Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2022, 11:47

General

  • Target

    tmp.exe

  • Size

    1.1MB

  • MD5

    911b41caf07e1358460415fe7ddc9ba5

  • SHA1

    2a2e2120055b91824166b4cbecb86b25cab7a6f1

  • SHA256

    4562af450cbc44c9ddf59509c802f83abcc2dc66a2eccc0b734ea7ceded60522

  • SHA512

    92f5410901ce62f81bd2d1e0e86cd3492b05fcf415a271e9784994239296b3001e1a53b5ff176d1c3cc09fa42ae1e0c379cada397c74d7e232590e048938b80d

  • SSDEEP

    12288:imIFTT41hw4e/ehLrz9+maNmNR734hodpBXk8jB6rSDdrCsv6ySk1hw4e/:lIF/L4LJwNmNYqpBXXQCOsvu4

Malware Config

Extracted

Family

formbook

Campaign

nytc

Decoy

xxa3lYw6m81Pd//kzzAdG4U=

YXZAfGEJkwXABM5TR/E=

hUbaOQOt0DYguI9XS8pwJrEZWmU=

A/ygqm4Kfa0kUcnqnsJDp+zEWGM=

RORz56hFPHnrLO2iW0+9

iqg4UizXgbNRcvmiW0+9

VRTafWQvdNtipVkn5VtZyrF/+rnbCQ==

gQueRkb7G4Z/Jvu3qBQZNo8=

ePKbHxG8f76FOQesODERPA==

fHESMDnjE3MqK+7b

0k/peV8LzCGeqzU7ODERPA==

cTQPl24ePactS+KiW0+9

pjTaSRTKnctzqirmZx/oa3X0tg==

aAWYMRriqLzAA85TR/E=

tDgT5cRmmQqRpFrkpR+4

drFaFOGXywjGUxzL9wm++AOs

Okbd//qcDXIbai4QB7WKaH+p6bEPPfgV

ae/IhkTwKWcXT9mY6A+++AOs

eEbmHeuHEHk4xoclVxQZNo8=

C2I8W0/9c+jsDk/CmEn8Ng==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Users\Admin\AppData\Local\Temp\tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2004
    • C:\Windows\SysWOW64\NETSTAT.EXE
      "C:\Windows\SysWOW64\NETSTAT.EXE"
      2⤵
      • Suspicious use of SetThreadContext
      • Gathers network information
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1152

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1212-68-0x0000000002A80000-0x0000000002B81000-memory.dmp

      Filesize

      1.0MB

    • memory/1212-78-0x0000000006460000-0x0000000006536000-memory.dmp

      Filesize

      856KB

    • memory/1212-76-0x0000000006460000-0x0000000006536000-memory.dmp

      Filesize

      856KB

    • memory/1676-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

      Filesize

      8KB

    • memory/1676-56-0x00000000002E0000-0x00000000002FA000-memory.dmp

      Filesize

      104KB

    • memory/1676-57-0x0000000000780000-0x000000000078C000-memory.dmp

      Filesize

      48KB

    • memory/1676-58-0x0000000007F50000-0x0000000007FDC000-memory.dmp

      Filesize

      560KB

    • memory/1676-59-0x0000000004F80000-0x0000000004FB2000-memory.dmp

      Filesize

      200KB

    • memory/1676-54-0x0000000000D30000-0x0000000000E4A000-memory.dmp

      Filesize

      1.1MB

    • memory/1984-71-0x0000000000C20000-0x0000000000C29000-memory.dmp

      Filesize

      36KB

    • memory/1984-72-0x00000000000C0000-0x00000000000EB000-memory.dmp

      Filesize

      172KB

    • memory/1984-73-0x00000000021C0000-0x00000000024C3000-memory.dmp

      Filesize

      3.0MB

    • memory/1984-75-0x0000000000B10000-0x0000000000B9F000-memory.dmp

      Filesize

      572KB

    • memory/1984-77-0x00000000000C0000-0x00000000000EB000-memory.dmp

      Filesize

      172KB

    • memory/2004-66-0x00000000008E0000-0x0000000000BE3000-memory.dmp

      Filesize

      3.0MB

    • memory/2004-67-0x00000000000A0000-0x00000000000B0000-memory.dmp

      Filesize

      64KB

    • memory/2004-63-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/2004-70-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/2004-61-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/2004-60-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB