Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2022, 16:14

General

  • Target

    fb4fddb4cbdf4cfe8a3c658c6634d4a1d653f9fa61c4ca2ecb069770bf3cae57.exe

  • Size

    225KB

  • MD5

    c20af4b2b3bcb4bb82ef4a78818caffa

  • SHA1

    ddc2f854e96e649a300c6cba5bc8d57d0af8de58

  • SHA256

    fb4fddb4cbdf4cfe8a3c658c6634d4a1d653f9fa61c4ca2ecb069770bf3cae57

  • SHA512

    e53b8819e810d853f2fdf86e129058b096df025bdcf8ec308d8f69b796b911f52f0e1c60431654ac03caf081abdcbef807cb664f6581d6ff61ba9742cf2f33ab

  • SSDEEP

    3072:qUJoFfWzzl+cSMY7xIsqoh3vpj+WSuW2x96i6e4coO81ju5qoRNir+QKQqjQgWmA:qweEpGxj9pHHeFwVNr7jzUBWnk/fZ

Malware Config

Extracted

Family

formbook

Campaign

fqsu

Decoy

GhfTqaOqC4FsyoQRW/8=

kbPIpd/8k1C6zJz5mYYdK90ZUA==

VIdg/CoNGeYJHA==

KhzoqndOhw1j43z0ew==

wv8mTDcsX2wJN/Q=

MqBgt6S+3BgGKBQHLZy7Ucg=

GyhOb++nZDi39NPK7dbaKapf

pBtD1UoSTdo3eSp9H7OhRqMV0TAuKMU=

WTzTg1w+fP4fMO0oPPM=

NS/tpGdUwkiMwqmgkxoSzjrQATAuKMU=

MnoSdM1hYn4tdwxjB2fX

3EUfH2EJY17mMf4=

V9/wg2yCQruVszm7V+4=

aNL8pZCGYW4Ej2LD

1Bif9VkmdgVfrJqRvl1GtlTZq1M=

9wHIgmB8EOB2uUVcUfk=

1Fdn15qem+fL1qhrY9xdQmAnVg==

Y32ThttYUUr6PsuRmozlNP74RD+uBz7dOQ==

f5HKyoWNAJLM2qjnZlizsvXDKFs=

mRfaGezap6ZyvJqthZvf

Extracted

Family

xloader

Version

3.8

Campaign

fqsu

Decoy

GhfTqaOqC4FsyoQRW/8=

kbPIpd/8k1C6zJz5mYYdK90ZUA==

VIdg/CoNGeYJHA==

KhzoqndOhw1j43z0ew==

wv8mTDcsX2wJN/Q=

MqBgt6S+3BgGKBQHLZy7Ucg=

GyhOb++nZDi39NPK7dbaKapf

pBtD1UoSTdo3eSp9H7OhRqMV0TAuKMU=

WTzTg1w+fP4fMO0oPPM=

NS/tpGdUwkiMwqmgkxoSzjrQATAuKMU=

MnoSdM1hYn4tdwxjB2fX

3EUfH2EJY17mMf4=

V9/wg2yCQruVszm7V+4=

aNL8pZCGYW4Ej2LD

1Bif9VkmdgVfrJqRvl1GtlTZq1M=

9wHIgmB8EOB2uUVcUfk=

1Fdn15qem+fL1qhrY9xdQmAnVg==

Y32ThttYUUr6PsuRmozlNP74RD+uBz7dOQ==

f5HKyoWNAJLM2qjnZlizsvXDKFs=

mRfaGezap6ZyvJqthZvf

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Users\Admin\AppData\Local\Temp\fb4fddb4cbdf4cfe8a3c658c6634d4a1d653f9fa61c4ca2ecb069770bf3cae57.exe
      "C:\Users\Admin\AppData\Local\Temp\fb4fddb4cbdf4cfe8a3c658c6634d4a1d653f9fa61c4ca2ecb069770bf3cae57.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5040
      • C:\Users\Admin\AppData\Local\Temp\bquztp.exe
        "C:\Users\Admin\AppData\Local\Temp\bquztp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:560
        • C:\Users\Admin\AppData\Local\Temp\bquztp.exe
          "C:\Users\Admin\AppData\Local\Temp\bquztp.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:5084
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\SysWOW64\netsh.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:716
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:4948

