Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    56s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06/10/2022, 08:20

General

  • Target

    SecuriteInfo.com.Variant.Tedy.217947.21963.1711.exe

  • Size

    960KB

  • MD5

    f3309c43b2bf62602ba5b02e1ad2dc4a

  • SHA1

    367beedcaa104f82626a112d8ffeb58fba7e07cb

  • SHA256

    310b4ffa559e06b739ba7b4d7cd12f47286aec7352a8aa5296955f0a7f49b190

  • SHA512

    a2cf7b4f080203117ded70269476c3e703942df10afccf7a138ee1e1b0212b46246a2147518339b02be943024ca6c652dabb70290831b89e0f60aa0608a89d6b

  • SSDEEP

    12288:9H5nvEeyWvXp6/rcaIdxj42SNqwgxUiWV32ohJ9xtvqeNtVQR/4ve:jvEeVR6zc3j4XSE/3tvhO4ve

Malware Config

Extracted

Family

formbook

Campaign

uymo

Decoy

A4J+j1lFUiMbPgQD0uzpdg==

F3lajp/JwxgpzPZ3bf9zrK0EzWDU/JY=

bOCwjfx/jOF4Las6GFv7+tQ=

9BDZHgUVSa1ypSWjNcPR

S9u+wp+ai+yEW4OWIQ==

wXxiP8BRWDG2JiTw5XA=

VeumNjNg3QeL/qtw

KYxbMI9RU7eqPpEYg1v7+tQ=

zwfU2Vv4NxXzDLy1IWFrDo3iqOoV1KB3

0XQ3wM3oGntH+iTw5XA=

nx7p2XIfYkHv9+Uu+VKx3l41j3mS454=

+BIOmtNni5xbAo5VEZFYQFAw

tkQa0SXOEjV/0yTw5XA=

YOLHv42Us4eMrHCod80dYluXJzNn

HZdsbBNsdAvOq+cr4CaIfg==

YlQ/0dwFQYtd+DXIxzKUlO8kBc9C9A==

mCL+zS69yZ9DyvVMC4399tE/Xk0V1KB3

+tXLkwCl2LyCqaNnalv7+tQ=

yPzM2bjLKPyixsjWSoWe9NI=

KQPQVL5puBHigv/RmyAU0ExD4GDU/JY=

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.217947.21963.1711.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.217947.21963.1711.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.217947.21963.1711.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.217947.21963.1711.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/768-60-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/768-61-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/768-63-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/768-66-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/768-67-0x0000000000401000-0x000000000042F000-memory.dmp

    Filesize

    184KB

  • memory/768-68-0x00000000008F0000-0x0000000000BF3000-memory.dmp

    Filesize

    3.0MB

  • memory/1600-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

    Filesize

    8KB

  • memory/1600-56-0x00000000002E0000-0x00000000002FC000-memory.dmp

    Filesize

    112KB

  • memory/1600-57-0x0000000000290000-0x000000000029C000-memory.dmp

    Filesize

    48KB

  • memory/1600-58-0x0000000005DE0000-0x0000000005E70000-memory.dmp

    Filesize

    576KB

  • memory/1600-59-0x0000000000BC0000-0x0000000000BF6000-memory.dmp

    Filesize

    216KB

  • memory/1600-54-0x0000000000DB0000-0x0000000000EA0000-memory.dmp

    Filesize

    960KB