Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10FN-TOOLZ-m...AN.bat
windows10-2004-x64
10Tournament...ew.exe
windows10-2004-x64
6Tournament...al.dll
windows10-2004-x64
1Tournament...UI.dll
windows10-2004-x64
1Tournament...cl.exe
windows10-2004-x64
1Tournament...uz.exe
windows10-2004-x64
9Tournament...dc.exe
windows10-2004-x64
1Tournament...ft.exe
windows10-2004-x64
1Tournament...64.exe
windows10-2004-x64
1Tournament...32.exe
windows10-2004-x64
1Tournament...64.exe
windows10-2004-x64
4Tournament...fg.exe
windows10-2004-x64
3Tournament...sg.exe
windows10-2004-x64
3Tournament...sr.exe
windows10-2004-x64
10Tournament...wg.exe
windows10-2004-x64
1Tournament...sm.dll
windows10-2004-x64
1Tournament...xy.dll
windows10-2004-x64
7Tournament...ry.dll
windows10-2004-x64
1Tournament...ll.dll
windows10-2004-x64
1Tournament...pi.dll
windows10-2004-x64
1Tournament...32.dll
windows10-2004-x64
1Tournament...da.dll
windows10-2004-x64
1Tournament...ve.dll
windows10-2004-x64
1Tournament...70.dll
windows10-2004-x64
1Tournament...rl.exe
windows10-2004-x64
3Tournament...64.exe
windows10-2004-x64
3Tournament...cs.exe
windows10-2004-x64
8Tournament...64.exe
windows10-2004-x64
10Tournament...tm.exe
windows10-2004-x64
3Tournament...mc.exe
windows10-2004-x64
1FN-TOOLZ-m...er.exe
windows10-2004-x64
9FN-TOOLZ-m...er.bat
windows10-2004-x64
1Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2024, 20:50
Behavioral task
behavioral1
Sample
FN-TOOLZ-main/FNCLEAN.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
Tournament_Fixer/AdditionalRuntimes/DevManView.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Tournament_Fixer/AdditionalRuntimes/MCCSPal.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
Tournament_Fixer/AdditionalRuntimes/MaintenanceUI.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
Tournament_Fixer/AdditionalRuntimes/ccl.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral6
Sample
Tournament_Fixer/AdditionalRuntimes/cpuz.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Tournament_Fixer/AdditionalRuntimes/ddc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
Tournament_Fixer/AdditionalRuntimes/hssft.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
Tournament_Fixer/AdditionalRuntimes/hwbd64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
Tournament_Fixer/AdditionalRuntimes/hwinfo32.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Tournament_Fixer/AdditionalRuntimes/hwinfo64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral12
Sample
Tournament_Fixer/AdditionalRuntimes/jfg.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Tournament_Fixer/AdditionalRuntimes/jsg.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
Tournament_Fixer/AdditionalRuntimes/jsr.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Tournament_Fixer/AdditionalRuntimes/kwg.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral16
Sample
Tournament_Fixer/AdditionalRuntimes/lsm.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Tournament_Fixer/AdditionalRuntimes/lsmproxy.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
Tournament_Fixer/AdditionalRuntimes/lstelemetry.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Tournament_Fixer/AdditionalRuntimes/luainstall.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
Tournament_Fixer/AdditionalRuntimes/luiapi.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Tournament_Fixer/AdditionalRuntimes/lz32.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral22
Sample
Tournament_Fixer/AdditionalRuntimes/mcicda.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Tournament_Fixer/AdditionalRuntimes/mciwave.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral24
Sample
Tournament_Fixer/AdditionalRuntimes/mfc70.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
Tournament_Fixer/AdditionalRuntimes/nvrl.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral26
Sample
Tournament_Fixer/AdditionalRuntimes/nvrl64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Tournament_Fixer/AdditionalRuntimes/tcs.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
Tournament_Fixer/AdditionalRuntimes/tcs64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
Tournament_Fixer/AdditionalRuntimes/tm.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
Tournament_Fixer/AdditionalRuntimes/wmc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
FN-TOOLZ-main/applecleaner.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral32
Sample
FN-TOOLZ-main/serial_checker.bat
Resource
win10v2004-20240508-en
General
-
Target
Tournament_Fixer/AdditionalRuntimes/ddc.exe
-
Size
200KB
-
MD5
2d6af440d55fe5c2a1de3d0cfdf5a5c6
-
SHA1
f1f5a6e98892e66f696feab226ba90cd065ee247
-
SHA256
1efe7e80d8bda78d69a00ff26b21c02c71db8469193de7822e5529225bd0ec56
-
SHA512
21706bfc96b2c70860f02cb19ec357d7564ab27af206969a9ddaa667ef549a81141584a4fe6c3d7e093b7abe40fa8677817565dc0fc6f70850ee5ed6cbdb8c2c
-
SSDEEP
6144:otzsb5Uh28+V1WW69B9VjMdxPedN9ug0z9TB9SGaIRoq7fhHKv:otzE5elwLz9TrlaIo2fhHKv
Malware Config
Signatures
-
Kills process with taskkill 3 IoCs
pid Process 4452 taskkill.exe 4196 taskkill.exe 2164 taskkill.exe -
Modifies registry key 1 TTPs 2 IoCs
pid Process 3480 reg.exe 3536 reg.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4452 taskkill.exe Token: SeDebugPrivilege 4196 taskkill.exe Token: SeDebugPrivilege 2164 taskkill.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1164 wrote to memory of 1352 1164 ddc.exe 82 PID 1164 wrote to memory of 1352 1164 ddc.exe 82 PID 1352 wrote to memory of 4452 1352 cmd.exe 83 PID 1352 wrote to memory of 4452 1352 cmd.exe 83 PID 1352 wrote to memory of 4196 1352 cmd.exe 85 PID 1352 wrote to memory of 4196 1352 cmd.exe 85 PID 1352 wrote to memory of 2164 1352 cmd.exe 86 PID 1352 wrote to memory of 2164 1352 cmd.exe 86 PID 1352 wrote to memory of 1692 1352 cmd.exe 87 PID 1352 wrote to memory of 1692 1352 cmd.exe 87 PID 1352 wrote to memory of 4048 1352 cmd.exe 88 PID 1352 wrote to memory of 4048 1352 cmd.exe 88 PID 1352 wrote to memory of 2656 1352 cmd.exe 89 PID 1352 wrote to memory of 2656 1352 cmd.exe 89 PID 1352 wrote to memory of 4832 1352 cmd.exe 90 PID 1352 wrote to memory of 4832 1352 cmd.exe 90 PID 1352 wrote to memory of 2316 1352 cmd.exe 91 PID 1352 wrote to memory of 2316 1352 cmd.exe 91 PID 1352 wrote to memory of 2960 1352 cmd.exe 92 PID 1352 wrote to memory of 2960 1352 cmd.exe 92 PID 1352 wrote to memory of 3480 1352 cmd.exe 93 PID 1352 wrote to memory of 3480 1352 cmd.exe 93 PID 1352 wrote to memory of 3536 1352 cmd.exe 94 PID 1352 wrote to memory of 3536 1352 cmd.exe 94 PID 1352 wrote to memory of 3352 1352 cmd.exe 95 PID 1352 wrote to memory of 3352 1352 cmd.exe 95 PID 1352 wrote to memory of 3512 1352 cmd.exe 96 PID 1352 wrote to memory of 3512 1352 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tournament_Fixer\AdditionalRuntimes\ddc.exe"C:\Users\Admin\AppData\Local\Temp\Tournament_Fixer\AdditionalRuntimes\ddc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4A57.tmp\4A58.tmp\4A59.bat C:\Users\Admin\AppData\Local\Temp\Tournament_Fixer\AdditionalRuntimes\ddc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\system32\taskkill.exetaskkill /f /im EscapeFromTarkov.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im EscapeFromTarkov_BE.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im BsgLauncher.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /f3⤵PID:1692
-
-
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /f3⤵PID:4048
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-860440266-1445122309-108474356-1001\Software\Epic Games\Unreal Engine\Identifiers" /va /f3⤵PID:2656
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-860440266-1445122309-108474356-1001\Software\Epic Games\Unreal Engine\Hardware Survey" /va /f3⤵PID:4832
-
-
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\Software\Epic Games" /f3⤵PID:2316
-
-
C:\Windows\system32\reg.exereg delete "HKU\S-1-5-21-860440266-1445122309-108474356-1001\Software\Epic Games" /f3⤵PID:2960
-
-
C:\Windows\system32\reg.exeREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 23565 /f3⤵
- Modifies registry key
PID:3480
-
-
C:\Windows\system32\reg.exeREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 22895 /f3⤵
- Modifies registry key
PID:3536
-
-
C:\Windows\system32\reg.exereg delete "HKEY_CURRENT_USER\Software\Epic Games" /f3⤵PID:3352
-
-
C:\Windows\system32\ARP.EXEarp -d3⤵PID:3512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5cf83e40a1338ad5be3af61a5f882664d
SHA1479a7b4bb38725f7949647161017d42fbd630ed2
SHA2565f283ef150cd3675af8bb98ae1f270b153ef7c622d9cf86b5c84288edf6743d1
SHA512dbf2ead0709bb6542a45f6dbc304ccdd8bd0929a48754880a0dafa18d32b427e1d416ecf695bcebda5583bb37632781bd15fb0fd1c0bfbc584dcd05916604e4e