Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    18s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 01:00

General

  • Target

    37597a431d5cc8ef90c319b77d356ff6be15ba32df42b69b36561f226236d3ee.exe

  • Size

    795KB

  • MD5

    0221dcfd786601ea3e97128ba5e23278

  • SHA1

    6d768e1299b5903ead6030b32e1e6a2aed881e1a

  • SHA256

    37597a431d5cc8ef90c319b77d356ff6be15ba32df42b69b36561f226236d3ee

  • SHA512

    99fe04e8fb1fe1738b17bf0a149b891376dc760f613318892682da65bc5576fe6c6d2315833515f53851de2dc216bd32a7dd5c09e39e61faee28c1f647ea1cef

  • SSDEEP

    12288:PNk0/uOQAWuzQ5e119/mGZ7dgWwwNBLl0xA3:Fk0/xQhSKe11HiWFNBqxA3

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gy14

Decoy

mavbam.com

theanhedonia.com

budgetnurseries.com

buflitr.com

alqamarhotel.com

2660348.top

123bu6.shop

v72999.com

yzyz841.xyz

247fracing.com

naples.beauty

twinklethrive.com

loscaseros.com

creditspisatylegko.site

sgyy3ej2dgwesb5.com

ufocafe.net

techn9nehollywoodundead.com

truedatalab.com

alterdpxlmarketing.com

harborspringsfire.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

Processes

  • C:\Users\Admin\AppData\Local\Temp\37597a431d5cc8ef90c319b77d356ff6be15ba32df42b69b36561f226236d3ee.exe
    "C:\Users\Admin\AppData\Local\Temp\37597a431d5cc8ef90c319b77d356ff6be15ba32df42b69b36561f226236d3ee.exe"
    1⤵
      PID:2856
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NjQlGC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5ADC.tmp"
        2⤵
        • Creates scheduled task(s)
        PID:3064
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
          PID:2660
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NjQlGC.exe"
          2⤵
            PID:2888
        • C:\Windows\SysWOW64\ipconfig.exe
          "C:\Windows\SysWOW64\ipconfig.exe"
          1⤵
          • Gathers network information
          PID:2476
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            2⤵
              PID:2836

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmp5ADC.tmp

            Filesize

            1KB

            MD5

            6b77fe8fbb085fd4c2f0149ba69f1c4f

            SHA1

            b2b30ad2d50716cfbd32fc0a6aaa2f418cea1545

            SHA256

            f8929e9b030ced5080706440495f40657f995d28a2951cca27f32603289c16e7

            SHA512

            b3181b7cc59fd475ec433a3122deb3448e50b8cb76eea485b69bbe33ac80106edbaf9ba9a6908d01b4bc7cbc85dbca0dc3b5efee2ec89b058ba7edaf8baba07d

          • memory/1212-26-0x0000000006700000-0x0000000006893000-memory.dmp

            Filesize

            1.6MB

          • memory/1212-44-0x0000000004CA0000-0x0000000004DA7000-memory.dmp

            Filesize

            1.0MB

          • memory/1212-21-0x0000000003B30000-0x0000000003C30000-memory.dmp

            Filesize

            1024KB

          • memory/1212-36-0x0000000004CA0000-0x0000000004DA7000-memory.dmp

            Filesize

            1.0MB

          • memory/2476-42-0x00000000006D0000-0x0000000000764000-memory.dmp

            Filesize

            592KB

          • memory/2476-41-0x0000000000080000-0x00000000000AF000-memory.dmp

            Filesize

            188KB

          • memory/2476-40-0x0000000002200000-0x0000000002503000-memory.dmp

            Filesize

            3.0MB

          • memory/2476-37-0x0000000000DF0000-0x0000000000DFA000-memory.dmp

            Filesize

            40KB

          • memory/2476-39-0x0000000000080000-0x00000000000AF000-memory.dmp

            Filesize

            188KB

          • memory/2476-38-0x0000000000DF0000-0x0000000000DFA000-memory.dmp

            Filesize

            40KB

          • memory/2660-25-0x0000000000190000-0x00000000001A5000-memory.dmp

            Filesize

            84KB

          • memory/2660-14-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2660-15-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2660-34-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2660-35-0x00000000001E0000-0x00000000001F5000-memory.dmp

            Filesize

            84KB

          • memory/2660-30-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

            Filesize

            3.0MB

          • memory/2660-24-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2660-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2660-18-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2856-6-0x0000000005220000-0x00000000052A0000-memory.dmp

            Filesize

            512KB

          • memory/2856-1-0x0000000073F30000-0x000000007461E000-memory.dmp

            Filesize

            6.9MB

          • memory/2856-0-0x00000000008D0000-0x000000000099E000-memory.dmp

            Filesize

            824KB

          • memory/2856-2-0x00000000004A0000-0x00000000004E0000-memory.dmp

            Filesize

            256KB

          • memory/2856-3-0x0000000000350000-0x0000000000364000-memory.dmp

            Filesize

            80KB

          • memory/2856-19-0x0000000073F30000-0x000000007461E000-memory.dmp

            Filesize

            6.9MB

          • memory/2856-5-0x0000000000530000-0x000000000053E000-memory.dmp

            Filesize

            56KB

          • memory/2856-4-0x0000000000520000-0x000000000052A000-memory.dmp

            Filesize

            40KB

          • memory/2888-31-0x000000006E2F0000-0x000000006E89B000-memory.dmp

            Filesize

            5.7MB

          • memory/2888-28-0x0000000002AA0000-0x0000000002AE0000-memory.dmp

            Filesize

            256KB

          • memory/2888-27-0x0000000002AA0000-0x0000000002AE0000-memory.dmp

            Filesize

            256KB

          • memory/2888-29-0x0000000002AA0000-0x0000000002AE0000-memory.dmp

            Filesize

            256KB

          • memory/2888-22-0x000000006E2F0000-0x000000006E89B000-memory.dmp

            Filesize

            5.7MB

          • memory/2888-23-0x000000006E2F0000-0x000000006E89B000-memory.dmp

            Filesize

            5.7MB