Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

[FreeTP.Or...ne.exe

windows7-x64

7

[FreeTP.Or...ne.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 09:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    [FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe

  • Size

    6.3MB

  • MD5

    4c37c102a240b35cac574ad70c9be545

  • SHA1

    44c8c744c420e7744694b0b15be59bbf598c4fd0

  • SHA256

    efbdde22bb6a09acd4782f0e11ef49de59491acc431700ceba6bc5f184f39765

  • SHA512

    9d99bfe91bd57c18842f1d0c036eec1357688d9af344343f3639a070857391a544ee7cd57986ed0652fcf54f58e768537c988276105699b7f333887bcf50d9fa

  • SSDEEP

    98304:ATp6Nv/WiEKDxTY/Utas2r7aFB6tK0d1oXtvtlpCmnWJMOgnsARBFaADs6UDgk9X:AoNv/WwxTAUAZ7aFh0DoBcXJMb/e6Uxp

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe
    "C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:532
    • C:\Users\Admin\AppData\Local\Temp\is-187A2.tmp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-187A2.tmp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.tmp" /SL5="$401D6,6111299,152064,C:\Users\Admin\AppData\Local\Temp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      PID:1412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-0ICAV.tmp\CheckBox.png
    Filesize

    7KB

    MD5

    abd301b0263b0e0cebdd71e4855ac7d3

    SHA1

    1e8480c3f3b47a5daa7cb1183b6a7a49998cda6e

    SHA256

    aff003e75bbf410ed2f7ca8728afe01ab4a517536647ad20109d00c4adf570d5

    SHA512

    b5abb188bd23d7fc2e3253a5639cc3eba6d21774dba55b43395cf84ddb49fe707ad54dc0a7f157e6b0804c1662d9c4cb4bef2787aafb194ea73fbebd1a63bb6b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-0ICAV.tmp\WizardImage.jpg
    Filesize

    62KB

    MD5

    b91658597f15d7f689c86f5a2e7824bd

    SHA1

    00da609aa0b39140b767a3bc2644433d64edbd71

    SHA256

    b3cda6ab45ad5aa6a0a5f700d2c8987b3c1c1ebda63165d9bd5a566b24dcbd84

    SHA512

    00b287fb14b947edf4b16d52243e9a992595d8894e83d8590473103d1b54a4670b323db13c4f78234617c44f905baf517e68fcceaad313f3ea7cd44cf036daea

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-0ICAV.tmp\botva2.dll
    Filesize

    32KB

    MD5

    295832fa6400cb3407cfe84b06785531

    SHA1

    7068910c2e0ea7f4535c770517e29d9c2d2ee77b

    SHA256

    13e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784

    SHA512

    50516f9761efd14641f65bd773cfdd50c4ab0de977e094ba9227796dc319d9330321c7914243fc7dc04b5716752395f8dac8ccdfdb98ba7e5f5c1172408ce57b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-0ICAV.tmp\button.png
    Filesize

    12KB

    MD5

    51af4120d6d22b1126cc87a5143740ef

    SHA1

    1cb4e91e765537a72c9628056d29fbd6a7ce515c

    SHA256

    c74fed62141f7e666379a0b00d5b39c86975332cf08151cbe8cab88eff2c393c

    SHA512

    2595be954684ca34bc9284337524a5191c72fbea46b59555a5113ed8404a1e7ab6c2aa0f5a975f832cccdd8934ff1140c679ecd940f31cc14b4c3a362a225cbc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-0ICAV.tmp\get_hw_caps.dll
    Filesize

    76KB

    MD5

    2e35d2894df3b691dbd8e0d4f4c84efc

    SHA1

    d0fc14963e397d185e9f2d7dea1d07bc6308d5b9

    SHA256

    869079ba362cbc560d673db290248ec2aa075a74f22a82d90621f1118f8e1c4d

    SHA512

    29ba662ab2e77aef0547ff76213a1b6ef52be27a446923790a27cf8b69377621048387dbb9f22001b6d15837dddada84c7350614ec9622258319658822705f90

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-0ICAV.tmp\innocallback.dll
    Filesize

    63KB

    MD5

    1c55ae5ef9980e3b1028447da6105c75

    SHA1

    f85218e10e6aa23b2f5a3ed512895b437e41b45c

    SHA256

    6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

    SHA512

    1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-187A2.tmp\[FreeTP.Org]Dead-Island-2-Multiplayer-Fix-Online.tmp
    Filesize

    1.4MB

    MD5

    7300211c571951be86be6c6f8cdfc09d

    SHA1

    5464e16689003406513c7677b3d970f673551d18

    SHA256

    e77c3184d90f6e7a1276bb8389aba06296be97deb2e8a3433ca9a537538696da

    SHA512

    9c340edcd63c87565a9de26892d2e83647798583cc942bf608b54e86b8fd36bc2ad64421241b88f0a0682e7c006a5af712e62d3231ca5a81264d8b1a1905ebb4

    Download Submit

  • memory/532-2-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/532-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/532-110-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1412-6-0x0000000002330000-0x0000000002331000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1412-34-0x00000000033A0000-0x00000000033AD000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1412-76-0x0000000005E60000-0x0000000005E75000-memory.dmp

    Filesize

    84KB

    Download

  • memory/1412-111-0x0000000000400000-0x000000000057B000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/1412-113-0x0000000005E60000-0x0000000005E75000-memory.dmp

    Filesize

    84KB

    Download

  • memory/1412-112-0x00000000033A0000-0x00000000033AD000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1412-118-0x0000000002330000-0x0000000002331000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1412-121-0x00000000033A0000-0x00000000033AD000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1412-122-0x0000000005E60000-0x0000000005E75000-memory.dmp

    Filesize

    84KB

    Download