Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
30/07/2024, 18:20
Static task
static1
Behavioral task
behavioral1
Sample
Payment Prove for Invoice No.126789.exe
Resource
win7-20240708-en
General
-
Target
Payment Prove for Invoice No.126789.exe
-
Size
218KB
-
MD5
19c2e374a191ee18466c11cefeddbe75
-
SHA1
6a6b1d342f67705a05c3eda5f8121b76e4a72e04
-
SHA256
fd4dbce199d52440961eec1b4557d51014ff2ed2278466b84925eb5f7b38c13d
-
SHA512
3a94415990bacc4cb8d9c68a1e65e0bfb999fd944e161a22d5709545919143ffa344f624a212347d76364653ed0e06fe320aaff43bbbba4bbadfdf7f6deb7dc1
-
SSDEEP
3072:BtvW1h07m6MfaxOhHwlzErARHTvpyJWA3l9MwO078PMznseowDGooqRJYuEK39uj:BtT7PMixWQlvDcJKwZXowbosYPK39u0
Malware Config
Extracted
formbook
4.1
na10
tetheus.com
ventlikeyoumeanit.com
tintbliss.com
rinabet357.com
sapphireboutiqueusa.com
abc8bet6.com
xzcn3i7jb13cqei.buzz
pinktravelsnagpur.com
bt365038.com
rtpbossujang303.shop
osthirmaker.com
thelonelyteacup.com
rlc2019.com
couverture-charpente.com
productivagc.com
defendercarcare.com
abcentixdigital.com
petco.ltd
oypivh.top
micro.guru
hokivegasslots.club
5663876.com
symboleffekt.info
tworiverlabsintake.com
pegaso.store
sasoera.com
material.chat
taniamckirdy.com
dansistosproductions.com
moromorojp.com
z27e1thx976ez3u.buzz
skinrenue.com
nbvci.xyz
jakobniinja.xyz
snykee.com
sl24.top
wawturkiye.xyz
virtualeventsbyelaine.com
giorgiaclerico.com
d9psk8.xyz
hard-to-miss.space
awclog.com
topcomparativos.com
somoyboutique.com
findlove.pro
zbo170.app
dexcoenergy.com
nona23.lat
ingelset.com
hexatelier.com
nftees.tech
visionarymaterialsinstitute.com
khanyos.com
bz59.top
migraine-treatment-28778.bond
catboxbot.online
kkugames.com
llmsearchoptimization.com
fipbhvvb.xyz
vmytzptc.xyz
intermediafx.shop
lhrrs.com
grimreapervalley.com
discount-fess.space
liamcollinai.com
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/32-8-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/32-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4280-18-0x0000000000850000-0x000000000087F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3424 set thread context of 32 3424 Payment Prove for Invoice No.126789.exe 84 PID 32 set thread context of 3488 32 ngentask.exe 56 PID 4280 set thread context of 3488 4280 msdt.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payment Prove for Invoice No.126789.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 32 ngentask.exe 32 ngentask.exe 32 ngentask.exe 32 ngentask.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe 4280 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 32 ngentask.exe 32 ngentask.exe 32 ngentask.exe 4280 msdt.exe 4280 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 32 ngentask.exe Token: SeDebugPrivilege 4280 msdt.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3424 wrote to memory of 32 3424 Payment Prove for Invoice No.126789.exe 84 PID 3424 wrote to memory of 32 3424 Payment Prove for Invoice No.126789.exe 84 PID 3424 wrote to memory of 32 3424 Payment Prove for Invoice No.126789.exe 84 PID 3424 wrote to memory of 32 3424 Payment Prove for Invoice No.126789.exe 84 PID 3424 wrote to memory of 32 3424 Payment Prove for Invoice No.126789.exe 84 PID 3424 wrote to memory of 32 3424 Payment Prove for Invoice No.126789.exe 84 PID 3488 wrote to memory of 4280 3488 Explorer.EXE 85 PID 3488 wrote to memory of 4280 3488 Explorer.EXE 85 PID 3488 wrote to memory of 4280 3488 Explorer.EXE 85 PID 4280 wrote to memory of 984 4280 msdt.exe 86 PID 4280 wrote to memory of 984 4280 msdt.exe 86 PID 4280 wrote to memory of 984 4280 msdt.exe 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\Payment Prove for Invoice No.126789.exe"C:\Users\Admin\AppData\Local\Temp\Payment Prove for Invoice No.126789.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:32
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"3⤵
- System Location Discovery: System Language Discovery
PID:984
-
-