Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    199s
  • max time network
    227s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 07:09

General

  • Target

    doc#230928330.exe

  • Size

    688KB

  • MD5

    733e39b98b5d9e34afd5feba60e74566

  • SHA1

    33b76f208403ff4a41de8c0b59edf02ead600843

  • SHA256

    3776d991080dd8cdf41d7b64315d1bccf2c09ed001058b9a28042d760f888163

  • SHA512

    e7a82d2ba88f93b395b53bff19b2b6b32617639cc731a04d2ee57d9b33cfd1e18a42d4d1ed99fdf5d6967d43438b7f354299a762bcd033a0e95174ac8c07d2af

  • SSDEEP

    12288:EuRr/TP5WypE15ZP5Lt35w2VM4k6yONHFs:Eu9/j0ypE15ZP5Lt35w2VM9ODs

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sn26

Decoy

resenha10.bet

gulshan-rajput.com

xbus.tech

z813my.cfd

wlxzjlny.cfd

auntengotiempo.com

canada-reservation.com

thegiftcompany.shop

esthersilveirapropiedades.com

1wapws.top

ymjblnvo.cfd

termokimik.net

kushiro-artist-school.com

bmmboo.com

caceresconstructionservices.com

kentuckywalkabout.com

bringyourcart.com

miamiwinetour.com

bobcatsocial.site

thirdmind.network

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\doc#230928330.exe
      "C:\Users\Admin\AppData\Local\Temp\doc#230928330.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Users\Admin\AppData\Local\Temp\doc#230928330.exe
        "{path}"
        3⤵
          PID:1908
        • C:\Users\Admin\AppData\Local\Temp\doc#230928330.exe
          "{path}"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2644
      • C:\Windows\SysWOW64\raserver.exe
        "C:\Windows\SysWOW64\raserver.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2408
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\doc#230928330.exe"
          3⤵
          • Deletes itself
          PID:1896

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1248-28-0x00000000072E0000-0x000000000746F000-memory.dmp

      Filesize

      1.6MB

    • memory/1248-35-0x0000000007610000-0x000000000777D000-memory.dmp

      Filesize

      1.4MB

    • memory/1248-33-0x0000000007610000-0x000000000777D000-memory.dmp

      Filesize

      1.4MB

    • memory/1248-32-0x0000000007610000-0x000000000777D000-memory.dmp

      Filesize

      1.4MB

    • memory/1248-22-0x0000000003C40000-0x0000000003E40000-memory.dmp

      Filesize

      2.0MB

    • memory/1248-23-0x00000000072E0000-0x000000000746F000-memory.dmp

      Filesize

      1.6MB

    • memory/2408-26-0x0000000000080000-0x00000000000AF000-memory.dmp

      Filesize

      188KB

    • memory/2408-27-0x00000000020B0000-0x00000000023B3000-memory.dmp

      Filesize

      3.0MB

    • memory/2408-29-0x0000000000080000-0x00000000000AF000-memory.dmp

      Filesize

      188KB

    • memory/2408-25-0x00000000009C0000-0x00000000009DC000-memory.dmp

      Filesize

      112KB

    • memory/2408-24-0x00000000009C0000-0x00000000009DC000-memory.dmp

      Filesize

      112KB

    • memory/2408-31-0x0000000001E80000-0x0000000001F14000-memory.dmp

      Filesize

      592KB

    • memory/2644-10-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2644-12-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2644-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2644-16-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2644-18-0x0000000000850000-0x0000000000B53000-memory.dmp

      Filesize

      3.0MB

    • memory/2644-20-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2644-21-0x0000000000280000-0x0000000000295000-memory.dmp

      Filesize

      84KB

    • memory/2724-7-0x000000007EF40000-0x000000007EF50000-memory.dmp

      Filesize

      64KB

    • memory/2724-17-0x0000000074590000-0x0000000074C7E000-memory.dmp

      Filesize

      6.9MB

    • memory/2724-9-0x0000000000520000-0x0000000000554000-memory.dmp

      Filesize

      208KB

    • memory/2724-8-0x0000000005E90000-0x0000000005F12000-memory.dmp

      Filesize

      520KB

    • memory/2724-0-0x0000000074590000-0x0000000074C7E000-memory.dmp

      Filesize

      6.9MB

    • memory/2724-6-0x00000000001D0000-0x0000000000210000-memory.dmp

      Filesize

      256KB

    • memory/2724-5-0x0000000074590000-0x0000000074C7E000-memory.dmp

      Filesize

      6.9MB

    • memory/2724-4-0x00000000002D0000-0x00000000002DC000-memory.dmp

      Filesize

      48KB

    • memory/2724-3-0x000000007EF40000-0x000000007EF50000-memory.dmp

      Filesize

      64KB

    • memory/2724-2-0x00000000001D0000-0x0000000000210000-memory.dmp

      Filesize

      256KB

    • memory/2724-1-0x0000000000CC0000-0x0000000000D72000-memory.dmp

      Filesize

      712KB