Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    HBL_2022_790643.doc

  • Size

    21KB

  • Sample

    220920-efymaabhd9

  • MD5

    1bec2ce33fbfac0bae25e2e97f192172

  • SHA1

    d7bcee3c070796b2c618415533f57b5d9c48f5be

  • SHA256

    7583d99426f32a09f530dc3746df2ccb44aada08f258083565cffe4491f0f6d4

  • SHA512

    6b62df7ecbf214a8e000474e36f450eaf84f67aaa8fc32a1f4d5d411c222ea94f0a35625580d926663f7366b92206bde7a1441528aa8c523c20fbd8101f9188d

  • SSDEEP

    384:Py+I8QPgKLToFhryQ9JElr+GOilcLdXj1PVq8h7taiw0KIPw:P8++ToFpyQ96/OilcpXjB4u7nw0KIPw

Malware Config

Extracted

Family

formbook

Campaign

tbgn

Decoy

72uabkWDao+ISa9+tnvd8g==

iHmPX6PZRe2+KUpH8bvyQ68=

DDZrOvw0IT/2cK9sgmSn5Q==

c9nixBxRvLxNBkHR/Q==

Ms/6ydhGJCsp8F8rmWeBMbg=

9vwtEc/074RPygwVx3vJk1Sj6nRnFQ==

3Xy/qN8agnyJQpliwmSqtMLvdQ==

4YelbYl+4fT6sSYguZ3Lhh+rSJQ=

3HSghdAThh2rZPMKqkifKesnqu9orLE=

zwA5DmqaB+VyYuw=

JcUFx6bdrcZbFjWu4rL4

IL7z2C5vtEdYBx/NAYE=

H4+ggrrmXwTFTain36T5

IBEn7UyPK8eER+id9w==

j7LfxdFDOWJlInsaWRhTRMXjLpByHw==

gBsrBXWAXWg9MqYDIug0G+l2k9gQ

432wiJgA7Ox7OsNDexmDtMLvdQ==

fJzoyChf4PQCtyIny2K6jQsBLpByHw==

gLTzwFJTKj3Pds0HC83YDd4h

EKPToXy2sdR1J4bau1KqkwsBLpByHw==

Extracted

Family

xloader

Version

3.7

Campaign

tbgn

Decoy

72uabkWDao+ISa9+tnvd8g==

iHmPX6PZRe2+KUpH8bvyQ68=

DDZrOvw0IT/2cK9sgmSn5Q==

c9nixBxRvLxNBkHR/Q==

Ms/6ydhGJCsp8F8rmWeBMbg=

9vwtEc/074RPygwVx3vJk1Sj6nRnFQ==

3Xy/qN8agnyJQpliwmSqtMLvdQ==

4YelbYl+4fT6sSYguZ3Lhh+rSJQ=

3HSghdAThh2rZPMKqkifKesnqu9orLE=

zwA5DmqaB+VyYuw=

JcUFx6bdrcZbFjWu4rL4

IL7z2C5vtEdYBx/NAYE=

H4+ggrrmXwTFTain36T5

IBEn7UyPK8eER+id9w==

j7LfxdFDOWJlInsaWRhTRMXjLpByHw==

gBsrBXWAXWg9MqYDIug0G+l2k9gQ

432wiJgA7Ox7OsNDexmDtMLvdQ==

fJzoyChf4PQCtyIny2K6jQsBLpByHw==

gLTzwFJTKj3Pds0HC83YDd4h

EKPToXy2sdR1J4bau1KqkwsBLpByHw==

Targets

    • Target

      HBL_2022_790643.doc

    • Size

      21KB

    • MD5

      1bec2ce33fbfac0bae25e2e97f192172

    • SHA1

      d7bcee3c070796b2c618415533f57b5d9c48f5be

    • SHA256

      7583d99426f32a09f530dc3746df2ccb44aada08f258083565cffe4491f0f6d4

    • SHA512

      6b62df7ecbf214a8e000474e36f450eaf84f67aaa8fc32a1f4d5d411c222ea94f0a35625580d926663f7366b92206bde7a1441528aa8c523c20fbd8101f9188d

    • SSDEEP

      384:Py+I8QPgKLToFhryQ9JElr+GOilcLdXj1PVq8h7taiw0KIPw:P8++ToFpyQ96/OilcpXjB4u7nw0KIPw

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks