Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 01:27
Static task
static1
Behavioral task
behavioral1
Sample
6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe
Resource
win7-20240220-en
General
-
Target
6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe
-
Size
1.0MB
-
MD5
8170ed5deb6ad823fc7ae0b4d3c0cb4d
-
SHA1
b851fda5941039c70879c1c5aaafe7ee98f1d4f6
-
SHA256
6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380
-
SHA512
e42b0be31d5bec09621dfe297c93416122dceaa7feccd270b89a0e6f595c0aad869a296732d2f549976df45528781430586e1b564f165b97ae129ec0a4e88feb
-
SSDEEP
24576:2AHnh+eWsN3skA4RV1Hom2KXMmHaeVM8iSU2HMMOuvzON5:Rh+ZkldoPK8YaeVs2s0U
Malware Config
Extracted
formbook
4.1
da29
kas-travel.com
hy1618.net
biosrch.com
sharvellestudio.com
56416.ooo
953700958.com
500051.com
clic.coach
veriosg.xyz
aptsafety.com
cucinaconestilo.com
sercettopper.com
diycoldplungetub.com
hostingopinion.com
mediatechnologysolutions.com
nodogwifnohat.com
ethpiee.com
tragaperrasbares.com
bbbcf.top
jtxu6.top
sorgulama95.shop
myconc.pro
okb-ar.net
thanhdoanacademy.com
rlyadventures.com
maestrolipari.com
digitaluxsolution.com
zituahmed.com
h5yfdgtg.top
whalesnorkelingmirissa.online
indxriim-firsaxtllari.com
fopoliswhlvtjv.top
iransarafan.com
usedata.monster
mnasjdqw66775jqwe09qwjsqwx.vip
aphropay.com
myfreedomlyfe.com
vytennow.com
micheleditrana.com
babycarrot.fun
maltepede.site
618dfyy21.com
flickzbiz.fun
sshihi.top
xsports108.com
ideiastransformadoras.com
aerotyneholdings.com
expandyourbusinessdigital.com
crown777login.com
wheepexpress.com
openshiftstore.com
xzdkzsaczp.xyz
cycmedb.com
9sh3j02g8j.com
cemeku.sydney
functionalfossils.com
kenguru.ink
classicsty.com
directadz.com
scuffedwrapz.com
oxmoz.art
rusticstores.com
vietcadao.com
ai-infinite.net
1wxir.com
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2884-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2884-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2884-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2568-25-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3036 set thread context of 2884 3036 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 28 PID 2884 set thread context of 1192 2884 svchost.exe 21 PID 2884 set thread context of 1192 2884 svchost.exe 21 PID 2568 set thread context of 1192 2568 netsh.exe 21 -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2884 svchost.exe 2884 svchost.exe 2884 svchost.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe 2568 netsh.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3036 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 2884 svchost.exe 2884 svchost.exe 2884 svchost.exe 2884 svchost.exe 2568 netsh.exe 2568 netsh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2884 svchost.exe Token: SeDebugPrivilege 2568 netsh.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3036 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 3036 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3036 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 3036 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2884 3036 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 28 PID 3036 wrote to memory of 2884 3036 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 28 PID 3036 wrote to memory of 2884 3036 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 28 PID 3036 wrote to memory of 2884 3036 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 28 PID 3036 wrote to memory of 2884 3036 6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe 28 PID 1192 wrote to memory of 2568 1192 Explorer.EXE 29 PID 1192 wrote to memory of 2568 1192 Explorer.EXE 29 PID 1192 wrote to memory of 2568 1192 Explorer.EXE 29 PID 1192 wrote to memory of 2568 1192 Explorer.EXE 29 PID 2568 wrote to memory of 2560 2568 netsh.exe 30 PID 2568 wrote to memory of 2560 2568 netsh.exe 30 PID 2568 wrote to memory of 2560 2568 netsh.exe 30 PID 2568 wrote to memory of 2560 2568 netsh.exe 30
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe"C:\Users\Admin\AppData\Local\Temp\6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\6305683c82227f88452f652423871426259657f45fc89ad8802b3e92b49e0380.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:2560
-
-