Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2024, 17:43

General

  • Target

    8a23748bd6538bc7f349639d7b100260.exe

  • Size

    820KB

  • MD5

    8a23748bd6538bc7f349639d7b100260

  • SHA1

    892aef662cff782d478615ab5e3631c0e9ad5d13

  • SHA256

    8ca372bae777f7250c22113f1312b38955555f48c0b1ed2aaf0c9326abe06001

  • SHA512

    059e16d0fa1aad6c87699b5a41041ec969c9d1832708a4186faff724921527c1d97d9c19f6f1ce43ca99f3352933d68102846e71920a2292c166d1f9de36df57

  • SSDEEP

    12288:254GgfHiwrENcmH/nOLQ9+SboQY3Sa1Zen1hbzM/2iN:25jsHXrENcIOL6HU91ZOk/1

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

wz6a

Decoy

commonebisu.com

onlinedatingforyou.com

nomoreink.com

directcare.doctor

protego1.com

buvettechamonix.com

dissertationshelp.net

theawakenedmother.life

leonwickham.com

renaultstoreiran.com

lsxwsj.com

uniontattoosupply.com

herfitnessandbeauty.com

jesselynleephotography.com

imaginebyccp.com

athomeproductive.com

laratome.com

smoothsailingexpress.com

freedrumlessons4u.com

easylivego.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a23748bd6538bc7f349639d7b100260.exe
    "C:\Users\Admin\AppData\Local\Temp\8a23748bd6538bc7f349639d7b100260.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Local\Temp\8a23748bd6538bc7f349639d7b100260.exe
      "C:\Users\Admin\AppData\Local\Temp\8a23748bd6538bc7f349639d7b100260.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2516-6-0x0000000005590000-0x0000000005636000-memory.dmp

    Filesize

    664KB

  • memory/2516-15-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2516-2-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

    Filesize

    256KB

  • memory/2516-3-0x00000000003E0000-0x00000000003F2000-memory.dmp

    Filesize

    72KB

  • memory/2516-4-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2516-5-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

    Filesize

    256KB

  • memory/2516-7-0x0000000000520000-0x0000000000556000-memory.dmp

    Filesize

    216KB

  • memory/2516-1-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2516-0-0x0000000000AE0000-0x0000000000BB4000-memory.dmp

    Filesize

    848KB

  • memory/2644-10-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2644-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2644-14-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2644-8-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2644-16-0x0000000000BC0000-0x0000000000EC3000-memory.dmp

    Filesize

    3.0MB