Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10FN CHECKER...ER.exe
windows7-x64
10FN CHECKER...ER.exe
windows10-2004-x64
10FN CHECKER...rp.dll
windows7-x64
1FN CHECKER...rp.dll
windows10-2004-x64
1FN CHECKER...et.dll
windows7-x64
1FN CHECKER...et.dll
windows10-2004-x64
1FN CHECKER...to.dll
windows7-x64
1FN CHECKER...to.dll
windows10-2004-x64
1FN CHECKER...re.dll
windows7-x64
1FN CHECKER...re.dll
windows10-2004-x64
1FN CHECKER...rp.dll
windows7-x64
1FN CHECKER...rp.dll
windows10-2004-x64
1FN CHECKER...Re.dll
windows7-x64
1FN CHECKER...Re.dll
windows10-2004-x64
1FN CHECKER...le.dll
windows7-x64
1FN CHECKER...le.dll
windows10-2004-x64
1FN CHECKER...ne.dll
windows7-x64
1FN CHECKER...ne.dll
windows10-2004-x64
1FN CHECKER...or.dll
windows7-x64
1FN CHECKER...or.dll
windows10-2004-x64
1FN CHECKER...rp.dll
windows7-x64
1FN CHECKER...rp.dll
windows10-2004-x64
1FN CHECKER...ma.dll
windows7-x64
1FN CHECKER...ma.dll
windows10-2004-x64
1FN CHECKER...et.dll
windows7-x64
1FN CHECKER...et.dll
windows10-2004-x64
1FN CHECKER...er.dll
windows7-x64
1FN CHECKER...er.dll
windows10-2004-x64
1FN CHECKER...er.exe
windows7-x64
10FN CHECKER...er.exe
windows10-2004-x64
10FN CHECKER...as.dll
windows7-x64
1FN CHECKER...as.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/01/2025, 10:41
Behavioral task
behavioral1
Sample
FN CHECKER/FN CHECKER/FN CHECKER.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
FN CHECKER/FN CHECKER/FN CHECKER.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
FN CHECKER/FN CHECKER/bin/AngleSharp.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
FN CHECKER/FN CHECKER/bin/AngleSharp.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
FN CHECKER/FN CHECKER/bin/BCrypt.Net.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
FN CHECKER/FN CHECKER/bin/BCrypt.Net.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
FN CHECKER/FN CHECKER/bin/BouncyCastle.Crypto.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
FN CHECKER/FN CHECKER/bin/BouncyCastle.Crypto.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
FN CHECKER/FN CHECKER/bin/CaptchaSharp.Services.More.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
FN CHECKER/FN CHECKER/bin/CaptchaSharp.Services.More.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
FN CHECKER/FN CHECKER/bin/CaptchaSharp.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
FN CHECKER/FN CHECKER/bin/CaptchaSharp.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
FN CHECKER/FN CHECKER/bin/CloudflareSolverRe.dll
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
FN CHECKER/FN CHECKER/bin/CloudflareSolverRe.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
FN CHECKER/FN CHECKER/bin/Colorful.Console.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
FN CHECKER/FN CHECKER/bin/Colorful.Console.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
FN CHECKER/FN CHECKER/bin/CommandLine.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
FN CHECKER/FN CHECKER/bin/CommandLine.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
FN CHECKER/FN CHECKER/bin/CommonServiceLocator.dll
Resource
win7-20241023-en
Behavioral task
behavioral20
Sample
FN CHECKER/FN CHECKER/bin/CommonServiceLocator.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
FN CHECKER/FN CHECKER/bin/CryptSharp.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
FN CHECKER/FN CHECKER/bin/CryptSharp.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
FN CHECKER/FN CHECKER/bin/Esprima.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
FN CHECKER/FN CHECKER/bin/Esprima.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
FN CHECKER/FN CHECKER/bin/Extreme.Net.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
FN CHECKER/FN CHECKER/bin/Extreme.Net.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
FN CHECKER/FN CHECKER/bin/Fizzler.dll
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
FN CHECKER/FN CHECKER/bin/Fizzler.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
FN CHECKER/FN CHECKER/bin/Fortnite checker.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
FN CHECKER/FN CHECKER/bin/Fortnite checker.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
FN CHECKER/FN CHECKER/bin/GalaSoft.MvvmLight.Extras.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
FN CHECKER/FN CHECKER/bin/GalaSoft.MvvmLight.Extras.dll
Resource
win10v2004-20241007-en
General
-
Target
FN CHECKER/FN CHECKER/bin/Fortnite checker.exe
-
Size
517KB
-
MD5
4ee4eb93c2b66408bb2b7ed294ce8456
-
SHA1
0c5e89962612ae857dcdc7ae157c810a23c484a2
-
SHA256
3ccceb62c17463b89547b63957065b00621bfe611f6c83df1f6cb71c3c3b1c0f
-
SHA512
a44cc99c858c44ea7ce52328dcacec30e749804da182dcabf6978c1e73f1f5ff90dfb8c20ee1e82a6b2ee791a24289a0694b5e990de09df5d0b1c41d09af8088
-
SSDEEP
6144:k9EcZu6Te3V8zcL/9QRL5t5mVMZjE4usD6:BuTZ2lQRL5t5mOs
Malware Config
Signatures
-
Detect Neshta payload 3 IoCs
resource yara_rule behavioral29/files/0x0001000000010314-9.dat family_neshta behavioral29/memory/2136-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral29/memory/2136-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 1 IoCs
pid Process 1592 Fortnite checker.exe -
Loads dropped DLL 2 IoCs
pid Process 2136 Fortnite checker.exe 2136 Fortnite checker.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Fortnite checker.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe Fortnite checker.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE Fortnite checker.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE Fortnite checker.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe Fortnite checker.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe Fortnite checker.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com Fortnite checker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fortnite checker.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Fortnite checker.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2136 wrote to memory of 1592 2136 Fortnite checker.exe 31 PID 2136 wrote to memory of 1592 2136 Fortnite checker.exe 31 PID 2136 wrote to memory of 1592 2136 Fortnite checker.exe 31 PID 2136 wrote to memory of 1592 2136 Fortnite checker.exe 31 PID 1592 wrote to memory of 2952 1592 Fortnite checker.exe 33 PID 1592 wrote to memory of 2952 1592 Fortnite checker.exe 33 PID 1592 wrote to memory of 2952 1592 Fortnite checker.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\FN CHECKER\FN CHECKER\bin\Fortnite checker.exe"C:\Users\Admin\AppData\Local\Temp\FN CHECKER\FN CHECKER\bin\Fortnite checker.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3582-490\Fortnite checker.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Fortnite checker.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1592 -s 4923⤵PID:2952
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
476KB
MD52be46b2eee85470878c9eea822f56ccf
SHA17638cdcde5199a5575a40972ae08a49572d4798d
SHA25647ddc3b79f14bac59112b388579f182680fb91bec380f6761bbbc4fe9cf5c1b8
SHA5120995295b382fd75a5a8e03b093540059fa8692f37be51a2203763b5a6f9a60eb590ee65f317f92aad1c67e4644dd0069f62f5d8d79ca3c1eff923d1e1fc24f70