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\bquztp.exe

      Filesize

      6KB

      MD5

      e31a7d32d2fd851ae1b00ff85dd3a9ca

      SHA1

      1e63242b754008bfae79a5ab8e7a2ea45cc2dcd3

      SHA256

      aed72f8afba130aa196db63b1b036450d539c55f3bf9a352df09ce1f9202bddf

      SHA512

      ab51bcfb7d6fe8ff1f62ba030334594c25347eca882348ae1933c7001f841eab24d429704479bb8e343b03e7192506be48a17ece2c999862ee644ec094ced593

    • C:\Users\Admin\AppData\Local\Temp\bquztp.exe

      Filesize

      6KB

      MD5

      e31a7d32d2fd851ae1b00ff85dd3a9ca

      SHA1

      1e63242b754008bfae79a5ab8e7a2ea45cc2dcd3

      SHA256

      aed72f8afba130aa196db63b1b036450d539c55f3bf9a352df09ce1f9202bddf

      SHA512

      ab51bcfb7d6fe8ff1f62ba030334594c25347eca882348ae1933c7001f841eab24d429704479bb8e343b03e7192506be48a17ece2c999862ee644ec094ced593

    • C:\Users\Admin\AppData\Local\Temp\bquztp.exe

      Filesize

      6KB

      MD5

      e31a7d32d2fd851ae1b00ff85dd3a9ca

      SHA1

      1e63242b754008bfae79a5ab8e7a2ea45cc2dcd3

      SHA256

      aed72f8afba130aa196db63b1b036450d539c55f3bf9a352df09ce1f9202bddf

      SHA512

      ab51bcfb7d6fe8ff1f62ba030334594c25347eca882348ae1933c7001f841eab24d429704479bb8e343b03e7192506be48a17ece2c999862ee644ec094ced593

    • C:\Users\Admin\AppData\Local\Temp\eggcij.vx

      Filesize

      185KB

      MD5

      cfa7847468c5383cd501f8f805e0021a

      SHA1

      f44e223a9af2db99ac56f2f7927fb64949ab1664

      SHA256

      58a415b44850c89beb91dbc1c21c81f8476970ea6226645483f268d68a271cd7

      SHA512

      e4ae5c17d31e45a9dadf72881cd1c42dd8d82095b0068c620b924c90ea328f0e78ddefb3e14f23da28d650bbe273698586327f4cb07dc6098ecd3920eb6e3d98

    • C:\Users\Admin\AppData\Local\Temp\nzieacxv.p

      Filesize

      5KB

      MD5

      b104c03dbda7dcb8f911d3d48ef3cdc5

      SHA1

      24f0c3f064a2fc7fbb945bcb89a4dc3914519ff2

      SHA256

      d9225978ab417360cb9fd791ea653ff49f6b2c4df533d0be078e30eca7b0832f

      SHA512

      a61e358fe6d43c45b7cb0a00d770ff8b9d0696c8b09ef7b1ac42a51ba838b2854b4d61c05ead24dab15041dfdde661f32422da650231c170e2cfc8d325491d66

    • memory/716-147-0x0000000001420000-0x000000000143E000-memory.dmp

      Filesize

      120KB

    • memory/716-152-0x0000000000E20000-0x0000000000E4D000-memory.dmp

      Filesize

      180KB

    • memory/716-150-0x0000000001540000-0x00000000015CF000-memory.dmp

      Filesize

      572KB

    • memory/716-149-0x0000000000E20000-0x0000000000E4D000-memory.dmp

      Filesize

      180KB

    • memory/716-148-0x0000000001700000-0x0000000001A4A000-memory.dmp

      Filesize

      3.3MB

    • memory/2456-153-0x00000000028F0000-0x00000000029D3000-memory.dmp

      Filesize

      908KB

    • memory/2456-151-0x00000000028F0000-0x00000000029D3000-memory.dmp

      Filesize

      908KB

    • memory/2456-143-0x0000000008470000-0x00000000085B8000-memory.dmp

      Filesize

      1.3MB

    • memory/5084-146-0x0000000000401000-0x000000000042F000-memory.dmp

      Filesize

      184KB

    • memory/5084-145-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/5084-142-0x0000000000D60000-0x0000000000D70000-memory.dmp

      Filesize

      64KB

    • memory/5084-141-0x00000000011E0000-0x000000000152A000-memory.dmp

      Filesize

      3.3MB

    • memory/5084-139-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/5084-140-0x0000000000401000-0x000000000042F000-memory.dmp

      Filesize

      184KB