Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    17/11/2023, 16:41

General

  • Target

    9008654324456.exe

  • Size

    996KB

  • MD5

    ef8d477861854541592ffe50ce56d3da

  • SHA1

    039477a4c34bc104a4ff797288ef3d8a01900ff6

  • SHA256

    c7b9dfbcf65edd98aff82ea3e1ffe6b0f83eca9c3c892de4ac8681fc1a2bb6d1

  • SHA512

    5c753ab3c9f9f627d912be4d147f5285bfcabf9fcbef35d2cbf87cf7a91d7e2282ed96face2f66b8c0236f23476208c45883ea34c8cb1f878ce8ffe370837f88

  • SSDEEP

    12288:qRP8sE9ARf1zb2iNkuPF337m+lLptOdn4RIdqBQ4U62yEUfrpHrAQU/RVXV0jXvE:U1l5Lm+hptOGRm62nUDpHra925VUS92

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ao65

Decoy

spins2023.pro

foodontario.com

jsnmz.com

canwealljustagree.com

shopthedivine.store

thelakahealth.com

kuis-raja-borong.website

hbqc2.com

optimusvisionlb.com

urdulatest.com

akhayarplus.com

info-antai-service.com

kermisbedrijfkramer.online

epansion.com

gxqingmeng.top

maltsky.net

ictwath.com

sharmafootcare.com

mycheese.net

portfoliotestkitchen.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9008654324456.exe
    "C:\Users\Admin\AppData\Local\Temp\9008654324456.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JezkAm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2860
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JezkAm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF4EA.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3012
    • C:\Users\Admin\AppData\Local\Temp\9008654324456.exe
      "C:\Users\Admin\AppData\Local\Temp\9008654324456.exe"
      2⤵
        PID:388
      • C:\Users\Admin\AppData\Local\Temp\9008654324456.exe
        "C:\Users\Admin\AppData\Local\Temp\9008654324456.exe"
        2⤵
          PID:1224
        • C:\Users\Admin\AppData\Local\Temp\9008654324456.exe
          "C:\Users\Admin\AppData\Local\Temp\9008654324456.exe"
          2⤵
            PID:1236
          • C:\Users\Admin\AppData\Local\Temp\9008654324456.exe
            "C:\Users\Admin\AppData\Local\Temp\9008654324456.exe"
            2⤵
              PID:2868
            • C:\Users\Admin\AppData\Local\Temp\9008654324456.exe
              "C:\Users\Admin\AppData\Local\Temp\9008654324456.exe"
              2⤵
                PID:2416

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpF4EA.tmp

              Filesize

              1KB

              MD5

              7fb86a405d3250b7ef2d1ce7590f5469

              SHA1

              f61c4d7252947c14b41e0d26bce5a19358648611

              SHA256

              82e8a67751ab80ffad61221b4ab11a2be104c3e202e1447a30cdfe194dab9b8d

              SHA512

              8de33832405b60a2037dd308f20d45423d6cb7c37c945d68facee8ec432f00861e956c6cc4e7efc8e0e14718be7f1fe14eeb79b1b38211aa0ae875d3c1a4cea0

            • memory/1860-12-0x0000000004D20000-0x0000000004D60000-memory.dmp

              Filesize

              256KB

            • memory/1860-1-0x0000000073EB0000-0x000000007459E000-memory.dmp

              Filesize

              6.9MB

            • memory/1860-3-0x00000000004C0000-0x00000000004D6000-memory.dmp

              Filesize

              88KB

            • memory/1860-4-0x0000000000640000-0x000000000064A000-memory.dmp

              Filesize

              40KB

            • memory/1860-5-0x00000000051D0000-0x000000000527C000-memory.dmp

              Filesize

              688KB

            • memory/1860-6-0x0000000073EB0000-0x000000007459E000-memory.dmp

              Filesize

              6.9MB

            • memory/1860-2-0x0000000004D20000-0x0000000004D60000-memory.dmp

              Filesize

              256KB

            • memory/1860-15-0x0000000004CD0000-0x0000000004CFF000-memory.dmp

              Filesize

              188KB

            • memory/1860-0-0x00000000003A0000-0x000000000049E000-memory.dmp

              Filesize

              1016KB

            • memory/1860-16-0x0000000073EB0000-0x000000007459E000-memory.dmp

              Filesize

              6.9MB

            • memory/2860-17-0x000000006E280000-0x000000006E82B000-memory.dmp

              Filesize

              5.7MB

            • memory/2860-18-0x000000006E280000-0x000000006E82B000-memory.dmp

              Filesize

              5.7MB

            • memory/2860-19-0x00000000024D0000-0x0000000002510000-memory.dmp

              Filesize

              256KB

            • memory/2860-20-0x00000000024D0000-0x0000000002510000-memory.dmp

              Filesize

              256KB

            • memory/2860-21-0x000000006E280000-0x000000006E82B000-memory.dmp

              Filesize

              5.7MB