Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/10/2022, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
Ref8810998235 Auto System Generated Order Form 051022.exe
Resource
win7-20220812-en
General
-
Target
Ref8810998235 Auto System Generated Order Form 051022.exe
-
Size
920KB
-
MD5
7bf0c2ef33695a76ec7cf8b489cef20d
-
SHA1
0aaced5986e6dd808ce1128233407d6db7331206
-
SHA256
832ba5363bd145bbcc01871bf79726fe7d4cfe90d9f93d9cca64598887c91d38
-
SHA512
31fa2a2a84ea1474b0f1182d1f6ca8b687c29a5246bb58941c86604065e8ed8bb7e49ef41ab84b5f41078fe82f384eb87ead21ee527c0091dd06b79f1ad64cce
-
SSDEEP
12288:oPCJRz6sid7VycOInfQcbD5+6eAPxB4PWbRdxk4ve:qk6/d7VycpnbI6eWxB68de4ve
Malware Config
Extracted
formbook
r83r
dF1arqf0q8jqGHpo
3s5obdLT/D42OkXYzXA=
MY4GqPg1TNBZiXEkrsyhlycGUN24oOaU
wKsmWEGSmhvRwo4=
jXeqRbgNrXzVBjEkt+Ircn8q8uqLRxB04g==
kWzwCGp3hZyQemHg2Ho=
vlaarHzH3YTtXSLeyQ==
LSNL62SxS36qDZBx
QzB7kGyuEkIf
AFmNF5DlgUzZjArFIxovHKlaz9E74po=
C/cWvSksOW1y2Gdi
5FdJf9GEwRvRwo4=
szFiiGFq8ubjqCPe/ChZC0g=
AWObGX3KVG9bBtWG4Mu5
80uIK32XLmNVA4xryvpajNA0
10WHLY+Nqu3Pkw/cKRD3Y6pVG8jd
kW/9OTF2FgXkki8UJM8K1vSogA0XnQ==
mAtF/lLM2RvRwo4=
VNFX6OUCoH1rU0XYzXA=
qAdGBejjez+ZCfPo0A==
yTR2+GKnGsAJQ1FKSid6ocYt
JyBe6lqrOf1t5Cn4xS5Y3cB2Mw==
syE7MRBZYJSHoqItMsis
/WeHjltQ+jUs3nR28RZR3cB2Mw==
Fe7zgspEodA/gg==
shdWfUhT/Ar8rlM4BiMlNQ==
ta0kJZidw0f345c=
uCWQHPUF/j0zHwK123Y=
XcENsP/+NnZUQkXYzXA=
2UrZd9kTJbAoKtaYjO9xnkw=
PbE5xsPhZ009BYhHn5KngqUJsGINig==
TLQwww9Sge1JcGA4EK73J5PEayo=
QrflC+Lz7CAR/bacnkdpcCUQVN64oOaU
kY7GaLLD8HXXCgvZlojjIg==
8lagWtvn5l7UXSLeyQ==
Qqon50dcodA/gg==
7NQKC+03QHRWQEXYzXA=
qQNU8kJQodA/gg==
AVmNPaGttjem1+a+uzJa3cB2Mw==
f+lR7c7ihnk9o8pF3cq7
UcJSAGm24mULzreoju9xnkw=
TDtu5jN5B8pAiqJk+iZajNA0
rqkrVd/SfFQyCJlF3cq7
wzKmM4vWbi6SAks4x/pajNA0
pAWQEPb0imHXXSLeyQ==
2MDsmgcWGIvx8p1xz8HmlJPEayo=
w7Pfeek1cQRgUPu9u2aVkHFZP7/57pI=
hfdtMLMEIIziEhvilojjIg==
H3OtS88kV8o5jbaAWQZe3cB2Mw==
6N0VtR91JvRsuKQtMsis
s7Hfb8TR31DTLY5F3cq7
mIOpRcUbkz7qGHpo
FgllXfJJw4DzYbi+iOd1N4FmqiI=
qhtb2+X+imZGDpNy1P4tlcUnKNq4oOaU
7NUQxzg7a7qz8Ukk3g==
C/EjxD2VO3JfB9WG4Mu5
uiNMY1JQ2p4JZdDKMSlajNA0
kAVCQSRxcZldCKeKjO9xnkw=
RyOeuzx/YiCXnohsPqyp3cB2Mw==
Q7gooXZ6LvJvM0Q3G5az
gOQYSDEqXsYcTHQtMsis
gfYpIfpLQMIfEPTT1nVlZt59GpLE
FX/6mJ+5Szoq65qV1PZajNA0
GgFyk4HS2Uf35ZM=
yankeebuilder.com
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 7 676 msiexec.exe 8 676 msiexec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation Ref8810998235 Auto System Generated Order Form 051022.exe -
Loads dropped DLL 1 IoCs
pid Process 676 msiexec.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1824 set thread context of 1968 1824 Ref8810998235 Auto System Generated Order Form 051022.exe 27 PID 1968 set thread context of 1216 1968 Ref8810998235 Auto System Generated Order Form 051022.exe 14 PID 1968 set thread context of 1216 1968 Ref8810998235 Auto System Generated Order Form 051022.exe 14 PID 676 set thread context of 1216 676 msiexec.exe 14 -
