Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
04/10/2023, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe
Resource
win7-20230831-en
General
-
Target
d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe
-
Size
835KB
-
MD5
33ffe47617ab65e5fbb0b2eedf0b5b4e
-
SHA1
394351007b7fa83b84a30c66b84083ba9af66410
-
SHA256
d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f
-
SHA512
b73e46c09c42c4196299e4787652991de3cc61ee869833a4b241d1222bbfbab9bd31e59533835a57fb15d221891ceac387d5a8e97cff918046fc84d81cdbe0cf
-
SSDEEP
24576:mk70TrcKMs8ftsubdunEtMif2Fo0VANdUKsm1:mkQTAZsubdunDif2F9Agw
Malware Config
Extracted
formbook
4.1
bz24
paltran.com
convadesolutions.com
smyx9b.work
friggerio.com
jndyfjc.com
dm4im2q2.top
adamloweforpresident2020.com
grvtyindustries.com
lovelycacau.com
seqizi.net
xisl88.com
dateknightdelivered.com
celebsmoaic.online
patriciolawnlandscapellc.com
liqq.asia
solutions4educators.com
hybridrate.com
newseza.com
enfejbaz9jdfthea.click
bergstromchevymadison.com
becozify.com
3a8882.com
norhenkan.net
leslie-jiang.top
bdgz.asia
lsdrw.com
stratusslides.com
jawatankosong.link
by6232.com
shenzhenjubo.com
mgt-xj-313.com
renovaro-ai.com
dvisionaryconnections.com
yyyyyt.com
oohyi.com
misslemonhotcheetoz.info
72nai.xyz
dde.ovh
genai-pubsec.com
huifeiya.com
ordermetrics.dev
ixcdex.top
mac-update.net
15659.top
aqyx.net
dtcp9900.com
syxomz.xyz
bluecarcovers.com
rottenegg.dev
zyk66.com
wiserstride.com
softwareology.online
ex-fudousan.com
spaceyplay.space
aa-012.top
m2senterprises.com
tokenbocket.pro
imtmatcher.shop
cove.directory
wilddolphinswhales.com
wooahanfamily.com
pergolassales.com
kustch.space
472persimmon7.com
aaacaw.com
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/1068-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1068-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2676-22-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook behavioral1/memory/2676-24-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral1/memory/924-2-0x0000000004A60000-0x0000000004B1A000-memory.dmp net_reactor behavioral1/memory/924-4-0x0000000004950000-0x0000000004A08000-memory.dmp net_reactor -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 924 set thread context of 1068 924 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 28 PID 1068 set thread context of 1348 1068 caspol.exe 13 PID 2676 set thread context of 1348 2676 help.exe 13 -
description ioc Process Key created \Registry\User\S-1-5-21-3185155662-718608226-894467740-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1068 caspol.exe 1068 caspol.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1348 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1068 caspol.exe 1068 caspol.exe 1068 caspol.exe 2676 help.exe 2676 help.exe 2676 help.exe 2676 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1068 caspol.exe Token: SeDebugPrivilege 2676 help.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 924 wrote to memory of 1068 924 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 28 PID 924 wrote to memory of 1068 924 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 28 PID 924 wrote to memory of 1068 924 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 28 PID 924 wrote to memory of 1068 924 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 28 PID 924 wrote to memory of 1068 924 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 28 PID 924 wrote to memory of 1068 924 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 28 PID 924 wrote to memory of 1068 924 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 28 PID 1348 wrote to memory of 2676 1348 Explorer.EXE 29 PID 1348 wrote to memory of 2676 1348 Explorer.EXE 29 PID 1348 wrote to memory of 2676 1348 Explorer.EXE 29 PID 1348 wrote to memory of 2676 1348 Explorer.EXE 29 PID 2676 wrote to memory of 3008 2676 help.exe 31 PID 2676 wrote to memory of 3008 2676 help.exe 31 PID 2676 wrote to memory of 3008 2676 help.exe 31 PID 2676 wrote to memory of 3008 2676 help.exe 31 PID 2676 wrote to memory of 3008 2676 help.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe"C:\Users\Admin\AppData\Local\Temp\d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3008
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5a60a75c2c72d807ea8da64602f421e3c
SHA16e344d1aaf57e1507d3c12b509dbae15b2c9376a
SHA256a8602f56d799db64ba24e41fce1c920e5ffc487d1dd3a45bc8c1e77504328f12
SHA5120828d1b3ec0c6cb8baf4f43f4c24523021edacd1a5feda2f0d3aa2ea0e89b6d4508918b9da2ccce9f95e179e9c798a1b4770a8e89769fc0289c6cd62bc3bcfaf
-
Filesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf