Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 10:43
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe
Resource
win7-20240221-en
General
-
Target
Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe
-
Size
1.0MB
-
MD5
0de4eb1758f5ef209ed50d5728cbb729
-
SHA1
dc50323b58a5f7a71f9c51c135e09f522aba1d26
-
SHA256
f6723f25605e46b8bdd2a8a875ee319c40108491934b2f8fbcdd58d649cbc651
-
SHA512
616bac0fdbf0ae628b8c6fb1cc2608a966703dce4005ea0812b9e7102e7db2e064c2e5512b725a10b052bf0f41d91888b9dcac7d63da22e6d844488dba366286
-
SSDEEP
24576:FAHnh+eWsN3skA4RV1Hom2KXMmHakjr3rmhkjknnL5:0h+ZkldoPK8YakvqhkjkN
Malware Config
Extracted
formbook
4.1
se63
socratesandhisclouds.com
versioncolor.com
ytcp011.com
908511.vip
egysrvs.com
ky5682011.cc
kkuu14.icu
wavebsb.com
klikadelivery.com
jnbxbpq.com
5o8oh.us
hemule.net
techinf.xyz
bevage.club
we37h.com
tipsde.shop
48136.vip
bestcampertrailerbrands.com
fairmedics.in
quixonic.tech
aldcr.in
drepeacewp.com
odty914.net
live2move.us
galeriaspognardi.com
danauslot.shop
usapubpong.com
jingchen.xyz
xztyvk.xyz
butimarproductions.com
wuhangyjs.com
baddogdigital.com
mb28apparel.com
bnkk9o3zrgsy5.quest
playsolutionsinc.com
warriors4earth.com
gastric-balloon-71533.bond
adptgn.com
psicologiaparausted.com
gothecleaningpros.com
xnc8ki.vip
908511.vip
ozr3np.com
tradingbase.cloud
36h9.com
iaobet.net
6902470365.com
qasolvers.in
00047.vip
massiverole.shop
used-cars-66201.bond
baisexual.com
shoreswimschool.com
shrike.foo
shemosservicesllc.net
electric-cars-97134.bond
aicryptochain.com
wg5688.com
nomades.digital
thesiamesebetta.store
abbymartz.com
kimsnailsii.top
producepatch.shop
ebridgereal.site
cincinnatisoup.com
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/4228-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4228-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2520-20-0x0000000000C50000-0x0000000000C7F000-memory.dmp formbook behavioral2/memory/2520-22-0x0000000000C50000-0x0000000000C7F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3948 set thread context of 4228 3948 Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe 87 PID 4228 set thread context of 3432 4228 svchost.exe 57 PID 2520 set thread context of 3432 2520 WWAHost.exe 57 -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4228 svchost.exe 4228 svchost.exe 4228 svchost.exe 4228 svchost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe 2520 WWAHost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3948 Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe 4228 svchost.exe 4228 svchost.exe 4228 svchost.exe 2520 WWAHost.exe 2520 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4228 svchost.exe Token: SeDebugPrivilege 2520 WWAHost.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 3948 Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe 3948 Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 3948 Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe 3948 Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe 3432 Explorer.EXE 3432 Explorer.EXE 3432 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3948 wrote to memory of 4228 3948 Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe 87 PID 3948 wrote to memory of 4228 3948 Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe 87 PID 3948 wrote to memory of 4228 3948 Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe 87 PID 3948 wrote to memory of 4228 3948 Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe 87 PID 3432 wrote to memory of 2520 3432 Explorer.EXE 88 PID 3432 wrote to memory of 2520 3432 Explorer.EXE 88 PID 3432 wrote to memory of 2520 3432 Explorer.EXE 88 PID 2520 wrote to memory of 1772 2520 WWAHost.exe 89 PID 2520 wrote to memory of 1772 2520 WWAHost.exe 89 PID 2520 wrote to memory of 1772 2520 WWAHost.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:1772
-
-