Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    24s
  • max time network
    26s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29/06/2024, 22:31

General

  • Target

    PCVR-Rookie.exe

  • Size

    920KB

  • MD5

    7e660168665d26cd71ed031bbe6d76b7

  • SHA1

    ea90944f7f589f92d0322c4e3eb4943cf449fe5f

  • SHA256

    9f71f0c21498c7e2957e8ba80bddee5ac53c33e45fa2fb6d93c661955c3a318c

  • SHA512

    795a14806a57f82efdd6c6928fe54bacbad7d128b14aa931979f0bb1b3dddc95e15eb8dbf5fa05031431337bccfd4f70851703622c2f7aaddaab838afeecad78

  • SSDEEP

    6144:n4lCyKgGScEOX+NuM3uBJgUpL8SNFDu/O63hGSb/DB5pr0+UTsWkef1XwxQ1GA/L:nrEJuHp5bu9TlLfUTdwq1hyiDyTO

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PCVR-Rookie.exe
    "C:\Users\Admin\AppData\Local\Temp\PCVR-Rookie.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Users\Admin\AppData\Local\Temp\7z.exe
      "7z.exe" x "C:\Users\Admin\AppData\Local\Temp\rclone.zip" -y -o"C:\Users\Admin\AppData\Local\Temp"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2040
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" listremotes --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4328
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" cat ":PCVR Games/VRP-GameList.txt" --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4080
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" cat ":PCVR Games/VRP-GameList.txt" --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1584
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" cat ":PCVR Games/VRP-GameList.txt" --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2876
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" cat ":PCVR Games/VRP-GameList.txt" --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2176
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" cat ":PCVR Games/VRP-GameList.txt" --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:388
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" cat ":PCVR Games/VRP-GameList.txt" --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1984
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" cat ":PCVR Games/VRP-GameList.txt" --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4244
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" cat ":PCVR Games/VRP-GameList.txt" --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" cat ":PCVR Games/VRP-GameList.txt" --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2844
    • C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe
      "C:\Users\Admin\AppData\Local\Temp\rclone\rclone.exe" cat ":PCVR Games/VRP-GameList.txt" --config vrp.download.config
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Rookie.WTF\PCVR-Rookie.exe_Url_xvschwsgakn2nagjsqlofr5vkuygxcxa\2.0.0.0\user.config

    Filesize

    1KB

    MD5

    18539f4e71b56fa588b9fc499e40bd8d

    SHA1

    31cd0e9ea7855ee5c5c94784eaa71b73f2f381ad

    SHA256

    d227df912be561c21e72ef6743f13eb31b1c6a16c72435c9ad25711c2fa311dc

    SHA512

    2882849a8d5e287ac9bdf6b95656b5a25037a050a84e8bf4e7bbef53c8b00473973e8f3a320f7164e7b605496e33f64c537ba8bc0882917f486f1d8d61918490

  • C:\Users\Admin\AppData\Local\Rookie.WTF\PCVR-Rookie.exe_Url_xvschwsgakn2nagjsqlofr5vkuygxcxa\2.0.0.0\user.config

    Filesize

    1KB

    MD5

    1ee5e88f8049c2d9e69bac871c4d3c5c

    SHA1

    531c8334b05c1ea0eb182721e7002bb5dfd783f3

    SHA256

    fbeaafa7d44af56009f6e4a5049d8814d9ae00af55e563ce4d1077af0a0477dd

    SHA512

    40e87b58742bbeb2fd4e684857b2e03f1690726bafcb764a897d440b638f9b48075549300826393a7e7c66e1b993f1b52d7ae9ed213918dea36491ff318a1b71

  • C:\Users\Admin\AppData\Local\Temp\7z.exe

    Filesize

    1.2MB

    MD5

    1a7eaa1dab7867e15d7800ae0b5af5e3

    SHA1

    9e6d344bd8724aa1862f4254d8c42b7cc929a797

    SHA256

    356bea8b6e9eb84dfa0dd8674e7c03428c641a47789df605c5bea0730de4aed2

    SHA512

    a12373ec7ec4bac3421363f70cc593f4334b4bb5a5c917e050a45090220fab002c36ba8b03be81159fd70955b4680146c9469e44ddf75a901465d6b1231ee6cd

  • C:\Users\Admin\AppData\Local\Temp\rclone.zip

    Filesize

    20.1MB

    MD5

    10babe225d85f3da58ee8cc260b63793

    SHA1

    900da981ad757c5b8696b71475341c9228e84be9

    SHA256

    8e8bb13fb0d7beb316487ecde8ead5426784cdcdbf8b4d8dd381c6fe8c7d92a0

    SHA512

    d771c4631b607fc447be37d2ee266859dec4e09aa5544559edff2dea6d277ac9a28792ef1d12875c51b48773e155a983633b9f7ad59e14a36fb36de4d7fe9246

  • memory/2728-4-0x00000000055D0000-0x00000000055DA000-memory.dmp

    Filesize

    40KB

  • memory/2728-5-0x0000000075130000-0x00000000758E1000-memory.dmp

    Filesize

    7.7MB

  • memory/2728-6-0x0000000075130000-0x00000000758E1000-memory.dmp

    Filesize

    7.7MB

  • memory/2728-7-0x0000000006930000-0x00000000069E0000-memory.dmp

    Filesize

    704KB

  • memory/2728-0-0x000000007513E000-0x000000007513F000-memory.dmp

    Filesize

    4KB

  • memory/2728-3-0x0000000005650000-0x00000000056E2000-memory.dmp

    Filesize

    584KB

  • memory/2728-2-0x0000000005B60000-0x0000000006106000-memory.dmp

    Filesize

    5.6MB

  • memory/2728-1-0x0000000000A10000-0x0000000000AFC000-memory.dmp

    Filesize

    944KB

  • memory/2728-50-0x000000007513E000-0x000000007513F000-memory.dmp

    Filesize

    4KB

  • memory/2728-51-0x0000000013BD0000-0x0000000013C36000-memory.dmp

    Filesize

    408KB

  • memory/2728-54-0x0000000075130000-0x00000000758E1000-memory.dmp

    Filesize

    7.7MB

  • memory/2728-63-0x0000000075130000-0x00000000758E1000-memory.dmp

    Filesize

    7.7MB