description ioc Process Key created \Registry\User\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1968 Ref8810998235 Auto System Generated Order Form 051022.exe 1968 Ref8810998235 Auto System Generated Order Form 051022.exe 1968 Ref8810998235 Auto System Generated Order Form 051022.exe 1968 Ref8810998235 Auto System Generated Order Form 051022.exe 1968 Ref8810998235 Auto System Generated Order Form 051022.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 1968 Ref8810998235 Auto System Generated Order Form 051022.exe 1968 Ref8810998235 Auto System Generated Order Form 051022.exe 1968 Ref8810998235 Auto System Generated Order Form 051022.exe 1968 Ref8810998235 Auto System Generated Order Form 051022.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe 676 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1968 Ref8810998235 Auto System Generated Order Form 051022.exe Token: SeDebugPrivilege 676 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1824 wrote to memory of 1968 1824 Ref8810998235 Auto System Generated Order Form 051022.exe 27 PID 1824 wrote to memory of 1968 1824 Ref8810998235 Auto System Generated Order Form 051022.exe 27 PID 1824 wrote to memory of 1968 1824 Ref8810998235 Auto System Generated Order Form 051022.exe 27 PID 1824 wrote to memory of 1968 1824 Ref8810998235 Auto System Generated Order Form 051022.exe 27 PID 1824 wrote to memory of 1968 1824 Ref8810998235 Auto System Generated Order Form 051022.exe 27 PID 1824 wrote to memory of 1968 1824 Ref8810998235 Auto System Generated Order Form 051022.exe 27 PID 1824 wrote to memory of 1968 1824 Ref8810998235 Auto System Generated Order Form 051022.exe 27 PID 1216 wrote to memory of 676 1216 Explorer.EXE 28 PID 1216 wrote to memory of 676 1216 Explorer.EXE 28 PID 1216 wrote to memory of 676 1216 Explorer.EXE 28 PID 1216 wrote to memory of 676 1216 Explorer.EXE 28 PID 1216 wrote to memory of 676 1216 Explorer.EXE 28 PID 1216 wrote to memory of 676 1216 Explorer.EXE 28 PID 1216 wrote to memory of 676 1216 Explorer.EXE 28 PID 676 wrote to memory of 544 676 msiexec.exe 31 PID 676 wrote to memory of 544 676 msiexec.exe 31 PID 676 wrote to memory of 544 676 msiexec.exe 31 PID 676 wrote to memory of 544 676 msiexec.exe 31 PID 676 wrote to memory of 544 676 msiexec.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\Ref8810998235 Auto System Generated Order Form 051022.exe"C:\Users\Admin\AppData\Local\Temp\Ref8810998235 Auto System Generated Order Form 051022.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\Ref8810998235 Auto System Generated Order Form 051022.exe"C:\Users\Admin\AppData\Local\Temp\Ref8810998235 Auto System Generated Order Form 051022.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:544
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
890KB
MD58402a6aa76d7787ff03943dd129e3d83
SHA1895338cb761d62930ca93918011fd2cd33d5b30c
SHA25649ff99d5b24f4f7d5a8ea175f35a6548c74b04e5c621c60121b5088dab19b4eb
SHA51239bbe90385be35492825929296aae771fb4afb00a1f6a48f0e4ec17bc1097c3a32cea3b22033116c82695e66acbd6c847483a8da21e7302240467b58e39169ea