Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    tmp

  • Size

    1.0MB

  • Sample

    221014-xp84gsebgp

  • MD5

    da04d6b7b1499842ee15fd06f0753a7b

  • SHA1

    51ab26f7074d2836ea4e1c3b9f0a9e8eb6b57929

  • SHA256

    1046455f39dbe56dc8cc160ebc53b5b32315021af4a871c06235a5257e02f123

  • SHA512

    6023ed14d7abdbcd734050ba46162024fd7b39eddad5973e7bdf5de7b1bdc233822c1a4f6027b99f3cebafeb46a41c5fdc82c693beaaa335065316cfdb382852

  • SSDEEP

    12288:NyqF7UsDy+vMCt3kzBXDanOmitbih4Lb/aUIYfa7N2NZiuEQDFFAQSQy4At:NJF0UD3kNTcJhmzPZWwAtQy4A

Malware Config

Extracted

Family

formbook

Campaign

s8gw

Decoy

b/iFndOEL2rKvw==

HK7quAepCJH6CkNgpH2cDYx1

YEayMA+cR1WQ0Qw/lQ==

kPVNVkAC6pEPHVFQnzCxsA==

yLE1wrE7kf1KRGRm5a95qQ==

D6ktQZWoaOJGopmOlg==

98rmMok6y5e47YvCCMQNPaqM6qf+7PsEAQ==

7Po3fdN1NNtop0X5Ryv9PnUrSLQ=

+vk1DU92V465rf1+gFhdWMFoAsAY

AuhZ6jw45aHmPdzGVilx

/9ln8smKekiYzqePkA==

7+gsdtTlpqcSL0/GVilx

6pXLEOumjAfvK8Y=

inT5kfC0FBmcw/hw7NYua819

wb/qKZCjfrEiKFz9Vyn9chrZxA==

Pil1K4a6ruUXJ2fPD5qXo+2pNMn5VdCREA==

mxo3/mBm1hMSWd8=

8ltzwIsdiPpJXbK30JecDYx1

BmrK2y9G+VyimqzrK9YtmYY=

jPP9Q/IqWt3JQSZtvqI1jb9oAsAY

Targets

    • Target

      tmp

    • Size

      1.0MB

    • MD5

      da04d6b7b1499842ee15fd06f0753a7b

    • SHA1

      51ab26f7074d2836ea4e1c3b9f0a9e8eb6b57929

    • SHA256

      1046455f39dbe56dc8cc160ebc53b5b32315021af4a871c06235a5257e02f123

    • SHA512

      6023ed14d7abdbcd734050ba46162024fd7b39eddad5973e7bdf5de7b1bdc233822c1a4f6027b99f3cebafeb46a41c5fdc82c693beaaa335065316cfdb382852

    • SSDEEP

      12288:NyqF7UsDy+vMCt3kzBXDanOmitbih4Lb/aUIYfa7N2NZiuEQDFFAQSQy4At:NJF0UD3kNTcJhmzPZWwAtQy4A

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks