Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2022, 20:12

General

  • Target

    tmp.exe

  • Size

    274KB

  • MD5

    3745a1fe4166a96e06729c67fd1469c7

  • SHA1

    0bef21b140c023b1158ba5d90f74fb761f1c573b

  • SHA256

    e4a8d78909b8d84fcb3d01b91ddeab26615148da704621a3635ac869c9d5dcaf

  • SHA512

    0f8800a60cc66a64b9c14421c60b96c416e73612542f64b1a96758514b6f45552c68ae5a4f64ea7eee37298bf9cc3cf1da1ec0dbcc332ff4942b137f416654cc

  • SSDEEP

    6144:PweEU2uCgUVrQSDux93/mMvthm7pp7jsSLWVaKsTdDfYJfTd:z2uCg69Dux9Pmehm7pp/sSaVMZYJfTd

Malware Config

Extracted

Family

formbook

Campaign

axe3

Decoy

nV63ydJMXMf7memspIpnnVLl3Q==

uJ50rs5Y/80AqT79guHh

FcsTFQ1xekTgcal8G0P2ZTQ=

uLWWVJP++ID3dkoB8g==

YyoybGF5Fsa/UH8=

Tk4htwkBBfM5ZA==

QgJ8vN9f+uCdsD79guHh

wmjC9UuSBGyTrY5PAX9t1A==

Sw7JEwOKl576ndxw/A==

BOqs09Ikjej1BN98ZYtVfSi5xQ==

YA5cbH3/4wVAYg==

fRWIvatAXM3+t0X9guHh

FAbZXq/jFuaEq2YCwQh3b2oE

STL+RDTA652/tD/9guHh

zgLNcuX32aFB

WmgwW1UCJ/9Nc0ofkIhVyQ==

jiWgy9ckGh8G+3Q7Rl//NW9ZU7TU

JCoawiBkwAkeJOehkNXRCYnj3A==

WQDFZvang91P

zGrJ4CA2pAhR

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Users\Admin\AppData\Local\Temp\psyfho.exe
        "C:\Users\Admin\AppData\Local\Temp\psyfho.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\Users\Admin\AppData\Local\Temp\psyfho.exe
          "C:\Users\Admin\AppData\Local\Temp\psyfho.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:588
    • C:\Windows\SysWOW64\wininit.exe
      "C:\Windows\SysWOW64\wininit.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1828

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\iyswjuwfq.txa

      Filesize

      185KB

      MD5

      ea21e5d81767a314ccb0ba7becaf765f

      SHA1

      0630995a565e43c9c0b00e1a6365ee08e9c93019

      SHA256

      5e41e235f96c3bc784d1d5959752e8f5184366c7c265de1bc76279ad2d2e96c4

      SHA512

      4e308c7812813e6a1aefe7a1e64ca495be0f38824989bc07796375487000ace87c71130bf40fd372a06e22c0a1e14d511bec0f1e46119445cc7385e5ffae2f99

    • C:\Users\Admin\AppData\Local\Temp\mqndj.psu

      Filesize

      5KB

      MD5

      8cdd489fb795ba76d37af601d3e1bc5c

      SHA1

      0db9fa2de0de0d468d26636ab21e4f6e1ba6457d

      SHA256

      91462d813f240b66b586ce6bca0ae1a3d7acb6f4e8a9c787b3b76f5afdf8e72c

      SHA512

      c18686766a4c1fbdf5d5ac92069832de0b540d046d695d59b6df0b2fd917885f737a0572443e224206780d3d5c9accf7923aea34404bb3689c150104a571ea1e

