Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2023, 02:11

General

  • Target

    Swift TT Copy pdf.exe

  • Size

    274KB

  • MD5

    becff9b703669062005159bd35dc315d

  • SHA1

    042b87bb8d7f28e363a6f3de67d37b0cd4fdd1b9

  • SHA256

    91407535cc5852ecae7889b9f034920694c733c9e47f89d08a470e32b9d31e13

  • SHA512

    b68c24cd100e8b9a7c3972a22b13da4b75305cc433b4a083a4762228795f257b0a769497dde755f828bd53416b0d1ba93bfd5182922ff57ff7cf16e57f5c4cb4

  • SSDEEP

    6144:PYa6x92BX0wKPBAfBiyrTOfYJVL2hTRiZQd:PYj9S0RPYHrbVL2h/d

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sn26

Decoy

resenha10.bet

gulshan-rajput.com

xbus.tech

z813my.cfd

wlxzjlny.cfd

auntengotiempo.com

canada-reservation.com

thegiftcompany.shop

esthersilveirapropiedades.com

1wapws.top

ymjblnvo.cfd

termokimik.net

kushiro-artist-school.com

bmmboo.com

caceresconstructionservices.com

kentuckywalkabout.com

bringyourcart.com

miamiwinetour.com

bobcatsocial.site

thirdmind.network

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Users\Admin\AppData\Local\Temp\Swift TT Copy pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Swift TT Copy pdf.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Users\Admin\AppData\Local\Temp\Swift TT Copy pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\Swift TT Copy pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:588
    • C:\Windows\SysWOW64\help.exe
      "C:\Windows\SysWOW64\help.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Swift TT Copy pdf.exe"
        3⤵
        • Deletes itself
        PID:2832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsy76F6.tmp\liiee.dll

    Filesize

    89KB

    MD5

    41ddf10747e14890df75b10f8cd48a66

    SHA1

    3b819381b137ef0af1ff4d8cb21651756e8088fb

    SHA256

    38b2ce7071de654c0b50c22fd5fa18dce6add7b17631d6f0be926520f23f5e75

    SHA512

    b880ae952b8b104ee16475f538fdd97fddefc0015a6755b43d467b9a231c416e513f1f3c758c9e53b5c141c6bdc00f1af9d95834060a7f554587361ee24e64d6

  • \Users\Admin\AppData\Local\Temp\nsy76F6.tmp\liiee.dll

    Filesize

    89KB

    MD5

    41ddf10747e14890df75b10f8cd48a66

    SHA1

    3b819381b137ef0af1ff4d8cb21651756e8088fb

    SHA256

    38b2ce7071de654c0b50c22fd5fa18dce6add7b17631d6f0be926520f23f5e75

    SHA512

    b880ae952b8b104ee16475f538fdd97fddefc0015a6755b43d467b9a231c416e513f1f3c758c9e53b5c141c6bdc00f1af9d95834060a7f554587361ee24e64d6

  • memory/588-66-0x0000000000340000-0x0000000000355000-memory.dmp

    Filesize

    84KB

  • memory/588-61-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/588-62-0x00000000008D0000-0x0000000000BD3000-memory.dmp

    Filesize

    3.0MB

  • memory/588-64-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1272-78-0x0000000006E40000-0x0000000006FB3000-memory.dmp

    Filesize

    1.4MB

  • memory/1272-79-0x0000000006E40000-0x0000000006FB3000-memory.dmp

    Filesize

    1.4MB

  • memory/1272-87-0x000007FEF5870000-0x000007FEF59B3000-memory.dmp

    Filesize

    1.3MB

  • memory/1272-85-0x000007FF72790000-0x000007FF7279A000-memory.dmp

    Filesize

    40KB

  • memory/1272-84-0x000007FEF5870000-0x000007FEF59B3000-memory.dmp

    Filesize

    1.3MB

  • memory/1272-81-0x0000000006E40000-0x0000000006FB3000-memory.dmp

    Filesize

    1.4MB

  • memory/1272-67-0x0000000006C90000-0x0000000006E34000-memory.dmp

    Filesize

    1.6MB

  • memory/1272-75-0x0000000006C90000-0x0000000006E34000-memory.dmp

    Filesize

    1.6MB

  • memory/2868-77-0x0000000000530000-0x00000000005C4000-memory.dmp

    Filesize

    592KB

  • memory/2868-74-0x00000000000C0000-0x00000000000EF000-memory.dmp

    Filesize

    188KB

  • memory/2868-73-0x00000000008C0000-0x0000000000BC3000-memory.dmp

    Filesize

    3.0MB

  • memory/2868-72-0x00000000000C0000-0x00000000000EF000-memory.dmp

    Filesize

    188KB

  • memory/2868-70-0x00000000008B0000-0x00000000008B6000-memory.dmp

    Filesize

    24KB

  • memory/2868-69-0x00000000008B0000-0x00000000008B6000-memory.dmp

    Filesize

    24KB

  • memory/2912-60-0x0000000002B80000-0x0000000002B82000-memory.dmp

    Filesize

    8KB