Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3Frankies_FunClub.zip
windows7-x64
1Frankies_FunClub.zip
windows10-2004-x64
1Frankie's FunClub.exe
windows7-x64
3Frankie's FunClub.exe
windows10-2004-x64
1Frankie's FunClub.pck
windows7-x64
3Frankie's FunClub.pck
windows10-2004-x64
3godot-jolt...64.dll
windows7-x64
1godot-jolt...64.dll
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 21:56
Static task
static1
Behavioral task
behavioral1
Sample
Frankies_FunClub.zip
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Frankies_FunClub.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Frankie's FunClub.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Frankie's FunClub.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Frankie's FunClub.pck
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Frankie's FunClub.pck
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
godot-jolt_windows-x64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
godot-jolt_windows-x64.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
Frankies_FunClub.zip
-
Size
594.0MB
-
MD5
d8ffcb3d4f5872787dc6b16659806c2a
-
SHA1
6a0817b4a1e33e45cf147c444e58db5bedd696a6
-
SHA256
75157852354ae856c5d818602e31347e32b35e71203c7639eb157db327857f4a
-
SHA512
f599a9867849bef6a7f8868abd7fc5ae616792bcb348d79120c2a97ca7ffcd5b7103cf8910c0462b3962a0673d8d787e12b56cb3ae5f122aaa2f702f208e57d6
-
SSDEEP
12582912:/oZCYlL0zXiPy7NoFCtxhxv0RUju6iOLGXedvNsdJW6YrDA/z1yAAn5gmxuj+o:/oZDlkSPcDhxvwUjfHgelNKGA/0R5goc
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1236 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1236 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 2676 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2676 AUDIODG.EXE Token: 33 2676 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2676 AUDIODG.EXE Token: 33 1236 vlc.exe Token: SeIncBasePriorityPrivilege 1236 vlc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe 1236 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1236 vlc.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Frankies_FunClub.zip1⤵PID:2704
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2104
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1236