Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20/04/2023, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
Fortnite_Hack_v3.2.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Fortnite_Hack_v3.2.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10v2004-20230220-en
General
-
Target
Setup.exe
-
Size
1011.0MB
-
MD5
d35a4d0264151fe12392c2de7b862df5
-
SHA1
2db6d67aa751316ce81b539c29283e6fdf7ea127
-
SHA256
bff00b68ddba7142583a95fe90cb337ba59fef25fc0696847a19b60a4a782e6a
-
SHA512
eb5b22d44e90d70da0e6142b5a4725f1475a0db5c132aa783b11abc54fde6c7b51d31644be34de0fd27eb69598c592fbf9a289cb36e698c460bd7187f38069a9
-
SSDEEP
24576:cMOCW00r5wCxnzmkMDghx9qinBSl6QOM6LvFuPROlW5wwwwwwwwwwwwwwwwwwwwQ:bBW00GCZ6e5rdu8lWK
Malware Config
Extracted
vidar
3.5
395ff08de6af5e2dbf2e94b1ee2175c2
https://steamcommunity.com/profiles/76561199497218285
https://t.me/tg_duckworld
-
profile_id_v2
395ff08de6af5e2dbf2e94b1ee2175c2
-
user_agent
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Vivaldi/3.7
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 772 jsc.exe 772 jsc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1396 set thread context of 772 1396 Setup.exe 36 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1396 Setup.exe 1396 Setup.exe 1396 Setup.exe 1396 Setup.exe 1396 Setup.exe 1396 Setup.exe 1396 Setup.exe 1396 Setup.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1396 Setup.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1396 wrote to memory of 1736 1396 Setup.exe 28 PID 1396 wrote to memory of 1736 1396 Setup.exe 28 PID 1396 wrote to memory of 1736 1396 Setup.exe 28 PID 1396 wrote to memory of 2016 1396 Setup.exe 29 PID 1396 wrote to memory of 2016 1396 Setup.exe 29 PID 1396 wrote to memory of 2016 1396 Setup.exe 29 PID 1396 wrote to memory of 2012 1396 Setup.exe 30 PID 1396 wrote to memory of 2012 1396 Setup.exe 30 PID 1396 wrote to memory of 2012 1396 Setup.exe 30 PID 1396 wrote to memory of 612 1396 Setup.exe 31 PID 1396 wrote to memory of 612 1396 Setup.exe 31 PID 1396 wrote to memory of 612 1396 Setup.exe 31 PID 1396 wrote to memory of 1840 1396 Setup.exe 32 PID 1396 wrote to memory of 1840 1396 Setup.exe 32 PID 1396 wrote to memory of 1840 1396 Setup.exe 32 PID 1396 wrote to memory of 996 1396 Setup.exe 33 PID 1396 wrote to memory of 996 1396 Setup.exe 33 PID 1396 wrote to memory of 996 1396 Setup.exe 33 PID 1396 wrote to memory of 472 1396 Setup.exe 34 PID 1396 wrote to memory of 472 1396 Setup.exe 34 PID 1396 wrote to memory of 472 1396 Setup.exe 34 PID 1396 wrote to memory of 1060 1396 Setup.exe 35 PID 1396 wrote to memory of 1060 1396 Setup.exe 35 PID 1396 wrote to memory of 1060 1396 Setup.exe 35 PID 1396 wrote to memory of 772 1396 Setup.exe 36 PID 1396 wrote to memory of 772 1396 Setup.exe 36 PID 1396 wrote to memory of 772 1396 Setup.exe 36 PID 1396 wrote to memory of 772 1396 Setup.exe 36 PID 1396 wrote to memory of 772 1396 Setup.exe 36 PID 1396 wrote to memory of 772 1396 Setup.exe 36 PID 1396 wrote to memory of 772 1396 Setup.exe 36 PID 1396 wrote to memory of 772 1396 Setup.exe 36 PID 1396 wrote to memory of 772 1396 Setup.exe 36 PID 1396 wrote to memory of 772 1396 Setup.exe 36 PID 1396 wrote to memory of 772 1396 Setup.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵PID:1736
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"2⤵PID:2016
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"2⤵PID:2012
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"2⤵PID:612
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"2⤵PID:1840
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"2⤵PID:996
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"2⤵PID:472
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:1060
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵
- Loads dropped DLL
PID:772
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571