize

    16.7MB

  • memory/1704-94-0x000007FEF5770000-0x000007FEF5970000-memory.dmp

    Filesize

    2.0MB

  • memory/1704-95-0x000007FEFB3E0000-0x000007FEFB41F000-memory.dmp

    Filesize

    252KB

  • memory/1704-96-0x000007FEFB3B0000-0x000007FEFB3D1000-memory.dmp

    Filesize

    132KB

  • memory/1704-97-0x000007FEFB390000-0x000007FEFB3A8000-memory.dmp

    Filesize

    96KB

  • memory/1704-98-0x000007FEFB370000-0x000007FEFB381000-memory.dmp

    Filesize

    68KB

  • memory/1704-100-0x000007FEFB330000-0x000007FEFB341000-memory.dmp

    Filesize

    68KB

  • memory/1704-101-0x000007FEF6FB0000-0x000007FEF6FCB000-memory.dmp

    Filesize

    108KB

  • memory/1704-102-0x000007FEF6F90000-0x000007FEF6FA1000-memory.dmp

    Filesize

    68KB

  • memory/1704-104-0x000007FEF6F40000-0x000007FEF6F70000-memory.dmp

    Filesize

    192KB

  • memory/1704-103-0x000007FEF6F70000-0x000007FEF6F88000-memory.dmp

    Filesize

    96KB

  • memory/1704-105-0x000007FEF74C0000-0x000007FEF7527000-memory.dmp

    Filesize

    412KB

  • memory/1704-99-0x000007FEFB350000-0x000007FEFB361000-memory.dmp

    Filesize

    68KB

  • memory/1704-106-0x000007FEF5700000-0x000007FEF576F000-memory.dmp

    Filesize

    444KB

  • memory/1704-107-0x000007FEF74A0000-0x000007FEF74B1000-memory.dmp

    Filesize

    68KB

  • memory/1704-108-0x000007FEF56A0000-0x000007FEF56F6000-memory.dmp

    Filesize

    344KB

  • memory/1704-109-0x000007FEF7470000-0x000007FEF7498000-memory.dmp

    Filesize

    160KB

  • memory/1704-110-0x000007FEF6E20000-0x000007FEF6E44000-memory.dmp

    Filesize

    144KB

  • memory/1704-111-0x000007FEF6AA0000-0x000007FEF6AB7000-memory.dmp

    Filesize

    92KB

  • memory/1704-112-0x000007FEF5670000-0x000007FEF5693000-memory.dmp

    Filesize

    140KB

  • memory/1704-113-0x000007FEF6A80000-0x000007FEF6A91000-memory.dmp

    Filesize

    68KB

  • memory/1704-114-0x000007FEF5650000-0x000007FEF5662000-memory.dmp

    Filesize

    72KB

  • memory/1704-115-0x000007FEF5580000-0x000007FEF55A1000-memory.dmp

    Filesize

    132KB

  • memory/1704-116-0x000007FEF5560000-0x000007FEF5573000-memory.dmp

    Filesize

    76KB

  • memory/1704-117-0x000007FEF5540000-0x000007FEF5552000-memory.dmp

    Filesize

    72KB

  • memory/1704-118-0x000007FEF4D60000-0x000007FEF4E9B000-memory.dmp

    Filesize

    1.2MB

  • memory/1704-119-0x000007FEF4800000-0x000007FEF482C000-memory.dmp

    Filesize

    176KB

  • memory/1704-120-0x000007FEF4620000-0x000007FEF47D2000-memory.dmp

    Filesize

    1.7MB

  • memory/1704-121-0x000007FEF45C0000-0x000007FEF461C000-memory.dmp

    Filesize

    368KB

  • memory/1704-122-0x000007FEF4530000-0x000007FEF4541000-memory.dmp

    Filesize

    68KB

  • memory/1704-123-0x000007FEF4490000-0x000007FEF4527000-memory.dmp

    Filesize

    604KB

  • memory/1704-124-0x000007FEF4470000-0x000007FEF4482000-memory.dmp

    Filesize

    72KB

  • memory/1704-125-0x000007FEF3FE0000-0x000007FEF4211000-memory.dmp

    Filesize

    2.2MB

  • memory/1704-126-0x000007FEF3EC0000-0x000007FEF3FD2000-memory.dmp

    Filesize

    1.1MB

  • memory/1704-128-0x000007FEF3E50000-0x000007FEF3E75000-memory.dmp

    Filesize

    148KB

  • memory/1704-127-0x000007FEF3E80000-0x000007FEF3EB5000-memory.dmp

    Filesize

    212KB

  • memory/1704-129-0x000007FEF3E30000-0x000007FEF3E41000-memory.dmp

    Filesize

    68KB

  • memory/1704-130-0x000007FEF3DC0000-0x000007FEF3E21000-memory.dmp

    Filesize

    388KB

  • memory/1704-131-0x000007FEF3C60000-0x000007FEF3C71000-memory.dmp

    Filesize

    68KB

  • memory/1704-132-0x000007FEF3C40000-0x000007FEF3C52000-memory.dmp

    Filesize

    72KB

  • memory/1704-133-0x000007FEF3C20000-0x000007FEF3C33000-memory.dmp

    Filesize

    76KB

  • memory/1704-134-0x000007FEF3B80000-0x000007FEF3C1F000-memory.dmp

    Filesize

    636KB

  • memory/1704-135-0x000007FEF3B60000-0x000007FEF3B71000-memory.dmp

    Filesize

    68KB

  • memory/1704-136-0x000007FEF3A50000-0x000007FEF3B52000-memory.dmp

    Filesize

    1.0MB

  • memory/1704-138-0x000007FEF3A10000-0x000007FEF3A21000-memory.dmp

    Filesize

    68KB

  • memory/1704-137-0x000007FEF3A30000-0x000007FEF3A41000-memory.dmp

    Filesize

    68KB

  • memory/1704-139-0x000007FEF39F0000-0x000007FEF3A01000-memory.dmp

    Filesize

    68KB

  • memory/1704-140-0x000007FEF39D0000-0x000007FEF39E2000-memory.dmp

    Filesize

    72KB

  • memory/1704-141-0x000007FEF39B0000-0x000007FEF39C8000-memory.dmp

    Filesize

    96KB

  • memory/1704-142-0x000007FEF3990000-0x000007FEF39A6000-memory.dmp

    Filesize

    88KB

  • memory/1704-143-0x000007FEF3960000-0x000007FEF3989000-memory.dmp

    Filesize

    164KB

  • memory/1704-144-0x000007FEF3940000-0x000007FEF3952000-memory.dmp

    Filesize

    72KB

  • memory/1704-145-0x000007FEF3920000-0x000007FEF3931000-memory.dmp

    Filesize

    68KB

  • memory/1704-146-0x000007FEF3900000-0x000007FEF3911000-memory.dmp

    Filesize

    68KB