Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
Obavestenje o prilivu.PDF.exe
Resource
win7-20240508-en
General
-
Target
Obavestenje o prilivu.PDF.exe
-
Size
524KB
-
MD5
3911e099bed114b7417378e2dbe079d1
-
SHA1
00fea996bbff2b686a0b3e275d536babacefc0af
-
SHA256
e9e09c2f8031763a0c8494d500bd28ca3adc87d5f700111255db99f8142f2933
-
SHA512
55630fbf32fb702185fbc3f6adee9f5775e6e91c0c1bf9e448d7506ebed15852970946d856d9dd399f0b12da3f0a97a05c6c2803a4546e8a034e8f89eeb3694b
-
SSDEEP
12288:7EELYhiWgZlgyCGYRe6v/M1Kx5pPKYcfzvw:oEskWgDDyb01I5pPKvfr
Malware Config
Extracted
lokibot
http://45.61.137.215/index.php/3b1tenbkyj
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Extracted
formbook
4.1
dn03
almouranipainting.com
cataloguia.shop
zaparielectric.com
whcqsc.com
ioco.in
aduredmond.com
vavada611a.fun
humtivers.com
jewellerytml.com
mcapitalparticipacoes.com
inhlcq.shop
solanamall.xyz
moviepropgroup.com
thegenesis.ltd
cyberxdefend.com
skinbykoco.com
entermintlead.com
honestaireviews.com
wyclhj7gqfustzp.buzz
w937xb.com
bakuusa.online
sabong-web.com
52cg2.club
jasonnutter.golf
odbet555.app
vipmotoryatkiralama.com
auravibeslighting.com
pulsesautos.com
imdcaam.com
vivaness.club
bovverbadges.com
giaydonghai.online
aditi-jobs.com
numericalsemantics.com
shoprazorlaser.com
lovedacademy.com
gets-lnds.io
teyo293.xyz
banditsolana.com
delivery-jobs-76134.bond
ppp5716.buzz
zjmeterial.com
de-ponqk.top
bntyr76rhg.top
servicepmgtl.world
nailtimelocust.top
paperappa.com
80sos.com
daysofbetting.com
slaytheday.fun
travauxdefou.com
bx2zyg.com
thecoxnews.com
qriskaq.com
top-dao.com
krstockly1.shop
roiwholesale.com
pajero777ads.click
twistedrubytx.com
thesovreignkingdomofmaui.info
cataclysmicgamingapparel.com
verxop.xyz
xn--kwra1023b.com
winterclairee.com
sukhiclothing.com
Signatures
-
Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/4164-97-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3284-131-0x0000000000EE0000-0x0000000000F0F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4712 powershell.exe 4380 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation Obavestenje o prilivu.PDF.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation gJUOIrUR6kc2sEM.exe -
Executes dropped EXE 1 IoCs
pid Process 3300 gJUOIrUR6kc2sEM.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegSvcs.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4388 set thread context of 4108 4388 Obavestenje o prilivu.PDF.exe 96 PID 3300 set thread context of 4164 3300 gJUOIrUR6kc2sEM.exe 99 PID 4164 set thread context of 3596 4164 RegSvcs.exe 56 PID 3284 set thread context of 3596 3284 chkdsk.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4712 powershell.exe 4712 powershell.exe 4164 RegSvcs.exe 4164 RegSvcs.exe 4164 RegSvcs.exe 4164 RegSvcs.exe 4380 powershell.exe 4380 powershell.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe 3284 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4164 RegSvcs.exe 4164 RegSvcs.exe 4164 RegSvcs.exe 3284 chkdsk.exe 3284 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4388 Obavestenje o prilivu.PDF.exe Token: SeDebugPrivilege 4712 powershell.exe Token: SeDebugPrivilege 4108 RegSvcs.exe Token: SeDebugPrivilege 4164 RegSvcs.exe Token: SeDebugPrivilege 4380 powershell.exe Token: SeShutdownPrivilege 3596 Explorer.EXE Token: SeCreatePagefilePrivilege 3596 Explorer.EXE Token: SeDebugPrivilege 3284 chkdsk.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4388 wrote to memory of 4712 4388 Obavestenje o prilivu.PDF.exe 93 PID 4388 wrote to memory of 4712 4388 Obavestenje o prilivu.PDF.exe 93 PID 4388 wrote to memory of 4712 4388 Obavestenje o prilivu.PDF.exe 93 PID 4388 wrote to memory of 3300 4388 Obavestenje o prilivu.PDF.exe 95 PID 4388 wrote to memory of 3300 4388 Obavestenje o prilivu.PDF.exe 95 PID 4388 wrote to memory of 3300 4388 Obavestenje o prilivu.PDF.exe 95 PID 4388 wrote to memory of 4108 4388 Obavestenje o prilivu.PDF.exe 96 PID 4388 wrote to memory of 4108 4388 Obavestenje o prilivu.PDF.exe 96 PID 4388 wrote to memory of 4108 4388 Obavestenje o prilivu.PDF.exe 96 PID 4388 wrote to memory of 4108 4388 Obavestenje o prilivu.PDF.exe 96 PID 4388 wrote to memory of 4108 4388 Obavestenje o prilivu.PDF.exe 96 PID 4388 wrote to memory of 4108 4388 Obavestenje o prilivu.PDF.exe 96 PID 4388 wrote to memory of 4108 4388 Obavestenje o prilivu.PDF.exe 96 PID 4388 wrote to memory of 4108 4388 Obavestenje o prilivu.PDF.exe 96 PID 4388 wrote to memory of 4108 4388 Obavestenje o prilivu.PDF.exe 96 PID 3300 wrote to memory of 4380 3300 gJUOIrUR6kc2sEM.exe 97 PID 3300 wrote to memory of 4380 3300 gJUOIrUR6kc2sEM.exe 97 PID 3300 wrote to memory of 4380 3300 gJUOIrUR6kc2sEM.exe 97 PID 3300 wrote to memory of 4164 3300 gJUOIrUR6kc2sEM.exe 99 PID 3300 wrote to memory of 4164 3300 gJUOIrUR6kc2sEM.exe 99 PID 3300 wrote to memory of 4164 3300 gJUOIrUR6kc2sEM.exe 99 PID 3300 wrote to memory of 4164 3300 gJUOIrUR6kc2sEM.exe 99 PID 3300 wrote to memory of 4164 3300 gJUOIrUR6kc2sEM.exe 99 PID 3300 wrote to memory of 4164 3300 gJUOIrUR6kc2sEM.exe 99 PID 3596 wrote to memory of 3284 3596 Explorer.EXE 100 PID 3596 wrote to memory of 3284 3596 Explorer.EXE 100 PID 3596 wrote to memory of 3284 3596 Explorer.EXE 100 PID 3284 wrote to memory of 2296 3284 chkdsk.exe 101 PID 3284 wrote to memory of 2296 3284 chkdsk.exe 101 PID 3284 wrote to memory of 2296 3284 chkdsk.exe 101 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegSvcs.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\Obavestenje o prilivu.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Obavestenje o prilivu.PDF.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Obavestenje o prilivu.PDF.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
-
C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe"C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4108
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2296
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD570264519b777b0e4dbd4686bf2d8a673
SHA160394c3c32668061fd5f5f1658f28b49f2c1bf04
SHA2561af5e71d7ce7daa437302088c3d0781ebc319b68a0424dde7ffe7fa9a69c6e8c
SHA512fcd907e036120f57382ad0527d614a88136e3b1ac9aa8de605ca09f94a3045e83f769ba12114c4be93c1542fae1bad1e254b0ca4bc3e80aa694dd6f62c8ac4bc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
615KB
MD59fb018d34d80db3b22e721e2768f6bb5
SHA1bba13f32dc03ba024b55a76e92137dec699640cc
SHA2568ef8e3afba42a19e43c2cb6f591ad6ef601791db37b5626f6102e6c4d39667b7
SHA5127f8a28f648b48bbbabdb7c7d78329fe821a11a54b40ed921be460c9875ba02307535cb0847dcf055497978e360f754083b67bc18877c6d6f2cb6b34aa1b3c2a2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2539840389-1261165778-1087677076-1000\0f5007522459c86e95ffcc62f32308f1_468f6343-c0e6-4931-9703-30c6539573cb
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2539840389-1261165778-1087677076-1000\0f5007522459c86e95ffcc62f32308f1_468f6343-c0e6-4931-9703-30c6539573cb
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b