Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2023, 18:32

General

  • Target

    d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe

  • Size

    835KB

  • MD5

    33ffe47617ab65e5fbb0b2eedf0b5b4e

  • SHA1

    394351007b7fa83b84a30c66b84083ba9af66410

  • SHA256

    d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f

  • SHA512

    b73e46c09c42c4196299e4787652991de3cc61ee869833a4b241d1222bbfbab9bd31e59533835a57fb15d221891ceac387d5a8e97cff918046fc84d81cdbe0cf

  • SSDEEP

    24576:mk70TrcKMs8ftsubdunEtMif2Fo0VANdUKsm1:mkQTAZsubdunDif2F9Agw

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bz24

Decoy

paltran.com

convadesolutions.com

smyx9b.work

friggerio.com

jndyfjc.com

dm4im2q2.top

adamloweforpresident2020.com

grvtyindustries.com

lovelycacau.com

seqizi.net

xisl88.com

dateknightdelivered.com

celebsmoaic.online

patriciolawnlandscapellc.com

liqq.asia

solutions4educators.com

hybridrate.com

newseza.com

enfejbaz9jdfthea.click

bergstromchevymadison.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1068
    • C:\Windows\SysWOW64\help.exe
      "C:\Windows\SysWOW64\help.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:3008

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\9PM15TB1\9PMlogim.jpeg

      Filesize

      72KB

      MD5

      a60a75c2c72d807ea8da64602f421e3c

      SHA1

      6e344d1aaf57e1507d3c12b509dbae15b2c9376a

      SHA256

      a8602f56d799db64ba24e41fce1c920e5ffc487d1dd3a45bc8c1e77504328f12

      SHA512

      0828d1b3ec0c6cb8baf4f43f4c24523021edacd1a5feda2f0d3aa2ea0e89b6d4508918b9da2ccce9f95e179e9c798a1b4770a8e89769fc0289c6cd62bc3bcfaf

    • C:\Users\Admin\AppData\Roaming\9PM15TB1\9PMlogrf.ini

      Filesize

      40B

      MD5

      2f245469795b865bdd1b956c23d7893d

      SHA1

      6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

      SHA256

      1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

      SHA512

      909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

    • C:\Users\Admin\AppData\Roaming\9PM15TB1\9PMlogri.ini

      Filesize

      40B

      MD5

      d63a82e5d81e02e399090af26db0b9cb

      SHA1

      91d0014c8f54743bba141fd60c9d963f869d76c9

      SHA256

      eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

      SHA512

      38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

    • C:\Users\Admin\AppData\Roaming\9PM15TB1\9PMlogrv.ini

      Filesize

      40B

      MD5

      ba3b6bc807d4f76794c4b81b09bb9ba5

      SHA1

      24cb89501f0212ff3095ecc0aba97dd563718fb1

      SHA256

      6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507

      SHA512

      ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf

    • memory/924-1-0x0000000004A20000-0x0000000004A60000-memory.dmp

      Filesize

      256KB

    • memory/924-2-0x0000000004A60000-0x0000000004B1A000-memory.dmp

      Filesize

      744KB

    • memory/924-3-0x0000000004A20000-0x0000000004A60000-memory.dmp

      Filesize

      256KB

    • memory/924-4-0x0000000004950000-0x0000000004A08000-memory.dmp

      Filesize

      736KB

    • memory/924-5-0x0000000002070000-0x000000000207A000-memory.dmp

      Filesize

      40KB

    • memory/924-6-0x0000000004A20000-0x0000000004A60000-memory.dmp

      Filesize

      256KB

    • memory/924-0-0x0000000074560000-0x0000000074C4E000-memory.dmp

      Filesize

      6.9MB

    • memory/924-13-0x0000000074560000-0x0000000074C4E000-memory.dmp

      Filesize

      6.9MB

    • memory/1068-9-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1068-16-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1068-14-0x00000000008A0000-0x0000000000BA3000-memory.dmp

      Filesize

      3.0MB

    • memory/1068-17-0x0000000000200000-0x0000000000215000-memory.dmp

      Filesize

      84KB

    • memory/1068-12-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1068-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1068-7-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/1348-19-0x0000000006A80000-0x0000000006BFD000-memory.dmp

      Filesize

      1.5MB

    • memory/1348-37-0x000007FEF65A0000-0x000007FEF66E3000-memory.dmp

      Filesize

      1.3MB

    • memory/1348-18-0x0000000003810000-0x0000000003910000-memory.dmp

      Filesize

      1024KB

    • memory/1348-28-0x0000000006A80000-0x0000000006BFD000-memory.dmp

      Filesize

      1.5MB

    • memory/1348-38-0x000007FEA4DD0000-0x000007FEA4DDA000-memory.dmp

      Filesize

      40KB

    • memory/1348-31-0x00000000040D0000-0x00000000041CA000-memory.dmp

      Filesize

      1000KB

    • memory/1348-32-0x00000000040D0000-0x00000000041CA000-memory.dmp

      Filesize

      1000KB

    • memory/1348-35-0x00000000040D0000-0x00000000041CA000-memory.dmp

      Filesize

      1000KB

    • memory/2676-30-0x0000000000510000-0x00000000005A4000-memory.dmp

      Filesize

      592KB

    • memory/2676-23-0x00000000009B0000-0x0000000000CB3000-memory.dmp

      Filesize

      3.0MB

    • memory/2676-22-0x00000000000C0000-0x00000000000EF000-memory.dmp

      Filesize

      188KB

    • memory/2676-21-0x0000000000210000-0x0000000000216000-memory.dmp

      Filesize

      24KB

    • memory/2676-20-0x0000000000210000-0x0000000000216000-memory.dmp

      Filesize

      24KB

    • memory/2676-24-0x00000000000C0000-0x00000000000EF000-memory.dmp

      Filesize

      188KB