Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2022, 16:33

General

  • Target

    DOCUMENTO DE ENVÍO DE DHL AWB _111832457673,pdf.exe

  • Size

    461KB

  • MD5

    26860d51fddf664076d1cf601e43ba1d

  • SHA1

    dcd3fa1f67c3a7496caebd09c40cf8c6e5846c53

  • SHA256

    7a73079ae74c6c75f4f72bdae2437960533e8532a26b10dc98df4d8caf272f5e

  • SHA512

    e7aca103565635e73a5ce0fe64027dfdec356390f39537aec134611a6aeee176f666e5aada2cae90cebb7d3002bce43c0c251a79f28d95a09ca1a36e159dd513

  • SSDEEP

    12288:vj3ZrR7VyT/IdT5D7E61U6NolW1M6wRs:vj9Rs/IdFPU6+l0

Malware Config

Extracted

Family

formbook

Campaign

nrln

Decoy

IG7zJSm49UqTTuu/N/oTCIg=

CVLdAPgw0CRSMuZnRRU=

PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG

5i6p4GeQqtBgNRfGNQ==

5984keYswxh8mGZHz4ipAHtQ

VNJaK4Gh0CrOvHpW/p353A==

71rEtrL2icToyKGhcWrTxjsFU5T98zeO

r3q1sy1iZaL+2XIUAob7yw==

9+83Qkrk/vV/jVXsDvoTCIg=

aMFAgYF1prov8/UErH/Y1A==

Alqtx/0rxwEbCLdudftl

ImCbnglBSUHF0mv2tTSP40bPeYao

s4DFNvAJ4GIJ+g==

phOa6mtS8QQICuZnRRU=

7TSu5vqRtB45EZtf4WDSTBHPeYao

ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=

HF7jKjbGox2SAffTPw==

yAM3mOQot5l+cD0ikR5MGp8=

UYzW0/8z70JcQenVLidu1kLPeYao

OoCznp5UWz+hT9OBFXbfVhXPeYao

Extracted

Family

xloader

Version

3.8

Campaign

nrln

Decoy

IG7zJSm49UqTTuu/N/oTCIg=

CVLdAPgw0CRSMuZnRRU=

PiA5Z3umP2NyX81VGQhjWyS59nFYhXiG

5i6p4GeQqtBgNRfGNQ==

5984keYswxh8mGZHz4ipAHtQ

VNJaK4Gh0CrOvHpW/p353A==

71rEtrL2icToyKGhcWrTxjsFU5T98zeO

r3q1sy1iZaL+2XIUAob7yw==

9+83Qkrk/vV/jVXsDvoTCIg=

aMFAgYF1prov8/UErH/Y1A==

Alqtx/0rxwEbCLdudftl

ImCbnglBSUHF0mv2tTSP40bPeYao

s4DFNvAJ4GIJ+g==

phOa6mtS8QQICuZnRRU=

7TSu5vqRtB45EZtf4WDSTBHPeYao

ImPWqwUUIVWMQLyMbUab7tmspvNCcT8=

HF7jKjbGox2SAffTPw==

yAM3mOQot5l+cD0ikR5MGp8=

UYzW0/8z70JcQenVLidu1kLPeYao

OoCznp5UWz+hT9OBFXbfVhXPeYao

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE ENVÍO DE DHL AWB _111832457673,pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE ENVÍO DE DHL AWB _111832457673,pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2000
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1112

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll

      Filesize

      1.0MB

      MD5

      ce5c15b5092877974d5b6476ad1cb2d7

      SHA1

      76a6fc307d1524081cba1886d312df97c9dd658f

      SHA256

      1f1a186ea26bd2462ea2a9cf35a816b92caf0897fdf332af3a61569e0ba97b24

      SHA512

      bb9ced38c63d2a29e18c38f60020cfdf0161384cd4ad6328352626643becdf49f6b4bef47012391720344fdd8ad520aa802dcbbed15b5026d27eb93b0a839c90

    • memory/1216-69-0x0000000006590000-0x000000000668B000-memory.dmp

      Filesize

      1004KB

    • memory/1216-80-0x0000000006BC0000-0x0000000006CFB000-memory.dmp

      Filesize

      1.2MB

    • memory/1216-78-0x0000000006BC0000-0x0000000006CFB000-memory.dmp

      Filesize

      1.2MB

    • memory/1884-55-0x00000000001F0000-0x00000000001F6000-memory.dmp

      Filesize

      24KB

    • memory/1884-56-0x0000000000250000-0x000000000025C000-memory.dmp

      Filesize

      48KB

    • memory/1884-57-0x0000000000260000-0x0000000000268000-memory.dmp

      Filesize

      32KB

    • memory/1884-54-0x0000000001370000-0x00000000013E4000-memory.dmp

      Filesize

      464KB

    • memory/1932-75-0x00000000000D0000-0x00000000000FD000-memory.dmp

      Filesize

      180KB

    • memory/1932-79-0x00000000000D0000-0x00000000000FD000-memory.dmp

      Filesize

      180KB

    • memory/1932-77-0x0000000001E60000-0x0000000001EEF000-memory.dmp

      Filesize

      572KB

    • memory/1932-76-0x00000000020A0000-0x00000000023A3000-memory.dmp

      Filesize

      3.0MB

    • memory/1932-74-0x00000000001C0000-0x00000000001D4000-memory.dmp

      Filesize

      80KB

    • memory/1932-73-0x0000000075571000-0x0000000075573000-memory.dmp

      Filesize

      8KB

    • memory/2000-72-0x0000000000401000-0x000000000042F000-memory.dmp

      Filesize

      184KB

    • memory/2000-71-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2000-65-0x0000000000401000-0x000000000042F000-memory.dmp

      Filesize

      184KB

    • memory/2000-64-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2000-68-0x00000000000F0000-0x0000000000100000-memory.dmp

      Filesize

      64KB

    • memory/2000-61-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2000-67-0x00000000008D0000-0x0000000000BD3000-memory.dmp

      Filesize

      3.0MB

    • memory/2000-59-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2000-58-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB