Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    296s
  • max time network
    297s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2024, 21:48

General

  • Target

    3979bd4374308cc1a5a91f04c080b480dc4081dd2612aa2a9d1b504f09b7367c.exe

  • Size

    747KB

  • MD5

    3cd2595e3d20f8200d3ddf84b81932de

  • SHA1

    c05f5a5fd2e0da7be16621a5482541f3d492891c

  • SHA256

    3979bd4374308cc1a5a91f04c080b480dc4081dd2612aa2a9d1b504f09b7367c

  • SHA512

    fbc314a53bb2eeba48c0cf5793cc93b1f9361e62aa38de34c941d57bb677b0868e651ed46b783fef939c4b9659048b4a555c3e647201aae7ce1f9e9bf0731670

  • SSDEEP

    12288:H7nYP1+rSlwFON6zXeEt+f2VtTwfyfyp4P7r9r/+ppppppppppppppppppppppp0:HDYP1+rDOkKderNqS1qU

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

cix

Decoy

stephaniperold.com

sorairo12.com

palumasteknik.com

marketing4proptech.com

iwanttoheargod.com

structured-waters.com

sunvalleyvacations.net

sanketweb.com

tmasco.com

d-valentine.com

engmousavi.com

lithiumtolashes.com

texastramper.com

shoemall.store

beginningguitarbook.com

wonderlustnfairytales.com

bizinabox.store

kmacg.net

cashgold4cash.com

smtpguide.com

Signatures

  • 404 Keylogger

    Information stealer and keylogger first seen in 2019.

  • 404 Keylogger Main Executable 2 IoCs
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3404
    • C:\Users\Admin\AppData\Local\Temp\3979bd4374308cc1a5a91f04c080b480dc4081dd2612aa2a9d1b504f09b7367c.exe
      "C:\Users\Admin\AppData\Local\Temp\3979bd4374308cc1a5a91f04c080b480dc4081dd2612aa2a9d1b504f09b7367c.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Users\Admin\AppData\Local\Temp\3979bd4374308cc1a5a91f04c080b480dc4081dd2612aa2a9d1b504f09b7367c.exe
        "C:\Users\Admin\AppData\Local\Temp\3979bd4374308cc1a5a91f04c080b480dc4081dd2612aa2a9d1b504f09b7367c.exe"
        3⤵
        • Checks computer location settings
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4828
        • C:\Users\Admin\Pinatype\Coseismic.scr
          "C:\Users\Admin\Pinatype\Coseismic.scr" /S
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1468
          • C:\Users\Admin\Pinatype\Coseismic.scr
            "C:\Users\Admin\Pinatype\Coseismic.scr" /S
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:948
        • C:\Users\Admin\Payment receipt.exe
          "C:\Users\Admin\Payment receipt.exe"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • outlook_office_path
          • outlook_win_path
          PID:3868
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4384
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\Pinatype\Coseismic.scr"
        3⤵
          PID:3896
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:3580

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\DB1

        Filesize

        46KB

        MD5

        8f5942354d3809f865f9767eddf51314

        SHA1

        20be11c0d42fc0cef53931ea9152b55082d1a11e

        SHA256

        776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

        SHA512

        fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

      • C:\Users\Admin\AppData\Roaming\NN42N073\NN4logim.jpeg

        Filesize

        83KB

        MD5

        a0ca351d1e92fa9e124a3ccd13193b14

        SHA1

        643f41225e4d8c519f193fae23a12470c4b5c3d4

        SHA256

        d0e0b38cdce2d5e3ec2492e718db67a1ca2fe793dc8ef4b21e75332e0bc2e8cc

        SHA512

        6fe9b8d1fd62e1421f1449c6fa215e2e98e8e72a6ce1f1394432f48fd0203c98e833fef117793d99dd83776637bfa4fff96f61825a5c7f6984daa9031c7e6c94

