Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

24/01/2025, 21:43

250124-1kyzha1nhr 10

24/01/2025, 21:41

250124-1j76sazna1 10

24/01/2025, 21:40

250124-1jejga1naq 10

Analysis

  • max time kernel
    37s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 21:41

General

  • Target

    wetransfer_hotmail-txt_2025-01-24_2133.zip

  • Size

    52.0MB

  • MD5

    17854d89a4f57f4b5a3eacee2612064b

  • SHA1

    47120215f62694b95684c2e45b747836871dc7c9

  • SHA256

    98d520115f3c179f332f9848af44aeeffd115c152e8105e7be247648021430b5

  • SHA512

    c333b8d1790775a487fc4d13daa4456400f67102c59719ba3f8f90551b148dcaa258a13687914fc445ba138ba4556e0fcf302e804d55455fb2dc6e1bbbc8065c

  • SSDEEP

    786432:yWo2ZhNiqGL+qHFcDJExAFsHEAayG4jzGgjqoLkW9FAa3MbJUSxDMQpPdXYE9P:yWd2qmJHFcN6AFEEtyH9qoB7Asy3npPV

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\wetransfer_hotmail-txt_2025-01-24_2133.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:684
  • C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe
    "C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe
      "C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe"
      2⤵
      • Loads dropped DLL
      PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI23122\python311.dll

    Filesize

    1.6MB

    MD5

    ccdbd8027f165575a66245f8e9d140de

    SHA1

    d91786422ce1f1ad35c528d1c4cd28b753a81550

    SHA256

    503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

    SHA512

    870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

  • memory/2108-42-0x000007FEF5F60000-0x000007FEF6552000-memory.dmp

    Filesize

    5.9MB