Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 00:05
Behavioral task
behavioral1
Sample
Release/dlls/fortnite_undetected.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Release/dlls/fortnite_undetected.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Release/loader.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Release/loader.exe
Resource
win10v2004-20240802-en
General
-
Target
Release/loader.exe
-
Size
6.5MB
-
MD5
5640e7c7fbbfa0134b74865a6d4737ea
-
SHA1
82cb4c4440e9e3baab6b75994d94041e66830b3c
-
SHA256
55ec88ada55c35967781c12ac60757e8e8f6257357cf5508cf17eca7a8acc123
-
SHA512
3acea538d5910aee2faa1c954e927eefa9c606eb35637072e3f06601c5fe91cf95e8d3ca176ae5ecec8b1a1f017da867408a29b0a9e0d4c47085d439ce8a1342
-
SSDEEP
196608:AMNTPY7QEbGXqEICteEroXGzlxZV3Gu5D4S26/CS32uTdq:BYkEhEInEroXC14S26Wuxq
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2640 loader.exe -
resource yara_rule behavioral3/memory/2840-0-0x000000013FB20000-0x000000013FB9D000-memory.dmp upx behavioral3/memory/2640-15-0x000000013FB20000-0x000000013FB9D000-memory.dmp upx behavioral3/memory/2640-19-0x000000013FB20000-0x000000013FB9D000-memory.dmp upx behavioral3/memory/2840-33-0x000000013FB20000-0x000000013FB9D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2640 2840 loader.exe 31 PID 2840 wrote to memory of 2640 2840 loader.exe 31 PID 2840 wrote to memory of 2640 2840 loader.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Release\loader.exe"C:\Users\Admin\AppData\Local\Temp\Release\loader.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\Release\loader.exe"C:\Users\Admin\AppData\Local\Temp\Release\loader.exe"2⤵
- Loads dropped DLL
PID:2640
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2528
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5384349987b60775d6fc3a6d202c3e1bd
SHA1701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA256f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
SHA5126bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5