Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2023, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe
Resource
win7-20230831-en
General
-
Target
d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe
-
Size
835KB
-
MD5
33ffe47617ab65e5fbb0b2eedf0b5b4e
-
SHA1
394351007b7fa83b84a30c66b84083ba9af66410
-
SHA256
d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f
-
SHA512
b73e46c09c42c4196299e4787652991de3cc61ee869833a4b241d1222bbfbab9bd31e59533835a57fb15d221891ceac387d5a8e97cff918046fc84d81cdbe0cf
-
SSDEEP
24576:mk70TrcKMs8ftsubdunEtMif2Fo0VANdUKsm1:mkQTAZsubdunDif2F9Agw
Malware Config
Extracted
formbook
4.1
bz24
paltran.com
convadesolutions.com
smyx9b.work
friggerio.com
jndyfjc.com
dm4im2q2.top
adamloweforpresident2020.com
grvtyindustries.com
lovelycacau.com
seqizi.net
xisl88.com
dateknightdelivered.com
celebsmoaic.online
patriciolawnlandscapellc.com
liqq.asia
solutions4educators.com
hybridrate.com
newseza.com
enfejbaz9jdfthea.click
bergstromchevymadison.com
becozify.com
3a8882.com
norhenkan.net
leslie-jiang.top
bdgz.asia
lsdrw.com
stratusslides.com
jawatankosong.link
by6232.com
shenzhenjubo.com
mgt-xj-313.com
renovaro-ai.com
dvisionaryconnections.com
yyyyyt.com
oohyi.com
misslemonhotcheetoz.info
72nai.xyz
dde.ovh
genai-pubsec.com
huifeiya.com
ordermetrics.dev
ixcdex.top
mac-update.net
15659.top
aqyx.net
dtcp9900.com
syxomz.xyz
bluecarcovers.com
rottenegg.dev
zyk66.com
wiserstride.com
softwareology.online
ex-fudousan.com
spaceyplay.space
aa-012.top
m2senterprises.com
tokenbocket.pro
imtmatcher.shop
cove.directory
wilddolphinswhales.com
wooahanfamily.com
pergolassales.com
kustch.space
472persimmon7.com
aaacaw.com
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/4376-7-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4376-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1240-17-0x0000000000AC0000-0x0000000000AEF000-memory.dmp formbook behavioral2/memory/1240-19-0x0000000000AC0000-0x0000000000AEF000-memory.dmp formbook -
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/2648-0-0x0000000004E10000-0x0000000004ECA000-memory.dmp net_reactor behavioral2/memory/2648-4-0x0000000004D40000-0x0000000004DF8000-memory.dmp net_reactor -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2648 set thread context of 4376 2648 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 87 PID 4376 set thread context of 772 4376 caspol.exe 58 PID 1240 set thread context of 772 1240 help.exe 58 -
description ioc Process Key created \Registry\User\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4376 caspol.exe 4376 caspol.exe 4376 caspol.exe 4376 caspol.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 772 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4376 caspol.exe 4376 caspol.exe 4376 caspol.exe 1240 help.exe 1240 help.exe 1240 help.exe 1240 help.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4376 caspol.exe Token: SeDebugPrivilege 1240 help.exe Token: SeShutdownPrivilege 772 Explorer.EXE Token: SeCreatePagefilePrivilege 772 Explorer.EXE Token: SeShutdownPrivilege 772 Explorer.EXE Token: SeCreatePagefilePrivilege 772 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 772 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2648 wrote to memory of 4376 2648 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 87 PID 2648 wrote to memory of 4376 2648 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 87 PID 2648 wrote to memory of 4376 2648 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 87 PID 2648 wrote to memory of 4376 2648 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 87 PID 2648 wrote to memory of 4376 2648 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 87 PID 2648 wrote to memory of 4376 2648 d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe 87 PID 772 wrote to memory of 1240 772 Explorer.EXE 88 PID 772 wrote to memory of 1240 772 Explorer.EXE 88 PID 772 wrote to memory of 1240 772 Explorer.EXE 88 PID 1240 wrote to memory of 3204 1240 help.exe 96 PID 1240 wrote to memory of 3204 1240 help.exe 96 PID 1240 wrote to memory of 3204 1240 help.exe 96 PID 1240 wrote to memory of 4840 1240 help.exe 100 PID 1240 wrote to memory of 4840 1240 help.exe 100 PID 1240 wrote to memory of 4840 1240 help.exe 100
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe"C:\Users\Admin\AppData\Local\Temp\d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3204
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4840
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
78KB
MD56c3f18e9e2fdc221b155cd329ed9d99b
SHA1c4a215786f8de627fc696e5c1333940ced218f50
SHA2563df9373667ad298d022f3b6c7ce1593640dba260fcad07ffb3d2e013a2ff8d91
SHA512f066943a7850e315b00ed129f5552fa3168d6275a0c0baa939f7da25aacc34535cd17c14cfe20e5f47fd91307af27fb3fedc3a88741f866328f8981a4fe6f80f
-
Filesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
Filesize
38B
MD54aadf49fed30e4c9b3fe4a3dd6445ebe
SHA11e332822167c6f351b99615eada2c30a538ff037
SHA25675034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
SHA512eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
872B
MD5bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4