Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
5s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
22/10/2023, 13:11
Behavioral task
behavioral1
Sample
rbxfpsunlocker.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
rbxfpsunlocker.exe
Resource
win10v2004-20230915-en
General
-
Target
rbxfpsunlocker.exe
-
Size
7.7MB
-
MD5
09a6438ca4c9c813b99665e25de611c7
-
SHA1
d42b1a17419b701604672ec234af9bc5fde011f0
-
SHA256
4b7c7af734a54ddb16f12c27b1321fdde53da8aa0560427e56ce47a3c7fd9002
-
SHA512
eefe88b44a338f97ebfdb1301c1eef7fdde1147c42b7866d76c6559acf83c6492a2637f76a503b6214a1a863ab784a666a6f82fc90f48a8d0f73f9e46f4fd615
-
SSDEEP
196608:MupYS6988OshoKMuIkhVastRL5Di3uq1D7m5:RYSAOshouIkPftRL54DRE
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2888 rbxfpsunlocker.exe -
resource yara_rule behavioral1/files/0x0006000000016c3e-22.dat upx behavioral1/files/0x0006000000016c3e-23.dat upx behavioral1/memory/2888-24-0x000007FEF55F0000-0x000007FEF5BD9000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2888 2272 rbxfpsunlocker.exe 28 PID 2272 wrote to memory of 2888 2272 rbxfpsunlocker.exe 28 PID 2272 wrote to memory of 2888 2272 rbxfpsunlocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"C:\Users\Admin\AppData\Local\Temp\rbxfpsunlocker.exe"2⤵
- Loads dropped DLL
PID:2888
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab