Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/04/2024, 10:43

General

  • Target

    Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe

  • Size

    1.0MB

  • MD5

    0de4eb1758f5ef209ed50d5728cbb729

  • SHA1

    dc50323b58a5f7a71f9c51c135e09f522aba1d26

  • SHA256

    f6723f25605e46b8bdd2a8a875ee319c40108491934b2f8fbcdd58d649cbc651

  • SHA512

    616bac0fdbf0ae628b8c6fb1cc2608a966703dce4005ea0812b9e7102e7db2e064c2e5512b725a10b052bf0f41d91888b9dcac7d63da22e6d844488dba366286

  • SSDEEP

    24576:FAHnh+eWsN3skA4RV1Hom2KXMmHakjr3rmhkjknnL5:0h+ZkldoPK8YakvqhkjkN

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

se63

Decoy

socratesandhisclouds.com

versioncolor.com

ytcp011.com

908511.vip

egysrvs.com

ky5682011.cc

kkuu14.icu

wavebsb.com

klikadelivery.com

jnbxbpq.com

5o8oh.us

hemule.net

techinf.xyz

bevage.club

we37h.com

tipsde.shop

48136.vip

bestcampertrailerbrands.com

fairmedics.in

quixonic.tech

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3432
    • C:\Users\Admin\AppData\Local\Temp\Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe
      "C:\Users\Admin\AppData\Local\Temp\Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3948
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4228
    • C:\Windows\SysWOW64\WWAHost.exe
      "C:\Windows\SysWOW64\WWAHost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
          PID:1772

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2520-17-0x0000000000C90000-0x0000000000D6C000-memory.dmp

      Filesize

      880KB

    • memory/2520-24-0x0000000001430000-0x00000000014C4000-memory.dmp

      Filesize

      592KB

    • memory/2520-22-0x0000000000C50000-0x0000000000C7F000-memory.dmp

      Filesize

      188KB

    • memory/2520-21-0x0000000001550000-0x000000000189A000-memory.dmp

      Filesize

      3.3MB

    • memory/2520-20-0x0000000000C50000-0x0000000000C7F000-memory.dmp

      Filesize

      188KB

    • memory/2520-19-0x0000000000C90000-0x0000000000D6C000-memory.dmp

      Filesize

      880KB

    • memory/3432-25-0x0000000002E20000-0x0000000002F2A000-memory.dmp

      Filesize

      1.0MB

    • memory/3432-16-0x0000000002E20000-0x0000000002F2A000-memory.dmp

      Filesize

      1.0MB

    • memory/3432-28-0x0000000003090000-0x000000000315F000-memory.dmp

      Filesize

      828KB

    • memory/3432-29-0x0000000003090000-0x000000000315F000-memory.dmp

      Filesize

      828KB

    • memory/3432-32-0x0000000003090000-0x000000000315F000-memory.dmp

      Filesize

      828KB

    • memory/3948-10-0x0000000000BC0000-0x0000000000BC4000-memory.dmp

      Filesize

      16KB

    • memory/4228-15-0x00000000020D0000-0x00000000020E5000-memory.dmp

      Filesize

      84KB

    • memory/4228-14-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/4228-12-0x0000000001C00000-0x0000000001F4A000-memory.dmp

      Filesize

      3.3MB

    • memory/4228-11-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB