Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2023, 12:44

General

  • Target

    6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe

  • Size

    650KB

  • MD5

    e189c425869e466d842c472d895035d7

  • SHA1

    e50796539a9fd5c50f6569c00c2d01709bf203db

  • SHA256

    6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d

  • SHA512

    49c10e95d653531d4f92c3377f351c5639971fb58513aac23c803bb4ba930de101c20dd77649e1dd7bb207e6ba64150af2c99deb174bb7a5d62fe948b6d308f1

  • SSDEEP

    12288:VcrAckjQ5bLSqHcGdDY30I3lYPiICl45mLPKNDOvNvttVZeDh1:OkabLjcIc0I3l4wlBLCm7V

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

4hc5

Decoy

amandaastburyillustration.com

7141999.com

showshoe.info

sagemarlin.com

lithuaniandreamtime.com

therenixgroupllc.com

avalialooks.shop

vurporn.com

lemmy.systems

2816goldfinch.com

pacersun.com

checktrace.com

loadtransfer.site

matsuri-jujutsukaisen.com

iontrapper.science

5108010.com

beidixi.com

21305599.com

peakvitality.fitness

osisfeelingfee.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d_JC.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2384-9-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2384-15-0x00000000008F0000-0x0000000000BF3000-memory.dmp

    Filesize

    3.0MB

  • memory/2384-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2384-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2384-10-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3024-3-0x0000000000820000-0x0000000000836000-memory.dmp

    Filesize

    88KB

  • memory/3024-6-0x00000000004E0000-0x00000000004EA000-memory.dmp

    Filesize

    40KB

  • memory/3024-7-0x0000000000580000-0x000000000058C000-memory.dmp

    Filesize

    48KB

  • memory/3024-8-0x0000000005710000-0x000000000577E000-memory.dmp

    Filesize

    440KB

  • memory/3024-5-0x0000000004BE0000-0x0000000004C20000-memory.dmp

    Filesize

    256KB

  • memory/3024-4-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/3024-0-0x0000000000EF0000-0x0000000000F98000-memory.dmp

    Filesize

    672KB

  • memory/3024-2-0x0000000004BE0000-0x0000000004C20000-memory.dmp

    Filesize

    256KB

  • memory/3024-14-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/3024-1-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB