Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2022, 16:14

General

  • Target

    fb4fddb4cbdf4cfe8a3c658c6634d4a1d653f9fa61c4ca2ecb069770bf3cae57.exe

  • Size

    225KB

  • MD5

    c20af4b2b3bcb4bb82ef4a78818caffa

  • SHA1

    ddc2f854e96e649a300c6cba5bc8d57d0af8de58

  • SHA256

    fb4fddb4cbdf4cfe8a3c658c6634d4a1d653f9fa61c4ca2ecb069770bf3cae57

  • SHA512

    e53b8819e810d853f2fdf86e129058b096df025bdcf8ec308d8f69b796b911f52f0e1c60431654ac03caf081abdcbef807cb664f6581d6ff61ba9742cf2f33ab

  • SSDEEP

    3072:qUJoFfWzzl+cSMY7xIsqoh3vpj+WSuW2x96i6e4coO81ju5qoRNir+QKQqjQgWmA:qweEpGxj9pHHeFwVNr7jzUBWnk/fZ

Malware Config

Extracted

Family

formbook

Campaign

fqsu

Decoy

GhfTqaOqC4FsyoQRW/8=

kbPIpd/8k1C6zJz5mYYdK90ZUA==

VIdg/CoNGeYJHA==

KhzoqndOhw1j43z0ew==

wv8mTDcsX2wJN/Q=

MqBgt6S+3BgGKBQHLZy7Ucg=

GyhOb++nZDi39NPK7dbaKapf

pBtD1UoSTdo3eSp9H7OhRqMV0TAuKMU=

WTzTg1w+fP4fMO0oPPM=

NS/tpGdUwkiMwqmgkxoSzjrQATAuKMU=

MnoSdM1hYn4tdwxjB2fX

3EUfH2EJY17mMf4=

V9/wg2yCQruVszm7V+4=

aNL8pZCGYW4Ej2LD

1Bif9VkmdgVfrJqRvl1GtlTZq1M=

9wHIgmB8EOB2uUVcUfk=

1Fdn15qem+fL1qhrY9xdQmAnVg==

Y32ThttYUUr6PsuRmozlNP74RD+uBz7dOQ==

f5HKyoWNAJLM2qjnZlizsvXDKFs=

mRfaGezap6ZyvJqthZvf

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\AppData\Local\Temp\fb4fddb4cbdf4cfe8a3c658c6634d4a1d653f9fa61c4ca2ecb069770bf3cae57.exe
      "C:\Users\Admin\AppData\Local\Temp\fb4fddb4cbdf4cfe8a3c658c6634d4a1d653f9fa61c4ca2ecb069770bf3cae57.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Users\Admin\AppData\Local\Temp\bquztp.exe
        "C:\Users\Admin\AppData\Local\Temp\bquztp.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Users\Admin\AppData\Local\Temp\bquztp.exe
          "C:\Users\Admin\AppData\Local\Temp\bquztp.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1908
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe"
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1820

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\bquztp.exe

      Filesize

      6KB

      MD5

      e31a7d32d2fd851ae1b00ff85dd3a9ca

      SHA1

      1e63242b754008bfae79a5ab8e7a2ea45cc2dcd3

      SHA256

      aed72f8afba130aa196db63b1b036450d539c55f3bf9a352df09ce1f9202bddf

      SHA512

      ab51bcfb7d6fe8ff1f62ba030334594c25347eca882348ae1933c7001f841eab24d429704479bb8e343b03e7192506be48a17ece2c999862ee644ec094ced593

    • C:\Users\Admin\AppData\Local\Temp\bquztp.exe

      Filesize

      6KB

      MD5

      e31a7d32d2fd851ae1b00ff85dd3a9ca

      SHA1

      1e63242b754008bfae79a5ab8e7a2ea45cc2dcd3

      SHA256

      aed72f8afba130aa196db63b1b036450d539c55f3bf9a352df09ce1f9202bddf

      SHA512

      ab51bcfb7d6fe8ff1f62ba030334594c25347eca882348ae1933c7001f841eab24d429704479bb8e343b03e7192506be48a17ece2c999862ee644ec094ced593

    • C:\Users\Admin\AppData\Local\Temp\bquztp.exe

      Filesize

      6KB

      MD5

      e31a7d32d2fd851ae1b00ff85dd3a9ca

      SHA1

      1e63242b754008bfae79a5ab8e7a2ea45cc2dcd3

      SHA256

      aed72f8afba130aa196db63b1b036450d539c55f3bf9a352df09ce1f9202bddf

      SHA512

      ab51bcfb7d6fe8ff1f62ba030334594c25347eca882348ae1933c7001f841eab24d429704479bb8e343b03e7192506be48a17ece2c999862ee644ec094ced593

