Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2023, 02:11

General

  • Target

    Swift TT Copy pdf.exe

  • Size

    274KB

  • MD5

    becff9b703669062005159bd35dc315d

  • SHA1

    042b87bb8d7f28e363a6f3de67d37b0cd4fdd1b9

  • SHA256

    91407535cc5852ecae7889b9f034920694c733c9e47f89d08a470e32b9d31e13

  • SHA512

    b68c24cd100e8b9a7c3972a22b13da4b75305cc433b4a083a4762228795f257b0a769497dde755f828bd53416b0d1ba93bfd5182922ff57ff7cf16e57f5c4cb4

  • SSDEEP

    6144:PYa6x92BX0wKPBAfBiyrTOfYJVL2hTRiZQd:PYj9S0RPYHrbVL2h/d

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sn26

Decoy

resenha10.bet

gulshan-rajput.com

xbus.tech

z813my.cfd

wlxzjlny.cfd

auntengotiempo.com

canada-reservation.com

thegiftcompany.shop

esthersilveirapropiedades.com

1wapws.top

ymjblnvo.cfd

termokimik.net

kushiro-artist-school.com

bmmboo.com

caceresconstructionservices.com

kentuckywalkabout.com

bringyourcart.com

miamiwinetour.com

bobcatsocial.site

thirdmind.network

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3132
    • C:\Users\Admin\AppData\Local\Temp\Swift TT Copy pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Swift TT Copy pdf.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Users\Admin\AppData\Local\Temp\Swift TT Copy pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\Swift TT Copy pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1576
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3340
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Swift TT Copy pdf.exe"
        3⤵
          PID:2288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsj7745.tmp\liiee.dll

      Filesize

      89KB

      MD5

      41ddf10747e14890df75b10f8cd48a66

      SHA1

      3b819381b137ef0af1ff4d8cb21651756e8088fb

      SHA256

      38b2ce7071de654c0b50c22fd5fa18dce6add7b17631d6f0be926520f23f5e75

      SHA512

      b880ae952b8b104ee16475f538fdd97fddefc0015a6755b43d467b9a231c416e513f1f3c758c9e53b5c141c6bdc00f1af9d95834060a7f554587361ee24e64d6

    • memory/1576-140-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1576-141-0x0000000000B60000-0x0000000000EAA000-memory.dmp

      Filesize

      3.3MB

    • memory/1576-143-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1576-144-0x00000000006D0000-0x00000000006E5000-memory.dmp

      Filesize

      84KB

    • memory/2796-139-0x0000000003180000-0x0000000003182000-memory.dmp

      Filesize

      8KB

    • memory/3132-191-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-209-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-157-0x0000000008890000-0x00000000089EA000-memory.dmp

      Filesize

      1.4MB

    • memory/3132-159-0x0000000008890000-0x00000000089EA000-memory.dmp

      Filesize

      1.4MB

    • memory/3132-161-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-238-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-237-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-162-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-164-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-163-0x0000000000A80000-0x0000000000A90000-memory.dmp

      Filesize

      64KB

    • memory/3132-196-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-166-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-167-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-168-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-170-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-171-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-172-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-173-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-174-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

      Filesize

      64KB

    • memory/3132-175-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-176-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-177-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

      Filesize

      64KB

    • memory/3132-178-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-180-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-179-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-182-0x0000000000A80000-0x0000000000A90000-memory.dmp

      Filesize

      64KB

    • memory/3132-181-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-184-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-186-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-187-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-188-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

      Filesize

      64KB

    • memory/3132-189-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-190-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-192-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-203-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-193-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-165-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-156-0x0000000008890000-0x00000000089EA000-memory.dmp

      Filesize

      1.4MB

    • memory/3132-145-0x0000000009000000-0x0000000009177000-memory.dmp

      Filesize

      1.5MB

    • memory/3132-204-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-205-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-206-0x0000000000A90000-0x0000000000AA0000-memory.dmp

      Filesize

      64KB

    • memory/3132-207-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-208-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-210-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-212-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-195-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-214-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-213-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-215-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-216-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

      Filesize

      64KB

    • memory/3132-217-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-218-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-219-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

      Filesize

      64KB

    • memory/3132-220-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-222-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-224-0x0000000000A90000-0x0000000000AA0000-memory.dmp

      Filesize

      64KB

    • memory/3132-223-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-226-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-225-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-229-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-228-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-230-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

      Filesize

      64KB

    • memory/3132-231-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-233-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-232-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-234-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3132-235-0x0000000000A60000-0x0000000000A70000-memory.dmp

      Filesize

      64KB

    • memory/3340-147-0x0000000000C40000-0x0000000000C67000-memory.dmp

      Filesize

      156KB

    • memory/3340-149-0x0000000000C40000-0x0000000000C67000-memory.dmp

      Filesize

      156KB

    • memory/3340-150-0x0000000000600000-0x000000000062F000-memory.dmp

      Filesize

      188KB

    • memory/3340-151-0x0000000002770000-0x0000000002ABA000-memory.dmp

      Filesize

      3.3MB

    • memory/3340-152-0x0000000000600000-0x000000000062F000-memory.dmp

      Filesize

      188KB

    • memory/3340-154-0x0000000002510000-0x00000000025A4000-memory.dmp

      Filesize

      592KB