Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10afkjourney...c5.exe
windows7-x64
4afkjourney...c5.exe
windows10-2004-x64
4$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...el.dll
windows7-x64
7$PLUGINSDI...el.dll
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
37z.dll
windows7-x64
37z.dll
windows10-2004-x64
3AFKJourney...er.exe
windows7-x64
3AFKJourney...er.exe
windows10-2004-x64
1AFKJourneyUninst.exe
windows7-x64
4AFKJourneyUninst.exe
windows10-2004-x64
4$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3CrashSight.dll
windows7-x64
1CrashSight.dll
windows10-2004-x64
1hpatchz.exe
windows7-x64
1hpatchz.exe
windows10-2004-x64
1resource/lang/ar.js
windows7-x64
3resource/lang/ar.js
windows10-2004-x64
3resource/lang/de.js
windows7-x64
3resource/lang/de.js
windows10-2004-x64
3resource/lang/en.js
windows7-x64
3resource/lang/en.js
windows10-2004-x64
3resource/lang/es.js
windows7-x64
3resource/lang/es.js
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22/06/2024, 18:10 UTC
Behavioral task
behavioral1
Sample
afkjourneysetup_912ebd41c98565070879877cdf1584c5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
afkjourneysetup_912ebd41c98565070879877cdf1584c5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NsLauncher.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NsLauncher.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SelfDel.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
7z.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
7z.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
AFKJourneyLauncher.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
AFKJourneyLauncher.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
AFKJourneyUninst.exe
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
AFKJourneyUninst.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
CrashSight.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
CrashSight.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
hpatchz.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
hpatchz.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
resource/lang/ar.js
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
resource/lang/ar.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
resource/lang/de.js
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
resource/lang/de.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
resource/lang/en.js
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
resource/lang/en.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
resource/lang/es.js
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
resource/lang/es.js
Resource
win10v2004-20240611-en
General
-
Target
AFKJourneyLauncher.exe
-
Size
8.4MB
-
MD5
45b6bdf8c267b7f0848df5ce3bdbf170
-
SHA1
063000bf7d6c8ece7a83bf19ded5c950642a6bd4
-
SHA256
f04675e786a4ee91467766316241af4970f56c31c7598de738c95042cf503de5
-
SHA512
