Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2022, 15:20

General

  • Target

    NEW_ORDER_00041221.EXE.exe

  • Size

    6KB

  • MD5

    78715a3a620e1f4b1937a1bd7e764e57

  • SHA1

    0b67de4eaccbfe16d41bedc538b2a64bffaecbb0

  • SHA256

    37ad2a3bfe4e60fb4ad6f9edf3bd25602ebdbacf2ce429e96c3ec7b4213090e2

  • SHA512

    b55a095194d506bd111fe9d93440ee97be0f9418256e839ee3ce892af1206711402c493bdbeca021d4187433c0f080febfa44451e03737c3ddf6f0b6c9ccd91a

  • SSDEEP

    96:x+UKECqBC+bbhb4Lp5zV6ur8y2LnfoYYMxaDzNt:xgwHhcLp1V6ur+LfoYY5F

Malware Config

Extracted

Family

formbook

Campaign

gski

Decoy

w4dqmeRbroucK1d6Rjoieflr

4aOmGT8hdudzUsv7ZSwieflr

3sTC4jMnhzX+pOJNTZ4=

JcH9cI2V8BEeA0eA

doY0NLSYANTXiHt9/fbsP706cA==

KhN1zCT4Nb5T//UnNQ==

y4/RV2RRqNEr0c4nzNWP

x8sfUpcmiXqxdfls0dSN

rlygM3RQmQ7DliRSBQUKpWJ/FuU=

s672RU9HtT3XWaTvdEidsoLRjZb5J5oE

uaT/Znv3O9WfXs8GBluj2Z2szeMP

QvElhI8JUPHBlRsjsodB5GmUzO0W

2uM5rt7BEpcswwJhDA8JnA8=

TDFfhORfvuRP//UnNQ==

MtPNDl4mh1dSxgZs0dSN

ejpoOLXE/Wa7zMwppl3JOt8faA==

8qPraI3lOFSrRmCSR4EnHQc=

+LOpAwtx0LfGnOJNTZ4=

wMQehpwddDxHII+rVCwieflr

8KPhZrjGG//aix1s0dSN

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\NEW_ORDER_00041221.EXE.exe
      "C:\Users\Admin\AppData\Local\Temp\NEW_ORDER_00041221.EXE.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA3AA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4856
      • C:\Users\Admin\AppData\Local\Temp\NEW_ORDER_00041221.EXE.exe
        C:\Users\Admin\AppData\Local\Temp\NEW_ORDER_00041221.EXE.exe
        3⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2108
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\SysWOW64\netsh.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:2184

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2108-155-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2108-149-0x0000000000401000-0x000000000042F000-memory.dmp

      Filesize

      184KB

    • memory/2108-146-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2108-151-0x00000000010D0000-0x000000000141A000-memory.dmp

      Filesize

      3.3MB

    • memory/2108-152-0x00000000007F0000-0x0000000000800000-memory.dmp

      Filesize

      64KB

    • memory/2108-156-0x0000000000401000-0x000000000042F000-memory.dmp

      Filesize

      184KB

    • memory/2108-148-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2204-153-0x00000000085A0000-0x0000000008744000-memory.dmp

      Filesize

      1.6MB

    • memory/2204-161-0x0000000003380000-0x00000000034D2000-memory.dmp

      Filesize

      1.3MB

    • memory/2204-163-0x0000000003380000-0x00000000034D2000-memory.dmp

      Filesize

      1.3MB

    • memory/2688-132-0x0000000000940000-0x0000000000948000-memory.dmp

      Filesize

      32KB

    • memory/2688-136-0x0000000008120000-0x0000000008142000-memory.dmp

      Filesize

      136KB

    • memory/2688-135-0x0000000005390000-0x000000000539A000-memory.dmp

      Filesize

      40KB

    • memory/2688-133-0x00000000057C0000-0x0000000005D64000-memory.dmp

      Filesize

      5.6MB

    • memory/2688-134-0x00000000052D0000-0x0000000005362000-memory.dmp

      Filesize

      584KB

    • memory/4228-160-0x00000000015C0000-0x000000000164F000-memory.dmp

      Filesize

      572KB

    • memory/4228-162-0x0000000000F00000-0x0000000000F2D000-memory.dmp

      Filesize

      180KB

    • memory/4228-159-0x0000000000F00000-0x0000000000F2D000-memory.dmp

      Filesize

      180KB

    • memory/4228-157-0x0000000001680000-0x000000000169E000-memory.dmp

      Filesize

      120KB

    • memory/4228-158-0x0000000001850000-0x0000000001B9A000-memory.dmp

      Filesize

      3.3MB

    • memory/4856-139-0x0000000005A20000-0x0000000006048000-memory.dmp

      Filesize

      6.2MB

    • memory/4856-140-0x0000000006050000-0x00000000060B6000-memory.dmp

      Filesize

      408KB

    • memory/4856-141-0x0000000006170000-0x00000000061D6000-memory.dmp

      Filesize

      408KB

    • memory/4856-142-0x00000000067F0000-0x000000000680E000-memory.dmp

      Filesize

      120KB

    • memory/4856-144-0x0000000006CF0000-0x0000000006D0A000-memory.dmp

      Filesize

      104KB

    • memory/4856-138-0x0000000003210000-0x0000000003246000-memory.dmp

      Filesize

      216KB

    • memory/4856-143-0x0000000008050000-0x00000000086CA000-memory.dmp

      Filesize

      6.5MB