Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
1Valorant O...ch.zip
windows7-x64
1Valorant O...ch.zip
windows10-2004-x64
1Valorant O...T).lnk
windows7-x64
1Valorant O...T).lnk
windows10-2004-x64
1Valorant O...e).cmd
windows7-x64
1Valorant O...e).cmd
windows10-2004-x64
1Valorant O...es.cmd
windows7-x64
7Valorant O...es.cmd
windows10-2004-x64
7Valorant O...es.cmd
windows7-x64
7Valorant O...es.cmd
windows10-2004-x64
1Valorant O...he.bat
windows7-x64
8Valorant O...he.bat
windows10-2004-x64
8Valorant O...he.cmd
windows7-x64
1Valorant O...he.cmd
windows10-2004-x64
1Valorant O...Up.lnk
windows7-x64
7Valorant O...Up.lnk
windows10-2004-x64
7Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 09:33
Static task
static1
Behavioral task
behavioral1
Sample
Valorant Optimization Pack - OGTech.zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Valorant Optimization Pack - OGTech.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Valorant Optimization Pack - OGTech/1. Optmize Desktop & Laptop/Create A Restore Point (IMPORTANT).lnk
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Valorant Optimization Pack - OGTech/1. Optmize Desktop & Laptop/Create A Restore Point (IMPORTANT).lnk
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Clear DNS Cache (Ping Improve).cmd
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Clear DNS Cache (Ping Improve).cmd
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Delete Log Files.cmd
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Delete Log Files.cmd
Resource
win10v2004-20240220-en
Behavioral task
behavioral9
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Delete Temporary Files.cmd
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Delete Temporary Files.cmd
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Delete Thumbnail Cache.bat
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Delete Thumbnail Cache.bat
Resource
win10v2004-20240220-en
Behavioral task
behavioral13
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Delete Windows Update Cache.cmd
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Delete Windows Update Cache.cmd
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Disk Clean-Up.lnk
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
Valorant Optimization Pack - OGTech/4. Clean-Ups/Disk Clean-Up.lnk
Resource
win10v2004-20231215-en
General
-
Target
Valorant Optimization Pack - OGTech/4. Clean-Ups/Clear DNS Cache (Ping Improve).cmd
-
Size
99B
-
MD5
f0deed8e4300ddeae9a411eb67a8570a
-
SHA1
6ef6b925476d5812a8a41c1c44605d091e4bef69
-
SHA256
e22e3df20ba829d68412f37848ef23faf72927f529de22f5e5c127488d2724b3
-
SHA512
bc51c3069e781317807a731b10074401c8f738e5bb0fb5bb39071c9b18878e128dcd1efb79e78852dc8f1f74311de4d9a63ee3fd21f734d98d9851faafb6138c
Malware Config
Signatures
-
Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
pid Process 3700 ipconfig.exe 2508 ipconfig.exe 3076 ipconfig.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2012 wrote to memory of 3700 2012 cmd.exe 86 PID 2012 wrote to memory of 3700 2012 cmd.exe 86 PID 2012 wrote to memory of 2508 2012 cmd.exe 87 PID 2012 wrote to memory of 2508 2012 cmd.exe 87 PID 2012 wrote to memory of 3076 2012 cmd.exe 88 PID 2012 wrote to memory of 3076 2012 cmd.exe 88
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Valorant Optimization Pack - OGTech\4. Clean-Ups\Clear DNS Cache (Ping Improve).cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:3700
-
-
C:\Windows\system32\ipconfig.exeipconfig /release2⤵
- Gathers network information
PID:2508
-
-
C:\Windows\system32\ipconfig.exeipconfig /renew2⤵
- Gathers network information
PID:3076
-