Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2022, 14:13

General

  • Target

    SecuriteInfo.com.Trojan.Mardom.MN.10.23111.3388.exe

  • Size

    1.1MB

  • MD5

    3c21079c403687f4339a136919931ef5

  • SHA1

    05bb1260bbdc0d05460f41e2423691f7c044bbe9

  • SHA256

    2088000ab7a60b6d9eb519d1da9d42934e908a9724ab6977bc853d30b7f96642

  • SHA512

    1285f2e9b1fb1cf2785f88514542a8bf7beeed52558fa9fb49280e2c91b1e17ccfc514435969491cbd0cd0d4f9d29e7803eec248ca43e04ebf37d5f14d05bc38

  • SSDEEP

    24576:LNlitFN9lSz5iPqjiX+Iv3GytN1YeZo82E+u6Sz73JEL:LvizNCzc2I/GYNj6zup5E

Malware Config

Extracted

Family

formbook

Campaign

u6hu

Decoy

OvIuZKrtOMxghbaZbvb/8h9g+Q==

mjHLVEVO8gwVeZ+7

Lh1lcZzH8pTXgpdDzV0vzyVooAsviHQ=

OzJXhMQYaQKNT1aBY/gM8h9g+Q==

WSJFbX28mK+jXVvRJofdtSc=

mEv6JdT2o7Nq++XYt8MFpx5QrhRdhA==

Wxf/NnjMRlBj6JK3jg==

nB21Q0tg7gEVeZ+7

IZinOswGUPAn51eHvCAoMetC

INxV9PYg7AQP0xyDAyg=

kkZP+Iq1AgMVeZ+7

meuru6sSaxxuoLS7gA==

y0jMTFyffedqCSRXVfm/

sJbTfRVKuQScxw==

+ecHP3ayIjYFnb7j2Pt6z5dK

uZnHRwRE9QwVeZ+7

ZBg6Sy054P4oHp0DknCx

nFXn8j4yTuJ9aOfNlw==

35ygHt8uASpReRyDAyg=

8nT3T+8eWeh6aOfNlw==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.10.23111.3388.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.10.23111.3388.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAzAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3888
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.10.23111.3388.exe
      C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.MN.10.23111.3388.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3048

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3048-149-0x0000000001290000-0x00000000015DA000-memory.dmp

    Filesize

    3.3MB

  • memory/3048-148-0x0000000000401000-0x000000000042E000-memory.dmp

    Filesize

    180KB

  • memory/3048-147-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3048-145-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3208-133-0x00000000053C0000-0x0000000005452000-memory.dmp

    Filesize

    584KB

  • memory/3208-134-0x0000000005A10000-0x0000000005FB4000-memory.dmp

    Filesize

    5.6MB

  • memory/3208-135-0x0000000005490000-0x00000000054B2000-memory.dmp

    Filesize

    136KB

  • memory/3208-132-0x0000000000570000-0x0000000000684000-memory.dmp

    Filesize

    1.1MB

  • memory/3888-142-0x0000000007FF0000-0x000000000866A000-memory.dmp

    Filesize

    6.5MB

  • memory/3888-143-0x0000000006CC0000-0x0000000006CDA000-memory.dmp

    Filesize

    104KB

  • memory/3888-141-0x00000000067B0000-0x00000000067CE000-memory.dmp

    Filesize

    120KB

  • memory/3888-140-0x0000000006150000-0x00000000061B6000-memory.dmp

    Filesize

    408KB

  • memory/3888-139-0x00000000060E0000-0x0000000006146000-memory.dmp

    Filesize

    408KB

  • memory/3888-138-0x00000000058E0000-0x0000000005F08000-memory.dmp

    Filesize

    6.2MB

  • memory/3888-137-0x00000000051F0000-0x0000000005226000-memory.dmp

    Filesize

    216KB