Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
5Static
static
3Oblivity.rar
windows7-x64
3Oblivity.rar
windows10-2004-x64
3Oblivity/d...nifest
windows7-x64
3Oblivity/d...nifest
windows10-2004-x64
3Oblivity/s...90.acf
windows7-x64
3Oblivity/s...90.acf
windows10-2004-x64
3Oblivity/s...ly.dll
windows7-x64
1Oblivity/s...ly.dll
windows10-2004-x64
1Oblivity/s...ty.exe
windows7-x64
1Oblivity/s...ty.exe
windows10-2004-x64
5Oblivity/s...d1.caw
windows7-x64
3Oblivity/s...d1.caw
windows10-2004-x64
3Oblivity/s...d1.ecm
windows7-x64
3Oblivity/s...d1.ecm
windows10-2004-x64
3Oblivity/s...ws.sse
windows7-x64
3Oblivity/s...ws.sse
windows10-2004-x64
3Oblivity/s...d1.rgb
windows7-x64
3Oblivity/s...d1.rgb
windows10-2004-x64
3Oblivity/s...sc.sse
windows7-x64
3Oblivity/s...sc.sse
windows10-2004-x64
3Oblivity/s...d1.vis
windows7-x64
3Oblivity/s...d1.vis
windows10-2004-x64
3Oblivity/s...0a.caw
windows7-x64
3Oblivity/s...0a.caw
windows10-2004-x64
3Oblivity/s...0a.ecm
windows7-x64
3Oblivity/s...0a.ecm
windows10-2004-x64
3Oblivity/s...ws.sse
windows7-x64
3Oblivity/s...ws.sse
windows10-2004-x64
3Oblivity/s...0a.rgb
windows7-x64
3Oblivity/s...0a.rgb
windows10-2004-x64
3Oblivity/s...sc.sse
windows7-x64
3Oblivity/s...sc.sse
windows10-2004-x64
3Analysis
-
max time kernel
143s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
Oblivity.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Oblivity.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Oblivity/depotcache/1389991_7145957302409288600.manifest
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Oblivity/depotcache/1389991_7145957302409288600.manifest
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Oblivity/steamapps/appmanifest_1389990.acf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Oblivity/steamapps/appmanifest_1389990.acf
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Oblivity/steamapps/common/Oblivity/GameAssembly.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Oblivity/steamapps/common/Oblivity/GameAssembly.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Oblivity/steamapps/common/Oblivity/Oblivity.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
Oblivity/steamapps/common/Oblivity/Oblivity.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.caw
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.caw
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.ecm
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.ecm
Resource
win10v2004-20240910-en
Behavioral task
behavioral15
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.iws.sse
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.iws.sse
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.rgb
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.rgb
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.rsc.sse
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.rsc.sse
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.vis
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/7d/7dd7669427274c83815459e30760b2d1.vis
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.caw
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.caw
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.ecm
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.ecm
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.iws.sse
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.iws.sse
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.rgb
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.rgb
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.rsc.sse
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Oblivity/steamapps/common/Oblivity/Oblivity_Data/GI/level4/d0/d06ee7eda6916184a427fef9cc7ee30a.rsc.sse
Resource
win10v2004-20240802-en
General
-
Target
Oblivity.rar
-
Size
226.3MB
-
MD5
4e2535ab5686062ebc7feb7efcd6558c
-
SHA1
fc47e38dd4da5de9d2c6a68a8cf0c45e4beb9a7e
-
SHA256
2cb8c7061773b62038fc601d72d770c384062963f729ad4ca717ce3ce7c15555
-
SHA512
2725fc9bb3de396505f1ceea18231e53aa375899368cdbabc2b81114648d53b5c53eafd10635599f527fefe9e60ceb5694b6b4dafffa701a4fd3e777ebdd1115
-
SSDEEP
6291456:l4a+6GvqXok7j9GvZG6gpRogFLL5aReRVKM+NQ0T/L7KANgR:6a+6GvWosIvYLXLc4H+NtL7KAeR
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2828 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2828 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe 2828 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2828 vlc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2880 2088 cmd.exe 32 PID 2088 wrote to memory of 2880 2088 cmd.exe 32 PID 2088 wrote to memory of 2880 2088 cmd.exe 32 PID 2880 wrote to memory of 2756 2880 rundll32.exe 33 PID 2880 wrote to memory of 2756 2880 rundll32.exe 33 PID 2880 wrote to memory of 2756 2880 rundll32.exe 33 PID 2756 wrote to memory of 2828 2756 rundll32.exe 35 PID 2756 wrote to memory of 2828 2756 rundll32.exe 35 PID 2756 wrote to memory of 2828 2756 rundll32.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Oblivity.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Oblivity.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Oblivity.rar3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Oblivity.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2828
-
-
-