26a82ddbb377000ea1c7d5b3cc5e554a2a5c5e968bda9a2c8fc84eac00662e259e206b70611ab28ea21db4cd79813091fa10c0a2a21dfcf3fb12b3069d2afd66
-
SSDEEP
98304:iAgCwfDwBWvmua4UkN16q1Kg653H6kcaa1Om4XdI8S4URtCGcNtCGcJVxay:iHfsBWvRzF16qKY1YDUr1cf1cTxP
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 824 AFKJourneyLauncher.exe 824 AFKJourneyLauncher.exe 824 AFKJourneyLauncher.exe 824 AFKJourneyLauncher.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 824 AFKJourneyLauncher.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 824 AFKJourneyLauncher.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestimv2-gl.farlightgames.comIN AResponseimv2-gl.farlightgames.comIN CNAMEimv2-gl.farlightgames.com.a.lahuashanbx.comimv2-gl.farlightgames.com.a.lahuashanbx.comIN A163.181.154.180
-
Remote address:8.8.8.8:53Requestpc.crashsight.wetest.netIN AResponsepc.crashsight.wetest.netIN A101.33.48.102
-
Remote address:8.8.8.8:53Requestapp.farlightgames.comIN AResponseapp.farlightgames.comIN CNAMEapp-cdn.farlightgames.comapp-cdn.farlightgames.comIN CNAMEapp.farlightgames.com.edgesuite.netapp.farlightgames.com.edgesuite.netIN CNAMEa611.r.akamai.neta611.r.akamai.netIN A23.14.90.80a611.r.akamai.netIN A23.14.90.74
-
Remote address:8.8.8.8:53Requestapp.farlightgames.comIN AResponseapp.farlightgames.comIN CNAMEapp-cdn.farlightgames.comapp-cdn.farlightgames.comIN CNAMEapp.farlightgames.com.edgesuite.netapp.farlightgames.com.edgesuite.netIN CNAMEa611.r.akamai.neta611.r.akamai.netIN A23.14.90.80a611.r.akamai.netIN A23.14.90.74
-
Remote address:8.8.8.8:53Requeststatic-gl.farlightgames.comIN AResponsestatic-gl.farlightgames.comIN CNAMEstatic-gl-gcp.farlightgames.comstatic-gl-gcp.farlightgames.comIN A34.104.34.239
-
Remote address:8.8.8.8:53Requeststatic-gl.lilithgame.comIN AResponsestatic-gl.lilithgame.comIN CNAMEstatic-gl.lilithgame.com.w.alikunlun.comstatic-gl.lilithgame.com.w.alikunlun.comIN A79.133.176.211static-gl.lilithgame.com.w.alikunlun.comIN A79.133.176.225static-gl.lilithgame.com.w.alikunlun.comIN A79.133.176.224static-gl.lilithgame.com.w.alikunlun.comIN A79.133.176.213static-gl.lilithgame.com.w.alikunlun.comIN A79.133.176.223static-gl.lilithgame.com.w.alikunlun.comIN A79.133.176.222static-gl.lilithgame.com.w.alikunlun.comIN A79.133.176.166static-gl.lilithgame.com.w.alikunlun.comIN A79.133.176.219
-
Remote address:8.8.8.8:53Requestpsp-api.farlightgames.comIN AResponsepsp-api.farlightgames.comIN CNAMEaf36ac68061cc485ebbdc1279a1002cf-438bb6bf33a4e4a1.elb.ap-southeast-1.amazonaws.comaf36ac68061cc485ebbdc1279a1002cf-438bb6bf33a4e4a1.elb.ap-southeast-1.amazonaws.comIN A54.179.8.26af36ac68061cc485ebbdc1279a1002cf-438bb6bf33a4e4a1.elb.ap-southeast-1.amazonaws.comIN A13.215.107.93af36ac68061cc485ebbdc1279a1002cf-438bb6bf33a4e4a1.elb.ap-southeast-1.amazonaws.comIN A18.141.97.108
-
Remote address:8.8.8.8:53Requestd1s9fa96v0yqzs.cloudfront.netIN AResponsed1s9fa96v0yqzs.cloudfront.netIN A18.239.190.85d1s9fa96v0yqzs.cloudfront.netIN A18.239.190.133d1s9fa96v0yqzs.cloudfront.netIN A18.239.190.135d1s9fa96v0yqzs.cloudfront.netIN A18.239.190.142
