Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2022, 13:08

General

  • Target

    dbbd5f34648cc1a20d0022c47a6531a6.exe

  • Size

    940KB

  • MD5

    dbbd5f34648cc1a20d0022c47a6531a6

  • SHA1

    84bc195e56cdc6804cb987af330608ef5b173a67

  • SHA256

    f8612ea8ab764a3d09157a9b90dc418ec2a7b8af22b29ce63d375896f9ec9a28

  • SHA512

    6d44509bfb38afe4490034736e20dc59cd97de0a4e8cdbdddcd353f7ba5a470a1288f6a2761fa31d4c81bfdf0f6dc8cd56581e27f138e783ecea3e520d9819b3

  • SSDEEP

    24576:xuLJQ0+ai+JoMCXlTjcEa0s4Tj29W8AoqiVNWI:xUpRx+cEa0Q

Malware Config

Extracted

Family

formbook

Campaign

chof

Decoy

1UnM9v3V2HuR2iE=

B4oRF6xBBhDKMJEdaPRiEAw0

r9++/ZEvBh3jRD0FzE01EA==

8qVuosqPI0JfNJGbZ15FT4J8Ng==

83F9+6BFk45ZYEWU04g=

aFPhK8qZoK5CUsemIC+pMoA=

hHkCihi3/HESewQJvpc=

GUMdYJRn7phVzbCTl1BDFg==

aqh5D/PNZYKH3xjDlAoz

P7NS0gXlNFVl

tS/FQFfydoZW6R2I

249T0dBwbVJp

7qNui6I3hCL3vpf5UgKVL+po4YZw

6A/tRMtieCQf/TMU1/8pJbScylADQJRwXA==

b6N1CLSByGdvSIFl6KkVYOlmEoA=

HNGX1Q3YXPxV7ceaT0w/T4J8Ng==

WwvO/0jw8ICLWo9w860VYelmEoA=

Mfa58tV8e9xs5FfhMi+pMoA=

ZOB69iIBTXJ2

EUENQq5AXeCoh8TO0BI5T4J8Ng==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 63 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Users\Admin\AppData\Local\Temp\dbbd5f34648cc1a20d0022c47a6531a6.exe
      "C:\Users\Admin\AppData\Local\Temp\dbbd5f34648cc1a20d0022c47a6531a6.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1084
      • C:\Windows\SysWOW64\mspaint.exe
        "C:\Windows\System32\mspaint.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2204
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:2064
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\SysWOW64\cmd.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:4136

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1084-132-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-135-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-134-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-136-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-138-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-137-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-139-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-140-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-141-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-142-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-143-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-144-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-145-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-146-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-147-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-148-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-149-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-150-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-151-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-152-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-153-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-154-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-155-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-156-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-157-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-158-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-159-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-160-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-161-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-162-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-163-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-164-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-165-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-166-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-167-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-168-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-169-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-171-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-170-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-172-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-173-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-174-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-175-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-176-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-177-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-178-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-179-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-180-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-181-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-182-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-183-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-184-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-185-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-186-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-187-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-188-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-189-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-191-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-190-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-192-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-193-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-194-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/1084-195-0x0000000003ED0000-0x0000000003F34000-memory.dmp

        Filesize

        400KB

      • memory/2204-250-0x0000000050410000-0x000000005043F000-memory.dmp

        Filesize

        188KB

      • memory/2204-253-0x0000000050411000-0x000000005043F000-memory.dmp

        Filesize

        184KB

      • memory/2204-255-0x00000000030D0000-0x000000000341A000-memory.dmp

        Filesize

        3.3MB

      • memory/2204-294-0x0000000003050000-0x0000000003060000-memory.dmp

        Filesize

        64KB

      • memory/2204-297-0x0000000050410000-0x000000005043F000-memory.dmp

        Filesize

        188KB

      • memory/2204-298-0x0000000050411000-0x000000005043F000-memory.dmp

        Filesize

        184KB

      • memory/2212-295-0x0000000008820000-0x00000000089AD000-memory.dmp

        Filesize

        1.6MB

      • memory/2212-303-0x0000000008AA0000-0x0000000008B52000-memory.dmp

        Filesize

        712KB

      • memory/2212-305-0x0000000008AA0000-0x0000000008B52000-memory.dmp

        Filesize

        712KB

      • memory/4620-299-0x0000000000810000-0x000000000086A000-memory.dmp

        Filesize

        360KB

      • memory/4620-300-0x0000000001300000-0x000000000132D000-memory.dmp

        Filesize

        180KB

      • memory/4620-301-0x0000000001B90000-0x0000000001EDA000-memory.dmp

        Filesize

        3.3MB

      • memory/4620-302-0x0000000001A90000-0x0000000001B1F000-memory.dmp

        Filesize

        572KB

      • memory/4620-304-0x0000000001300000-0x000000000132D000-memory.dmp

        Filesize

        180KB