Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
Doc 07232412.exe
Resource
win7-20240704-en
General
-
Target
Doc 07232412.exe
-
Size
637KB
-
MD5
d44cbc7808ef4ca0e9007ed7812ac54c
-
SHA1
3562886c50d64e72079e0bad936c065027acb6f1
-
SHA256
eb9de075c6c5ac3dae5ec163fe9d8abeccf9edc3bdeed05364dcacf64c9550d2
-
SHA512
6c256b5c66177a5dee6bc769c8fa782834feefdc584beeb503f89e0cedbc23a88dd98976774f0839765efeb137b1a87ffb71ff36659e560777f33601340816f4
-
SSDEEP
12288:WdwwoIc0QIH2j0ocLX6NBxa3+SYOhAbp8FCTzcDxuN+wsv5/s2cxkOxW/t+BA:WywoIc0QIH2EiBcPQTTzIuN+vv5ixW/e
Malware Config
Extracted
formbook
4.1
by21
digitalillusions.net
changeblue25.com
kitchenwoow.com
grupocontigoalimentacion.com
iranabr.com
embodiedmagic.com
superstoreszone.com
apartments-for-rent-46883.bond
kelbagnole.com
rideskratchlab.com
a06kng.club
saddlebredallstars.xyz
filepd.com
kxetdf.asia
dl39yy.com
jackedsearch.com
exodusprofessionaldetailing.com
ecommerce-40144.bond
uh3b94g3pyczi9t.skin
dcmcc635i.xyz
mifactura.info
suv-deals-36687.bond
technboost.shop
coroaabos.com
lexbd.asia
card-swiss.com
zerolength.com
autopro13-dz.com
hr-outsourcing-51978.bond
pylo.online
vdecorshop.com
rh-surplus.com
j20d.vip
5nujoom.com
nothing-but.online
oyuxjkoz.xyz
3040com.com
ntbar.online
mpics.net
tacticalbirds.com
qwmu.asia
ahotbuyweb.com
fvbzx.xyz
thebjcam.com
ikbim.rest
directfunds.network
soitaxi.com
hypecoin.xyz
bt365819.com
aidiventures.com
coastwindowcleaninginc.com
pinup-adwise.top
prjctbestia.store
51272941.com
mubozest.com
teneriferedtape.com
hopeandshop.online
m9eytjkm46lzbln.skin
tehtarik8.com
00050131.xyz
leacarat.net
depression-test-20232.bond
aidhubamerica.com
alihz.asia
ahenkalacati.shop
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2864-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2864-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2768-23-0x00000000000F0000-0x000000000011F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2844 powershell.exe -
Deletes itself 1 IoCs
pid Process 2652 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2084 set thread context of 2864 2084 Doc 07232412.exe 31 PID 2864 set thread context of 1384 2864 Doc 07232412.exe 20 PID 2768 set thread context of 1384 2768 cmstp.exe 20 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2864 Doc 07232412.exe 2864 Doc 07232412.exe 2844 powershell.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe 2768 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2864 Doc 07232412.exe 2864 Doc 07232412.exe 2864 Doc 07232412.exe 2768 cmstp.exe 2768 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2864 Doc 07232412.exe Token: SeDebugPrivilege 2844 powershell.exe Token: SeDebugPrivilege 2768 cmstp.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2844 2084 Doc 07232412.exe 29 PID 2084 wrote to memory of 2844 2084 Doc 07232412.exe 29 PID 2084 wrote to memory of 2844 2084 Doc 07232412.exe 29 PID 2084 wrote to memory of 2844 2084 Doc 07232412.exe 29 PID 2084 wrote to memory of 2864 2084 Doc 07232412.exe 31 PID 2084 wrote to memory of 2864 2084 Doc 07232412.exe 31 PID 2084 wrote to memory of 2864 2084 Doc 07232412.exe 31 PID 2084 wrote to memory of 2864 2084 Doc 07232412.exe 31 PID 2084 wrote to memory of 2864 2084 Doc 07232412.exe 31 PID 2084 wrote to memory of 2864 2084 Doc 07232412.exe 31 PID 2084 wrote to memory of 2864 2084 Doc 07232412.exe 31 PID 1384 wrote to memory of 2768 1384 Explorer.EXE 32 PID 1384 wrote to memory of 2768 1384 Explorer.EXE 32 PID 1384 wrote to memory of 2768 1384 Explorer.EXE 32 PID 1384 wrote to memory of 2768 1384 Explorer.EXE 32 PID 1384 wrote to memory of 2768 1384 Explorer.EXE 32 PID 1384 wrote to memory of 2768 1384 Explorer.EXE 32 PID 1384 wrote to memory of 2768 1384 Explorer.EXE 32 PID 2768 wrote to memory of 2652 2768 cmstp.exe 33 PID 2768 wrote to memory of 2652 2768 cmstp.exe 33 PID 2768 wrote to memory of 2652 2768 cmstp.exe 33 PID 2768 wrote to memory of 2652 2768 cmstp.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\Doc 07232412.exe"C:\Users\Admin\AppData\Local\Temp\Doc 07232412.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Doc 07232412.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\Doc 07232412.exe"C:\Users\Admin\AppData\Local\Temp\Doc 07232412.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Doc 07232412.exe"3⤵
- Deletes itself
PID:2652
-
-