-
Remote address:8.8.8.8:53Requesttsg-hdp-raw-log.data.cn-singapore-lls01-d01.sls-pub.farlightgames.comIN AResponsetsg-hdp-raw-log.data.cn-singapore-lls01-d01.sls-pub.farlightgames.comIN A34.36.110.19
-
-
1.3kB 8.3kB 12 14
-
1.4kB 4.5kB 9 11
-
1.7kB 7.3kB 15 17
-
1.5kB 7.4kB 14 16
-
1.3kB 5.8kB 11 10
-
1.4kB 12.5kB 13 14
-
1.1kB 5.7kB 7 8
-
-
-
-
-
-
-
1.1kB 6.6kB 7 8
-
-
1.1kB 5.7kB 7 8
-
-
1.2kB 8.7kB 8 10
-
1.3kB 5.6kB 11 10
-
18.8kB 1.0MB 391 772
-
-
1.3kB 5.7kB 11 11
-
1.6kB 14.1kB 14 17
-
1.4kB 11.8kB 13 15
-
1.3kB 5.6kB 11 10
-
2.1kB 7.1kB 15 14
-
-
-
-
-
-
-
1.2kB 6.7kB 11 12
-
2.7kB 95.8kB 43 75
-
1.7kB 8.3kB 15 17
-
1.3kB 5.7kB 11 12
-
1.3kB 7.0kB 11 11
-
34.36.110.19:443tsg-hdp-raw-log.data.cn-singapore-lls01-d01.sls-pub.farlightgames.comtlsAFKJourneyLauncher.exe3.1kB 5.3kB 10 10
-
1.2kB 6.7kB 11 11
-
3.2kB 125.2kB 54 97
-
-
1.3kB 5.7kB 11 11
-
1.4kB 6.9kB 12 13
-
1.2kB 6.7kB 11 11
-
-
-
-
-
-
-
-
-
-
-
-
2.5kB 85.0kB 39 67
-
1.3kB 5.7kB 11 11
-
-
1.3kB 6.8kB 11 11
-
1.2kB 6.7kB 11 12
-
3.9kB 165.2kB 68 126
-
-
-
1.3kB 5.7kB 11 12
-
1.3kB 6.6kB 11 12
-
1.2kB 6.7kB 11 12
-
2.5kB 84.2kB 39 67
-
1.3kB 5.6kB 11 10
-
1.4kB 6.6kB 12 12
-
1.2kB 6.7kB 11 12
-
-
-
-
-
-
-
-
-
-
2.0kB 49.9kB 27 44
-
1.2kB 6.7kB 11 12
-
9.7kB 517.1kB 194 377
-
-
-
-
1.2kB 6.7kB 11 12
-
4.8kB 224.6kB 89 168
-
-
-
1.2kB 6.7kB 11 11
-
-
7.7kB 396.7kB 150 290
-
-
1.3kB 5.7kB 11 11
-
-
2.2kB 6.9kB 14 12
-
1.3kB 5.6kB 11 10
-
1.3kB 6.9kB 11 12
-
1.3kB 5.7kB 11 11
-
-
-
-
-
1.3kB 6.5kB 11 12
-
-
1.4kB 5.7kB 12 11
-
1.3kB 6.6kB 11 12
-
52 B 1
-
-
-
1.3kB 5.7kB 11 12
-
1.4kB 7.0kB 12 13
-
1.3kB 5.6kB 11 10
-
1.3kB 7.0kB 11 11
-
-
-
-
-
1.4kB 7.0kB 12 12
-
-
2.8kB 7.0kB 14 15
-
1.4kB 6.9kB 12 11
-
1.3kB 6.8kB 11 12
-
-
-
71 B 141 B 1 1
DNS Request
imv2-gl.farlightgames.com
DNS Response
163.181.154.180
-
70 B 86 B 1 1
DNS Request
pc.crashsight.wetest.net
DNS Response
101.33.48.102
-
67 B 198 B 1 1
DNS Request
app.farlightgames.com
DNS Response
23.14.90.8023.14.90.74
-
67 B 198 B 1 1
DNS Request
app.farlightgames.com
DNS Response
23.14.90.8023.14.90.74
-
73 B 117 B 1 1
DNS Request
static-gl.farlightgames.com
DNS Response
34.104.34.239
-
70 B 249 B 1 1
DNS Request
static-gl.lilithgame.com
DNS Response
79.133.176.21179.133.176.22579.133.176.22479.133.176.21379.133.176.22379.133.176.22279.133.176.16679.133.176.219
-
71 B 212 B 1 1
DNS Request
psp-api.farlightgames.com
DNS Response
54.179.8.2613.215.107.9318.141.97.108
-
75 B 139 B 1 1
DNS Request
d1s9fa96v0yqzs.cloudfront.net
DNS Response
18.239.190.8518.239.190.13318.239.190.13518.239.190.142
-
8.8.8.8:53tsg-hdp-raw-log.data.cn-singapore-lls01-d01.sls-pub.farlightgames.comdnsAFKJourneyLauncher.exe115 B 131 B 1 1
DNS Request
tsg-hdp-raw-log.data.cn-singapore-lls01-d01.sls-pub.farlightgames.com
DNS Response
34.36.110.19