      • C:\Users\Admin\AppData\Roaming\NN42N073\NN4logrg.ini

        Filesize

        38B

        MD5

        4aadf49fed30e4c9b3fe4a3dd6445ebe

        SHA1

        1e332822167c6f351b99615eada2c30a538ff037

        SHA256

        75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

        SHA512

        eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

      • C:\Users\Admin\AppData\Roaming\NN42N073\NN4logri.ini

        Filesize

        40B

        MD5

        d63a82e5d81e02e399090af26db0b9cb

        SHA1

        91d0014c8f54743bba141fd60c9d963f869d76c9

        SHA256

        eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

        SHA512

        38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

      • C:\Users\Admin\AppData\Roaming\NN42N073\NN4logrv.ini

        Filesize

        872B

        MD5

        bbc41c78bae6c71e63cb544a6a284d94

        SHA1

        33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

        SHA256

        ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

        SHA512

        0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

      • C:\Users\Admin\Payment receipt.exe

        Filesize

        98KB

        MD5

        f064015d967ac5fbedbe21c01689f388

        SHA1

        4f2044ea34938b045c5e62c389f3c62c44cb5392

        SHA256

        980563afc8a4af6029ef7266392765e4ed9cf23eb242078701b65f5d9078b0af

        SHA512

        2bf694bbada5bc84ec2e68b4b8e4a6c3b747c14e5e4f5aae0d25c5c94a44ed3df16b2384a966da9ce1d405441eb2727af22868204cca0a2b157a7ae0efedd67f

      • C:\Users\Admin\Pinatype\Coseismic.scr

        Filesize

        747KB

        MD5

        3cd2595e3d20f8200d3ddf84b81932de

        SHA1

        c05f5a5fd2e0da7be16621a5482541f3d492891c

        SHA256

        3979bd4374308cc1a5a91f04c080b480dc4081dd2612aa2a9d1b504f09b7367c

        SHA512

        fbc314a53bb2eeba48c0cf5793cc93b1f9361e62aa38de34c941d57bb677b0868e651ed46b783fef939c4b9659048b4a555c3e647201aae7ce1f9e9bf0731670

      • C:\Windows\win.ini

        Filesize

        123B

        MD5

        6bf517432f65eb7f0d18d574bf14124c

        SHA1

        5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

        SHA256

        6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

        SHA512

        7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

      • memory/948-58-0x0000000002130000-0x000000000213A000-memory.dmp

        Filesize

        40KB

      • memory/948-64-0x0000000000400000-0x00000000004BE000-memory.dmp

        Filesize

        760KB

      • memory/948-57-0x0000000000400000-0x00000000004BE000-memory.dmp

        Filesize

        760KB

      • memory/2720-3-0x0000000000610000-0x000000000061A000-memory.dmp

        Filesize

        40KB

      • memory/2720-4-0x00000000772A1000-0x00000000773C1000-memory.dmp

        Filesize

        1.1MB

      • memory/3404-68-0x0000000008570000-0x00000000086D1000-memory.dmp

        Filesize

        1.4MB

      • memory/3868-49-0x00000000050D0000-0x000000000516C000-memory.dmp

        Filesize

        624KB

      • memory/3868-62-0x00000000066E0000-0x00000000066EA000-memory.dmp

        Filesize

        40KB

      • memory/3868-61-0x00000000068B0000-0x0000000006A72000-memory.dmp

        Filesize

        1.8MB

      • memory/3868-60-0x0000000006640000-0x00000000066D2000-memory.dmp

        Filesize

        584KB

      • memory/3868-48-0x0000000005790000-0x0000000005D34000-memory.dmp

        Filesize

        5.6MB

      • memory/3868-47-0x0000000000620000-0x000000000063E000-memory.dmp

        Filesize

        120KB

      • memory/3868-59-0x00000000060F0000-0x0000000006156000-memory.dmp

        Filesize

        408KB

      • memory/4384-65-0x0000000000EC0000-0x0000000000EC6000-memory.dmp

        Filesize

        24KB

      • memory/4828-11-0x00000000021D0000-0x00000000021DA000-memory.dmp

        Filesize

        40KB