Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

PO98632732.rtf

windows7-x64

10

PO98632732.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7e75f4b5f47a4407a5efc54644fe024c

  • Size

    35KB

  • Sample

    220906-1ae4msaca5

  • MD5

    7e75f4b5f47a4407a5efc54644fe024c

  • SHA1

    1e208d58701d978cb1b1e1df821a32d3adf3177f

  • SHA256

    89bad78b1a52a59cc2fedee51f1c4a9592efec988b5aa2cae44500dd4532d19b

  • SHA512

    fdcdbda50249b1f802fecf2e76098b5ffab7cf93729ce1dd658cd7e258ab1f29492414c104bbcb4567f83b2946bdf9a39b50f8e87e7516bd7383a47da63051b5

  • SSDEEP

    768:kN2GY355Pw5P6w55Teex6q66w55Reerf2eeu5fR5fc5fW3i88Hhxy1+ZLgnMnp:k0kCs5TeexVHs5Reerf2eeunAuHGI1E/

Score
10/10
formbookos56ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

os56

Decoy

australianhotwaterupgrades.com

vipidplus.online

kneescooterscanada.com

pesanterkini.com

madden24gameplay.com

linkbong88moinhat.net

awongtest41saletest.com

thetravellingcatcompany.com

vazxlip.xyz

bangdemcheeks.com

passengerassistance.website

cloud4global.com

prestopizzarennes.com

midlandchambertravel.com

nashwan-d.com

bellescraftkitchen.com

teamtisdale.com

allascooussaa.us

cryptobet365.xyz

cbij.education

Targets

    • Target

      PO98632732.doc

    • Size

      16KB

    • MD5

      d5ec6564380513fa99e2f7c46f18040f

    • SHA1

      e4520ff2e021a71af52a69cfe4ab50d806820d55

    • SHA256

      690666560c162ef0fab9a510998f26dca0eec9f72b26cf91d8671bb03f728869

    • SHA512

      b48bb50855cae45f4f6ac94681bf08621c9b0626345e717321568652020220efdf3cdd919db61096ad71152423ff0f759c91ffc04ce8406fb5e135cdd7fafff8

    • SSDEEP

      192:TG0UrykljB+nk2/yAXJsbcg+WEyFUskqgiH7aBaC0Soy20DA4rk3F0j6hx:TCB+k2aAKIg+WLUskCH7aBaCdFbsR4W

    Score
    10/10
    formbookos56ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks