Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

31/08/2023, 02:27

230831-cxlypscd38 8

05/06/2023, 10:42

230605-mrst6sga44 10

05/06/2023, 10:36

230605-mnqweaga25 10

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/08/2023, 02:27

General

  • Target

    Roblox Bedwars Best GUI - Linkvertise Downloader_vNS3-h1.exe

  • Size

    10.8MB

  • MD5

    fc30f38c629fbafcfd1f4a4895814c46

  • SHA1

    e6b298591f7034463f603ede1573c8a198938b7f

  • SHA256

    40e1b53fb04746ac4a0561f5ab781291069b90232215afc36320263308a28ec9

  • SHA512

    74aba9bd29a9d6200f5b35a15f66c6edb57b3a8cfa24b3c04f2a90224d64bcda7564047a5f88698107aaf5e18c6d22bc6d8f5f3fdfdda2bb86aeb800d90e37d2

  • SSDEEP

    196608:w38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ugha:Z1MlCC0Ybzf4zZKUok5oXN8x

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks for any installed AV software in registry 1 TTPs 6 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Roblox Bedwars Best GUI - Linkvertise Downloader_vNS3-h1.exe
    "C:\Users\Admin\AppData\Local\Temp\Roblox Bedwars Best GUI - Linkvertise Downloader_vNS3-h1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Users\Admin\AppData\Local\Temp\is-8O4MR.tmp\Roblox Bedwars Best GUI - Linkvertise Downloader_vNS3-h1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8O4MR.tmp\Roblox Bedwars Best GUI - Linkvertise Downloader_vNS3-h1.tmp" /SL5="$A002C,10373288,1230848,C:\Users\Admin\AppData\Local\Temp\Roblox Bedwars Best GUI - Linkvertise Downloader_vNS3-h1.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-8O4MR.tmp\Roblox Bedwars Best GUI - Linkvertise Downloader_vNS3-h1.tmp

    Filesize

    3.3MB

    MD5

    36b37e0b2ce4747ceac6f895ec3e1660

    SHA1

    1b961ff51b855a48626bf03326ac08c68744b3ca

    SHA256

    d189b03c957346c8beee98d3f2b1956381eefb67e7818b476e93494e28acd681

    SHA512

    ac8a2797769743106631a2aa8f36940ecad11c6c91ac8e86d1a846ffeb3005a3704ce1401290d9dca54b859a4c5ee261c8804f7b7e8d59a01047a3e1126d150f

  • C:\Users\Admin\AppData\Local\Temp\is-ITDGL.tmp\AppUtils.dll

    Filesize

    1.8MB

    MD5

    43ce6d593abd5141a3139603f352ae05

    SHA1

    a97c75e23d275dddfde15ef5fdf3ff3253c0992c

    SHA256

    94e874f2702ea6be50e7d74864b66e7f763449c3db237803f3fad6adfd64ed3d

    SHA512

    bfc527529e5f73ba190dfc5bd043175c7e2ae963b665d6d39421c29e025020f1d593dc88b7bee33d86ef6b4f7a4c5e1a0339df4e99cab6849a275d1dda9f439f

  • C:\Users\Admin\AppData\Local\Temp\is-ITDGL.tmp\botva2.dll

    Filesize

    37KB

    MD5

    67965a5957a61867d661f05ae1f4773e

    SHA1

    f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

    SHA256

    450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

    SHA512

    c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

  • C:\Users\Admin\AppData\Local\Temp\is-ITDGL.tmp\botva2.dll

    Filesize

    37KB

    MD5

    67965a5957a61867d661f05ae1f4773e

    SHA1

    f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

    SHA256

    450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

    SHA512

    c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

  • C:\Users\Admin\AppData\Local\Temp\is-ITDGL.tmp\side-logo.png

    Filesize

    29KB

    MD5

    06b0076d9f4e2488d32855a0161e9c74

    SHA1

    7dbc3c098f7fb1256aeca79c256b75802b5fdd69

    SHA256

    929243f002eb4209a9e68af6744a3d63ece2b173c910a59d6752536dabf3870b

    SHA512

    7cecc1fc1c13f97dfe1ae7592918c9df16233851a8dd667ac2199b92fd24410a6ef76acfa014cd00aad2d27dfe2887f41100563cf2240f720466dbebaed0375a

  • memory/860-1-0x0000000000400000-0x000000000053A000-memory.dmp

    Filesize

    1.2MB

  • memory/860-37-0x0000000000400000-0x000000000053A000-memory.dmp

    Filesize

    1.2MB

  • memory/2772-6-0x0000000002620000-0x0000000002621000-memory.dmp

    Filesize

    4KB

  • memory/2772-31-0x00000000063B0000-0x00000000063BF000-memory.dmp

    Filesize

    60KB

  • memory/2772-38-0x0000000000400000-0x000000000075C000-memory.dmp

    Filesize

    3.4MB

  • memory/2772-39-0x00000000063B0000-0x00000000063BF000-memory.dmp

    Filesize

    60KB

  • memory/2772-40-0x0000000002620000-0x0000000002621000-memory.dmp

    Filesize

    4KB