Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3plpscripts..._1.zip
windows11-21h2-x64
1plpscripts...ELP.md
windows11-21h2-x64
1plpscripts...ll.bat
windows11-21h2-x64
10plpscripts...bot.py
windows11-21h2-x64
3plpscripts...st.zip
windows11-21h2-x64
1archive/data.pkl
windows11-21h2-x64
3archive/da...988160
windows11-21h2-x64
1archive/da...651120
windows11-21h2-x64
1archive/da...651216
windows11-21h2-x64
1archive/da...760992
windows11-21h2-x64
1archive/da...785696
windows11-21h2-x64
1archive/da...797712
windows11-21h2-x64
1archive/da...665328
windows11-21h2-x64
1archive/da...860848
windows11-21h2-x64
1archive/da...060304
windows11-21h2-x64
1archive/da...374192
windows11-21h2-x64
1archive/da...374288
windows11-21h2-x64
1archive/da...501856
windows11-21h2-x64
1archive/da...582784
windows11-21h2-x64
1archive/da...647568
windows11-21h2-x64
1archive/da...701936
windows11-21h2-x64
1archive/da...741200
windows11-21h2-x64
1archive/da...778800
windows11-21h2-x64
1archive/da...274048
windows11-21h2-x64
1plpscripts...g.json
windows11-21h2-x64
3plpscripts...e.json
windows11-21h2-x64
3plpscripts...ain.py
windows11-21h2-x64
3plpscripts...ev2.py
windows11-21h2-x64
3plpscripts...t__.py
windows11-21h2-x64
3plpscripts...me.dll
windows11-21h2-x64
1plpscripts...rt.bat
windows11-21h2-x64
1plpscripts...ts.txt
windows11-21h2-x64
3Analysis
-
max time kernel
91s -
max time network
98s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/05/2024, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
plpscripts_freeV2_1.zip
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
plpscripts_freeV2/1.READ ME & THIS HAS HELP.md
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
plpscripts_freeV2/auto_setup_install.bat
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
plpscripts_freeV2/plpscripts free ai aimbot/aimbot.py
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
plpscripts_freeV2/plpscripts free ai aimbot/config/best.zip
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
archive/data.pkl
Resource
win11-20240426-en
Behavioral task
behavioral7
Sample
archive/data/94907481988160
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
archive/data/94909076651120
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
archive/data/94909076651216
Resource
win11-20240419-en
Behavioral task
behavioral10
Sample
archive/data/94909076760992
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
archive/data/94909076785696
Resource
win11-20240426-en
Behavioral task
behavioral12
Sample
archive/data/94909076797712
Resource
win11-20240426-en
Behavioral task
behavioral13
Sample
archive/data/94909083665328
Resource
win11-20240508-en
Behavioral task
behavioral14
Sample
archive/data/94909083860848
Resource
win11-20240508-en
Behavioral task
behavioral15
Sample
archive/data/94909084060304
Resource
win11-20240508-en
Behavioral task
behavioral16
Sample
archive/data/94909084374192
Resource
win11-20240508-en
Behavioral task
behavioral17
Sample
archive/data/94909084374288
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
archive/data/94909084501856
Resource
win11-20240508-en
Behavioral task
behavioral19
Sample
archive/data/94909084582784
Resource
win11-20240426-en
Behavioral task
behavioral20
Sample
archive/data/94909084647568
Resource
win11-20240426-en
Behavioral task
behavioral21
Sample
archive/data/94909084701936
Resource
win11-20240426-en
Behavioral task
behavioral22
Sample
archive/data/94909084741200
Resource
win11-20240508-en
Behavioral task
behavioral23
Sample
archive/data/94909084778800
Resource
win11-20240426-en
Behavioral task
behavioral24
Sample
archive/data/94909086274048
Resource
win11-20240426-en
Behavioral task
behavioral25
Sample
plpscripts_freeV2/plpscripts free ai aimbot/config/config.json
Resource
win11-20240419-en
Behavioral task
behavioral26
Sample
plpscripts_freeV2/plpscripts free ai aimbot/config/style.json
Resource
win11-20240508-en
Behavioral task
behavioral27
Sample
plpscripts_freeV2/plpscripts free ai aimbot/main.py
Resource
win11-20240508-en
Behavioral task
behavioral28
Sample
plpscripts_freeV2/plpscripts free ai aimbot/plpscripts_freev2.py
Resource
win11-20240426-en
Behavioral task
behavioral29
Sample
plpscripts_freeV2/plpscripts free ai aimbot/pyarmor_runtime_000000/__init__.py
Resource
win11-20240508-en
Behavioral task
behavioral30
Sample
plpscripts_freeV2/plpscripts free ai aimbot/pyarmor_runtime_000000/pyarmor_runtime.dll
Resource
win11-20240426-en
Behavioral task
behavioral31
Sample
plpscripts_freeV2/plpscripts free ai aimbot/start.bat
Resource
win11-20240419-en
Behavioral task
behavioral32
Sample
plpscripts_freeV2/requirements.txt
Resource
win11-20240508-en
General
-
Target
plpscripts_freeV2/plpscripts free ai aimbot/start.bat
-
Size
40B
-
MD5
1e7695df315480d6bcd57e8971d8d881
-
SHA1
f4f5f764f237b49d698ca1fd5ab0c32157c7e511
-
SHA256
ee6e664af57a744c3d5587adc2cc1493262fe8f0b90bc8bfc0951461e99139fd
-
SHA512
0454dc00587ca2dd1ec9b74643c6707f11337b2f1a0cec9f094ba0dc9ceba0a310635341abaf069e1c3850dde925d6dc0c98c5990f765654dccdb8e94df49f26
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2892 wrote to memory of 3636 2892 cmd.exe 82 PID 2892 wrote to memory of 3636 2892 cmd.exe 82 PID 2892 wrote to memory of 3636 2892 cmd.exe 82
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\plpscripts_freeV2\plpscripts free ai aimbot\start.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython plpscripts_freev2.py2⤵PID:3636
-