Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
24/01/2025, 21:43
250124-1kyzha1nhr 1024/01/2025, 21:41
250124-1j76sazna1 1024/01/2025, 21:40
250124-1jejga1naq 10Analysis
-
max time kernel
37s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 21:41
Behavioral task
behavioral1
Sample
wetransfer_hotmail-txt_2025-01-24_2133.zip
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
wetransfer_hotmail-txt_2025-01-24_2133.zip
Resource
win10v2004-20241007-en
General
-
Target
wetransfer_hotmail-txt_2025-01-24_2133.zip
-
Size
52.0MB
-
MD5
17854d89a4f57f4b5a3eacee2612064b
-
SHA1
47120215f62694b95684c2e45b747836871dc7c9
-
SHA256
98d520115f3c179f332f9848af44aeeffd115c152e8105e7be247648021430b5
-
SHA512
c333b8d1790775a487fc4d13daa4456400f67102c59719ba3f8f90551b148dcaa258a13687914fc445ba138ba4556e0fcf302e804d55455fb2dc6e1bbbc8065c
-
SSDEEP
786432:yWo2ZhNiqGL+qHFcDJExAFsHEAayG4jzGgjqoLkW9FAa3MbJUSxDMQpPdXYE9P:yWd2qmJHFcN6AFEEtyH9qoB7Asy3npPV
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2108 vosfn.exe -
resource yara_rule behavioral1/files/0x00050000000194a9-40.dat upx behavioral1/memory/2108-42-0x000007FEF5F60000-0x000007FEF6552000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 684 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 684 7zFM.exe Token: 35 684 7zFM.exe Token: SeSecurityPrivilege 684 7zFM.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 684 7zFM.exe 684 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2108 2312 vosfn.exe 35 PID 2312 wrote to memory of 2108 2312 vosfn.exe 35 PID 2312 wrote to memory of 2108 2312 vosfn.exe 35
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\wetransfer_hotmail-txt_2025-01-24_2133.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:684
-
C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe"C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe"C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe"2⤵
- Loads dropped DLL
PID:2108
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5ccdbd8027f165575a66245f8e9d140de
SHA1d91786422ce1f1ad35c528d1c4cd28b753a81550
SHA256503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971
SHA512870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311