    • C:\Users\Admin\AppData\Local\Temp\eggcij.vx

      Filesize

      185KB

      MD5

      cfa7847468c5383cd501f8f805e0021a

      SHA1

      f44e223a9af2db99ac56f2f7927fb64949ab1664

      SHA256

      58a415b44850c89beb91dbc1c21c81f8476970ea6226645483f268d68a271cd7

      SHA512

      e4ae5c17d31e45a9dadf72881cd1c42dd8d82095b0068c620b924c90ea328f0e78ddefb3e14f23da28d650bbe273698586327f4cb07dc6098ecd3920eb6e3d98

    • C:\Users\Admin\AppData\Local\Temp\nzieacxv.p

      Filesize

      5KB

      MD5

      b104c03dbda7dcb8f911d3d48ef3cdc5

      SHA1

      24f0c3f064a2fc7fbb945bcb89a4dc3914519ff2

      SHA256

      d9225978ab417360cb9fd791ea653ff49f6b2c4df533d0be078e30eca7b0832f

      SHA512

      a61e358fe6d43c45b7cb0a00d770ff8b9d0696c8b09ef7b1ac42a51ba838b2854b4d61c05ead24dab15041dfdde661f32422da650231c170e2cfc8d325491d66

    • \Users\Admin\AppData\Local\Temp\bquztp.exe

      Filesize

      6KB

      MD5

      e31a7d32d2fd851ae1b00ff85dd3a9ca

      SHA1

      1e63242b754008bfae79a5ab8e7a2ea45cc2dcd3

      SHA256

      aed72f8afba130aa196db63b1b036450d539c55f3bf9a352df09ce1f9202bddf

      SHA512

      ab51bcfb7d6fe8ff1f62ba030334594c25347eca882348ae1933c7001f841eab24d429704479bb8e343b03e7192506be48a17ece2c999862ee644ec094ced593

    • \Users\Admin\AppData\Local\Temp\bquztp.exe

      Filesize

      6KB

      MD5

      e31a7d32d2fd851ae1b00ff85dd3a9ca

      SHA1

      1e63242b754008bfae79a5ab8e7a2ea45cc2dcd3

      SHA256

      aed72f8afba130aa196db63b1b036450d539c55f3bf9a352df09ce1f9202bddf

      SHA512

      ab51bcfb7d6fe8ff1f62ba030334594c25347eca882348ae1933c7001f841eab24d429704479bb8e343b03e7192506be48a17ece2c999862ee644ec094ced593

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll

      Filesize

      904KB

      MD5

      5e5ba61531d74e45b11cadb79e7394a1

      SHA1

      677224e14aac9dd35f367d5eb1704b36e69356b8

      SHA256

      99e91ae250c955bd403ec1a2321d6b11fcb715bdcc7cb3f63ffb46b349afde5c

      SHA512

      712bfe419ba97ecf0ec8323a68743013e8c767da9d986f74ab94d2a395c3086cac2a5823048e0022d3bbcebb55281b9e1f8c87fdc9295c70cc5521b57850bf46

    • memory/900-54-0x0000000076121000-0x0000000076123000-memory.dmp

      Filesize

      8KB

    • memory/1420-76-0x00000000097D0000-0x000000000995A000-memory.dmp

      Filesize

      1.5MB

    • memory/1420-74-0x00000000097D0000-0x000000000995A000-memory.dmp

      Filesize

      1.5MB

    • memory/1420-68-0x00000000072F0000-0x000000000749A000-memory.dmp

      Filesize

      1.7MB

    • memory/1908-66-0x0000000000930000-0x0000000000C33000-memory.dmp

      Filesize

      3.0MB

    • memory/1908-67-0x00000000000F0000-0x0000000000100000-memory.dmp

      Filesize

      64KB

    • memory/1908-65-0x0000000000401000-0x000000000042F000-memory.dmp

      Filesize

      184KB

    • memory/1908-64-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1988-70-0x000000004A480000-0x000000004A4CC000-memory.dmp

      Filesize

      304KB

    • memory/1988-71-0x0000000000080000-0x00000000000AD000-memory.dmp

      Filesize

      180KB

    • memory/1988-72-0x00000000021E0000-0x00000000024E3000-memory.dmp

      Filesize

      3.0MB

    • memory/1988-73-0x00000000003D0000-0x000000000045F000-memory.dmp

      Filesize

      572KB

    • memory/1988-75-0x0000000000080000-0x00000000000AD000-memory.dmp

      Filesize

      180KB