Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
08/05/2023, 15:46
General
-
Target
PO-230102_May 2023.exe
-
Size
222KB
-
MD5
41b41296821338a634d99d5b5c749ec1
-
SHA1
747470c76d47d50eaaa891edcc2f17b22b07d1c9
-
SHA256
272872a41e4e0ae720f6f61e50320720cf0313fe65d4c039334ed6c0cb7f37b0
-
SHA512
7e6e6892661051c9135ca042bc0af85dbbee366080ac326893a62666c4f54401bf1111b1c60c300f3a29b9ad26dfd71848a622215917f739d29ad882451e5ed0
-
SSDEEP
3072:d0gHHDGWvgDE4u+gCGHjEmELWQ88ffVls4:WkDBuEawAWE3Vls
Malware Config
Extracted
formbook
4.1
g3th
casemierlawncare.com
715harrison.com
laiwudj.com
jhy6id3bgsu.cfd
gewnaj.xyz
hullo.social
animejoyy.com
florenceodd.click
accountingassociatesil.com
cxuu39.shop
isabelladowns.com
checkstart.net
b2bmails.ru
wehantz.com
thejjwhyte.com
jerusalemfoundationsusa.com
newagreement19.com
findel.xyz
czanniversaryring.com
ape5n.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 4 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO-230102_May 2023.exe"C:\Users\Admin\AppData\Local\Temp\PO-230102_May 2023.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
84KB
-
Filesize
188KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
916KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
592KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
188KB
-
Filesize
880KB
-
Filesize
880KB