Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
TriggerBot Valorant cheater.fun/trigger/Free Hacks for Games.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
TriggerBot Valorant cheater.fun/trigger/Free Hacks for Games.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
TriggerBot Valorant cheater.fun/trigger/Siticone.UI.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
TriggerBot Valorant cheater.fun/trigger/Siticone.UI.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral5
Sample
TriggerBot Valorant cheater.fun/trigger/trigger.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
TriggerBot Valorant cheater.fun/trigger/trigger.exe
Resource
win10v2004-20240802-en
General
-
Target
TriggerBot Valorant cheater.fun/trigger/trigger.exe
-
Size
3.9MB
-
MD5
0d9659d907e2669a6b925fe1fdd2fe68
-
SHA1
ca2b9d8450c827625e4b0f8379685b3d247f2717
-
SHA256
025153faab21056472b13f00fb79a6bfb917e3fcd85eb4c08b7375e6e3e0cb87
-
SHA512
b1af46307dfc466d8743aeb19ce4cd303e1f15b5bfd13c68f479c18046a8cb48f222a4f51cef09459736dab4ec665c564c4a6e42054933145e8c2ffec3f5158f
-
SSDEEP
98304:Az92834b9W0v0DdmDDzh4MnBpS8vtjMkc:UdeJbgkjMkc
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2800 2308 trigger.exe 30 PID 2308 wrote to memory of 2800 2308 trigger.exe 30 PID 2308 wrote to memory of 2800 2308 trigger.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\TriggerBot Valorant cheater.fun\trigger\trigger.exe"C:\Users\Admin\AppData\Local\Temp\TriggerBot Valorant cheater.fun\trigger\trigger.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2308 -s 7002⤵PID:2800
-