Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2023, 18:32

General

  • Target

    d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe

  • Size

    835KB

  • MD5

    33ffe47617ab65e5fbb0b2eedf0b5b4e

  • SHA1

    394351007b7fa83b84a30c66b84083ba9af66410

  • SHA256

    d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f

  • SHA512

    b73e46c09c42c4196299e4787652991de3cc61ee869833a4b241d1222bbfbab9bd31e59533835a57fb15d221891ceac387d5a8e97cff918046fc84d81cdbe0cf

  • SSDEEP

    24576:mk70TrcKMs8ftsubdunEtMif2Fo0VANdUKsm1:mkQTAZsubdunDif2F9Agw

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bz24

Decoy

paltran.com

convadesolutions.com

smyx9b.work

friggerio.com

jndyfjc.com

dm4im2q2.top

adamloweforpresident2020.com

grvtyindustries.com

lovelycacau.com

seqizi.net

xisl88.com

dateknightdelivered.com

celebsmoaic.online

patriciolawnlandscapellc.com

liqq.asia

solutions4educators.com

hybridrate.com

newseza.com

enfejbaz9jdfthea.click

bergstromchevymadison.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Users\Admin\AppData\Local\Temp\d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f_JC.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4376
    • C:\Windows\SysWOW64\help.exe
      "C:\Windows\SysWOW64\help.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\Windows\SysWOW64\cmd.exe
        /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
        3⤵
          PID:3204
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:4840

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\DB1

        Filesize

        46KB

        MD5

        02d2c46697e3714e49f46b680b9a6b83

        SHA1

        84f98b56d49f01e9b6b76a4e21accf64fd319140

        SHA256

        522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

        SHA512

        60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

      • C:\Users\Admin\AppData\Roaming\9PM15TB1\9PMlogim.jpeg

        Filesize

        78KB

        MD5

        6c3f18e9e2fdc221b155cd329ed9d99b

        SHA1

        c4a215786f8de627fc696e5c1333940ced218f50

        SHA256

        3df9373667ad298d022f3b6c7ce1593640dba260fcad07ffb3d2e013a2ff8d91

        SHA512

        f066943a7850e315b00ed129f5552fa3168d6275a0c0baa939f7da25aacc34535cd17c14cfe20e5f47fd91307af27fb3fedc3a88741f866328f8981a4fe6f80f

      • C:\Users\Admin\AppData\Roaming\9PM15TB1\9PMlogrf.ini

        Filesize

        40B

        MD5

        2f245469795b865bdd1b956c23d7893d

        SHA1

        6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

        SHA256

        1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

        SHA512

        909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

      • C:\Users\Admin\AppData\Roaming\9PM15TB1\9PMlogrg.ini

        Filesize

        38B

        MD5

        4aadf49fed30e4c9b3fe4a3dd6445ebe

        SHA1

        1e332822167c6f351b99615eada2c30a538ff037

        SHA256

        75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

        SHA512

        eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

      • C:\Users\Admin\AppData\Roaming\9PM15TB1\9PMlogri.ini

        Filesize

        40B

        MD5

        d63a82e5d81e02e399090af26db0b9cb

        SHA1

        91d0014c8f54743bba141fd60c9d963f869d76c9

        SHA256

        eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

        SHA512

        38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

      • C:\Users\Admin\AppData\Roaming\9PM15TB1\9PMlogrv.ini

        Filesize

        872B

        MD5

        bbc41c78bae6c71e63cb544a6a284d94

        SHA1

        33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

        SHA256

        ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

        SHA512

        0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

      • memory/772-14-0x0000000008410000-0x000000000852A000-memory.dmp

        Filesize

        1.1MB

      • memory/772-40-0x00000000088D0000-0x00000000089DD000-memory.dmp

        Filesize

        1.1MB

      • memory/772-38-0x00000000088D0000-0x00000000089DD000-memory.dmp

        Filesize

        1.1MB

      • memory/772-37-0x00000000088D0000-0x00000000089DD000-memory.dmp

        Filesize

        1.1MB

      • memory/772-33-0x0000000008410000-0x000000000852A000-memory.dmp

        Filesize

        1.1MB

      • memory/1240-16-0x0000000000130000-0x0000000000137000-memory.dmp

        Filesize

        28KB

      • memory/1240-36-0x0000000001030000-0x00000000010C4000-memory.dmp

        Filesize

        592KB

      • memory/1240-15-0x0000000000130000-0x0000000000137000-memory.dmp

        Filesize

        28KB

      • memory/1240-19-0x0000000000AC0000-0x0000000000AEF000-memory.dmp

        Filesize

        188KB

      • memory/1240-17-0x0000000000AC0000-0x0000000000AEF000-memory.dmp

        Filesize

        188KB

      • memory/1240-18-0x0000000001250000-0x000000000159A000-memory.dmp

        Filesize

        3.3MB

      • memory/2648-1-0x0000000075070000-0x0000000075820000-memory.dmp

        Filesize

        7.7MB

      • memory/2648-9-0x0000000075070000-0x0000000075820000-memory.dmp

        Filesize

        7.7MB

      • memory/2648-6-0x0000000002730000-0x0000000002740000-memory.dmp

        Filesize

        64KB

      • memory/2648-5-0x00000000025E0000-0x00000000025EA000-memory.dmp

        Filesize

        40KB

      • memory/2648-4-0x0000000004D40000-0x0000000004DF8000-memory.dmp

        Filesize

        736KB

      • memory/2648-3-0x0000000004ED0000-0x0000000005474000-memory.dmp

        Filesize

        5.6MB

      • memory/2648-2-0x0000000002730000-0x0000000002740000-memory.dmp

        Filesize

        64KB

      • memory/2648-0-0x0000000004E10000-0x0000000004ECA000-memory.dmp

        Filesize

        744KB

      • memory/4376-13-0x0000000001BD0000-0x0000000001BE5000-memory.dmp

        Filesize

        84KB

      • memory/4376-10-0x0000000001760000-0x0000000001AAA000-memory.dmp

        Filesize

        3.3MB

      • memory/4376-12-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/4376-7-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB