Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 10:14

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.13488.exe

  • Size

    1000KB

  • MD5

    8945b0881e6509f485f7a0a2561bc1e3

  • SHA1

    2119de3dd810ab6edb5fd99cccfc85afeee38c3d

  • SHA256

    b812dd30a73b638b960af5ef21e2e3dcf807728b381a8f71553e0a32d2307b92

  • SHA512

    8334583bbb33f5c6eee5e03f4331b39a8c68518cb99ffcd544bbfa71a953f0f0bc17baad9da38f003cc98abd307f132d286012428eb6cd18908487f7bcd5b2c4

  • SSDEEP

    24576:tsa4byzdWezM7KabcIo6UKb8SDxOTeCYSfI5b2sJxHJHtuSCg/c3kCv/oMw2n+OL:tZeRo6UXdAoMMMMMMMMMMMMMMMMMS

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kmge

Decoy

jia0752d.com

cq0jt.sbs

whimsicalweddingrentals.com

meetsex-here.life

hhe-crv220.com

bedbillionaire.com

soycmo.com

mrawkward.xyz

11ramshornroad.com

motoyonaturals.com

thischicloves.com

gacorbet.pro

ihsanid.com

pancaketurner.com

santanarstore.com

cr3dtv.com

negotools.com

landfillequip.com

sejasuapropriachefe.com

diamant-verkopen.store

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Formbook payload 3 IoCs
  • ModiLoader Second Stage 62 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.13488.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.13488.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4400
      • C:\Windows\SysWOW64\colorcpl.exe
        C:\Windows\System32\colorcpl.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3524
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4960
      • C:\Windows\SysWOW64\cmd.exe
        /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
        3⤵
          PID:976
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:2628

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\DB1

        Filesize

        40KB

        MD5

        b608d407fc15adea97c26936bc6f03f6

        SHA1

        953e7420801c76393902c0d6bb56148947e41571

        SHA256

        b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

        SHA512

        cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

      • C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logim.jpeg

        Filesize

        84KB

        MD5

        0c53dc4fee13d3751b9335cdc4c81f2c

        SHA1

        57736743ab0983c4a16f445135a7fb152b841eaa

        SHA256

        7c4fe32fb6e6c936f2e57a1d07b3a450cbb0211acabef8052c44191aedef5d94

        SHA512

        affeea61665fbe78f3d3fca2778b9148143c4aa8036ccbce4c8b8c810b99a75b3a105dc0479ae2dc69f2bba76c6ebbcfa4d6a2fd147831a6a69a17f6e3933d8e

      • C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logrf.ini

        Filesize

        40B

        MD5

        2f245469795b865bdd1b956c23d7893d

        SHA1

        6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

        SHA256

        1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

        SHA512

        909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

      • C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logrg.ini

        Filesize

        38B

        MD5

        4aadf49fed30e4c9b3fe4a3dd6445ebe

        SHA1

        1e332822167c6f351b99615eada2c30a538ff037

        SHA256

        75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

        SHA512

        eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

      • C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logri.ini

        Filesize

        40B

        MD5

        d63a82e5d81e02e399090af26db0b9cb

        SHA1

        91d0014c8f54743bba141fd60c9d963f869d76c9

        SHA256

        eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

        SHA512

        38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

      • C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logrv.ini

        Filesize

        872B

        MD5

        bbc41c78bae6c71e63cb544a6a284d94

        SHA1

        33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

        SHA256

        ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

        SHA512

        0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

      • memory/1084-341-0x0000000008450000-0x00000000085FF000-memory.dmp

        Filesize

        1.7MB

      • memory/1084-351-0x0000000007BF0000-0x0000000007D22000-memory.dmp

        Filesize

        1.2MB

      • memory/1084-350-0x0000000007BF0000-0x0000000007D22000-memory.dmp

        Filesize

        1.2MB

      • memory/3524-340-0x0000000005320000-0x0000000005334000-memory.dmp

        Filesize

        80KB

      • memory/3524-339-0x0000000005350000-0x000000000569A000-memory.dmp

        Filesize

        3.3MB

      • memory/3524-338-0x0000000010410000-0x000000001043F000-memory.dmp

        Filesize

        188KB

      • memory/4400-168-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-176-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-144-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-145-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-146-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-147-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-148-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-149-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-150-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-151-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-152-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-153-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-154-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-155-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-156-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-157-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-158-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-159-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-160-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-161-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-162-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-163-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-164-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-165-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-166-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-167-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-142-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-169-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-170-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-171-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-174-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-173-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-175-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-143-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-177-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-178-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-179-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-180-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-181-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-183-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-182-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-184-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-185-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-186-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-187-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-188-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-189-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-190-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-191-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-192-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-193-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-194-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-195-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-132-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-134-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-135-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-136-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-141-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-140-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-137-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-138-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4400-139-0x00000000028B0000-0x00000000028DB000-memory.dmp

        Filesize

        172KB

      • memory/4960-349-0x00000000022F0000-0x0000000002383000-memory.dmp

        Filesize

        588KB

      • memory/4960-348-0x0000000000110000-0x000000000013F000-memory.dmp

        Filesize

        188KB

      • memory/4960-345-0x0000000000110000-0x000000000013F000-memory.dmp

        Filesize

        188KB

      • memory/4960-344-0x0000000000160000-0x0000000000187000-memory.dmp

        Filesize

        156KB

      • memory/4960-343-0x00000000024C0000-0x000000000280A000-memory.dmp

        Filesize

        3.3MB