Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    30s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01/02/2023, 05:12

General

  • Target

    043ae57e01ebd0a96fa30b92821b712504cfde03.exe

  • Size

    333KB

  • MD5

    69c1698445fbcfb15e516dba06928b54

  • SHA1

    043ae57e01ebd0a96fa30b92821b712504cfde03

  • SHA256

    fddea1265c29e98f5b679ff034f27124b688f03f2d4c72442ce5f358ddd3eff0

  • SHA512

    5f22300b1f6ee1960205b7d2fa29db76ed1daf8496322ed7429f06788ff8266475701209535951b4829d3dc44115c36d80b765148b9171f0de3d31c9efd6a853

  • SSDEEP

    6144:Hgxb9f5x3hLbahymkd2iUvXbPvbTT4nhnne4VX2pClCmgBaGYArphY3:HgxblYhj734hnvgpfmhGvq

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hko6

Decoy

apartmentsineverettwa.com

forritcu.net

hotroodes.com

skinnerttc.com

royaltrustmyanmar.com

adreslog.com

kaysbridalboutiques.com

multitask-improvements.com

geniiforum.com

smarthomehatinh.asia

banglikeaboss.com

javlover.club

affiliateclubindia.com

mycapecoralhomevalue.com

comparamuebles.online

newrochellenissan.com

nairobi-paris.com

fwk.xyz

downdepot.com

nextgenmemorabilia.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\043ae57e01ebd0a96fa30b92821b712504cfde03.exe
    "C:\Users\Admin\AppData\Local\Temp\043ae57e01ebd0a96fa30b92821b712504cfde03.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Users\Admin\AppData\Local\Temp\043ae57e01ebd0a96fa30b92821b712504cfde03.exe
      "C:\Users\Admin\AppData\Local\Temp\043ae57e01ebd0a96fa30b92821b712504cfde03.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 36
        3⤵
        • Program crash
        PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2004-54-0x0000000000920000-0x000000000094A000-memory.dmp

    Filesize

    168KB

  • memory/2004-56-0x0000000000920000-0x000000000094A000-memory.dmp

    Filesize

    168KB