Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
31/07/2024, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
RFQ31072024_August order_pdf.bat.exe
Resource
win7-20240708-en
General
-
Target
RFQ31072024_August order_pdf.bat.exe
-
Size
637KB
-
MD5
f48f1b6145eb795061ee91642a07cfa4
-
SHA1
5d8ab68c809005ad6495b04e3fe11e306ee71cbd
-
SHA256
9f17dfb2b539dbfeae4eff938a67da34bf07b6d9617c49963ec4b537449f7520
-
SHA512
69164b98afc612343d1eebd1d98ae544b1954bbaacb9444ceccc16894027f89e5eb3b7b807f7e24eb3fe7e76a829d67d93642c767d40d88c6e1d2f9013ea2a44
-
SSDEEP
12288:8I4QpjndCej981lKV+qspbem0HFnOXKizT3i/q8re+JvvYnQckR:8InjdCaKocam0HFOa+SQe
Malware Config
Extracted
formbook
4.1
ss24
agingwellhc.com
unikbetanggur.autos
eb2024yl.top
ja380.xyz
thehalcyon.studio
maudsoogrim.com
esteler10.click
mewtcp.xyz
www-zjbf1.club
kucinglucu.online
lunwencheck.com
65597.photos
erbxeu358h.top
startable.online
yousend.xyz
csharksg.com
centricoatings.com
ntruhslearn.xyz
achabakra.xyz
zuntool.com
jejbtl738a.top
runebinder.com
fidogmesvies170s63.online
online-unicsedritcorp.com
8208975.com
supporthq.life
protocolozeroacne.com
ocotilloco.com
xcolbu456t.xyz
ciclidossi.com
163875.shop
strangebedfellowstheatre.com
unikbetjeruk.homes
jhlktwyq.xyz
realearthpower.com
crucka.xyz
pkvnvtdb.com
profitablecasino.com
uspspsnami.top
thejerkspices.com
sivagiriashram.info
usavisa8loan.xyz
deoconverter.pro
investing-courses-66663.bond
2025tengxun171.lat
bluebirdbodyworkstudio.com
siblingstalk.com
lxcqx.com
amharicprofessional.pro
lijiangstory.net
barflybook.com
eldesigin.com
yd81w.top
head2toe.boutique
varun.works
next-genlion.com
awvd97.com
derindenizotel.com
vertibridge.xyz
qdfake609am.xyz
acc-pay.top
qblackbit.com
pallesudatissime.com
8548d.com
ygyqpswy.xyz
Signatures
-
Formbook payload 2 IoCs
resource yara_rule behavioral1/memory/2748-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2676-23-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2144 powershell.exe -
Deletes itself 1 IoCs
pid Process 672 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1728 set thread context of 2748 1728 RFQ31072024_August order_pdf.bat.exe 35 PID 2748 set thread context of 1204 2748 RFQ31072024_August order_pdf.bat.exe 21 PID 2676 set thread context of 1204 2676 cmmon32.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmmon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ31072024_August order_pdf.bat.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2564 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2748 RFQ31072024_August order_pdf.bat.exe 2748 RFQ31072024_August order_pdf.bat.exe 2144 powershell.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe 2676 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2748 RFQ31072024_August order_pdf.bat.exe 2748 RFQ31072024_August order_pdf.bat.exe 2748 RFQ31072024_August order_pdf.bat.exe 2676 cmmon32.exe 2676 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2748 RFQ31072024_August order_pdf.bat.exe Token: SeDebugPrivilege 2144 powershell.exe Token: SeDebugPrivilege 2676 cmmon32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2144 1728 RFQ31072024_August order_pdf.bat.exe 31 PID 1728 wrote to memory of 2144 1728 RFQ31072024_August order_pdf.bat.exe 31 PID 1728 wrote to memory of 2144 1728 RFQ31072024_August order_pdf.bat.exe 31 PID 1728 wrote to memory of 2144 1728 RFQ31072024_August order_pdf.bat.exe 31 PID 1728 wrote to memory of 2564 1728 RFQ31072024_August order_pdf.bat.exe 32 PID 1728 wrote to memory of 2564 1728 RFQ31072024_August order_pdf.bat.exe 32 PID 1728 wrote to memory of 2564 1728 RFQ31072024_August order_pdf.bat.exe 32 PID 1728 wrote to memory of 2564 1728 RFQ31072024_August order_pdf.bat.exe 32 PID 1728 wrote to memory of 2748 1728 RFQ31072024_August order_pdf.bat.exe 35 PID 1728 wrote to memory of 2748 1728 RFQ31072024_August order_pdf.bat.exe 35 PID 1728 wrote to memory of 2748 1728 RFQ31072024_August order_pdf.bat.exe 35 PID 1728 wrote to memory of 2748 1728 RFQ31072024_August order_pdf.bat.exe 35 PID 1728 wrote to memory of 2748 1728 RFQ31072024_August order_pdf.bat.exe 35 PID 1728 wrote to memory of 2748 1728 RFQ31072024_August order_pdf.bat.exe 35 PID 1728 wrote to memory of 2748 1728 RFQ31072024_August order_pdf.bat.exe 35 PID 1204 wrote to memory of 2676 1204 Explorer.EXE 50 PID 1204 wrote to memory of 2676 1204 Explorer.EXE 50 PID 1204 wrote to memory of 2676 1204 Explorer.EXE 50 PID 1204 wrote to memory of 2676 1204 Explorer.EXE 50 PID 2676 wrote to memory of 672 2676 cmmon32.exe 51 PID 2676 wrote to memory of 672 2676 cmmon32.exe 51 PID 2676 wrote to memory of 672 2676 cmmon32.exe 51 PID 2676 wrote to memory of 672 2676 cmmon32.exe 51
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\RFQ31072024_August order_pdf.bat.exe"C:\Users\Admin\AppData\Local\Temp\RFQ31072024_August order_pdf.bat.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WwRzxUm.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WwRzxUm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF20C.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2564
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ31072024_August order_pdf.bat.exe"C:\Users\Admin\AppData\Local\Temp\RFQ31072024_August order_pdf.bat.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2640
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2792
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2692
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2848
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2628
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1712
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2764
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2660
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2712
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2604
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2608
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2616
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2624
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2652
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ31072024_August order_pdf.bat.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:672
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54bbf539c1add3084e4c474af7c8a8af0
SHA100dbb0dc6355cd0d94c77265d77ab3f72b899e65
SHA256c2a13ad3a2f432b07e64ee65c2a5c83e565413af35ef25fc6d21364130403aec
SHA5121916aa46435a636ed4e5ad8e5b4fea7a0c87d0abfe1b1fa8832a4e025c12f400593323ab66c85032b5042dc659c1831a3ca5ef14bf21e54f730fac2126cb0e33