    • C:\Users\Admin\AppData\Local\Temp\psyfho.exe

      Filesize

      77KB

      MD5

      6e99b51b6533fe7a1ed56fa1ea553b82

      SHA1

      fb422cda0e04c577528849b4400d8b1ff44e9589

      SHA256

      5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48

      SHA512

      f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c

    • C:\Users\Admin\AppData\Local\Temp\psyfho.exe

      Filesize

      77KB

      MD5

      6e99b51b6533fe7a1ed56fa1ea553b82

      SHA1

      fb422cda0e04c577528849b4400d8b1ff44e9589

      SHA256

      5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48

      SHA512

      f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c

    • C:\Users\Admin\AppData\Local\Temp\psyfho.exe

      Filesize

      77KB

      MD5

      6e99b51b6533fe7a1ed56fa1ea553b82

      SHA1

      fb422cda0e04c577528849b4400d8b1ff44e9589

      SHA256

      5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48

      SHA512

      f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c

    • \Users\Admin\AppData\Local\Temp\psyfho.exe

      Filesize

      77KB

      MD5

      6e99b51b6533fe7a1ed56fa1ea553b82

      SHA1

      fb422cda0e04c577528849b4400d8b1ff44e9589

      SHA256

      5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48

      SHA512

      f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c

    • \Users\Admin\AppData\Local\Temp\psyfho.exe

      Filesize

      77KB

      MD5

      6e99b51b6533fe7a1ed56fa1ea553b82

      SHA1

      fb422cda0e04c577528849b4400d8b1ff44e9589

      SHA256

      5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48

      SHA512

      f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c

    • \Users\Admin\AppData\Local\Temp\psyfho.exe

      Filesize

      77KB

      MD5

      6e99b51b6533fe7a1ed56fa1ea553b82

      SHA1

      fb422cda0e04c577528849b4400d8b1ff44e9589

      SHA256

      5dbe88158dd2f1913f67b98a9505c38e370846583cadcb668c759a4b60e5cb48

      SHA512

      f9af2c0bc3b420a04436436e1ba6816882e6204a242b58e519b3dfa8c272572e247c858fb108e4fab5c5acb355d17db49ecfe759c6c5db5de674314b28301b0c

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll

      Filesize

      837KB

      MD5

      e1b58e0aa1b377a1d0e940660ad1ace1

      SHA1

      5afc7291b26855b1252b26381ebc85ed3cca218f

      SHA256

      1b98c006231d38524e2278a474c49274fe42e0bb1a31bcfda02e6e32f559b777

      SHA512

      9ce778bcb586638662b090910c4ceab3b64e16dfaf905a7581c1d349fecdf186995b3cc0dc8c6fc6e9761ea2831d7b14ac1619c2bd5ebc6d18015842e5d94aa2

    • memory/588-67-0x0000000000401000-0x000000000042F000-memory.dmp

      Filesize

      184KB

    • memory/588-69-0x0000000000170000-0x0000000000180000-memory.dmp

      Filesize

      64KB

    • memory/588-66-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/588-68-0x0000000000800000-0x0000000000B03000-memory.dmp

      Filesize

      3.0MB

    • memory/1112-72-0x0000000000D70000-0x0000000000D8A000-memory.dmp

      Filesize

      104KB

    • memory/1112-73-0x0000000000080000-0x00000000000AD000-memory.dmp

      Filesize

      180KB

    • memory/1112-74-0x0000000002190000-0x0000000002493000-memory.dmp

      Filesize

      3.0MB

    • memory/1112-75-0x0000000000960000-0x00000000009EF000-memory.dmp

      Filesize

      572KB

    • memory/1112-77-0x0000000000080000-0x00000000000AD000-memory.dmp

      Filesize

      180KB

    • memory/1220-70-0x0000000006C60000-0x0000000006DEA000-memory.dmp

      Filesize

      1.5MB

    • memory/1220-76-0x0000000006500000-0x000000000666C000-memory.dmp

      Filesize

      1.4MB

    • memory/1220-79-0x0000000006500000-0x000000000666C000-memory.dmp

      Filesize

      1.4MB

    • memory/1536-54-0x0000000075681000-0x0000000075683000-memory.dmp

      Filesize

      8KB