Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2024, 08:21
Static task
static1
Behavioral task
behavioral1
Sample
MalwareBazaar.exe
Resource
win7-20240704-en
General
-
Target
MalwareBazaar.exe
-
Size
620KB
-
MD5
035c35bf6a68763ba391504a7c6a4993
-
SHA1
2fb903b75098baf7d39fdc3db68cfb35e03100e8
-
SHA256
b731e1e07da1ab601c2773e2124f60e482f30f81bf2d1d64c3363c5d1f4ec08d
-
SHA512
4c6cbdcfed65bdcf1c37f93d02f6cf0ae839a3ac6016b594ff690a1d24615ba9abdeeb651734bb4b237c8cc9045e91c5ac25e1ed30b7762abe62a93a7170f049
-
SSDEEP
12288:j4lz4cX9/R3FcFCstoAsfqYFPV7PGuj9zcU/Nk8emr1y6m7H2ph1hRvjndCrkR:jcz4c7eFCseACJhzcU/Nkarub2fJvjdF
Malware Config
Extracted
formbook
4.1
ss24
agingwellhc.com
unikbetanggur.autos
eb2024yl.top
ja380.xyz
thehalcyon.studio
maudsoogrim.com
esteler10.click
mewtcp.xyz
www-zjbf1.club
kucinglucu.online
lunwencheck.com
65597.photos
erbxeu358h.top
startable.online
yousend.xyz
csharksg.com
centricoatings.com
ntruhslearn.xyz
achabakra.xyz
zuntool.com
jejbtl738a.top
runebinder.com
fidogmesvies170s63.online
online-unicsedritcorp.com
8208975.com
supporthq.life
protocolozeroacne.com
ocotilloco.com
xcolbu456t.xyz
ciclidossi.com
163875.shop
strangebedfellowstheatre.com
unikbetjeruk.homes
jhlktwyq.xyz
realearthpower.com
crucka.xyz
pkvnvtdb.com
profitablecasino.com
uspspsnami.top
thejerkspices.com
sivagiriashram.info
usavisa8loan.xyz
deoconverter.pro
investing-courses-66663.bond
2025tengxun171.lat
bluebirdbodyworkstudio.com
siblingstalk.com
lxcqx.com
amharicprofessional.pro
lijiangstory.net
barflybook.com
eldesigin.com
yd81w.top
head2toe.boutique
varun.works
next-genlion.com
awvd97.com
derindenizotel.com
vertibridge.xyz
qdfake609am.xyz
acc-pay.top
qblackbit.com
pallesudatissime.com
8548d.com
ygyqpswy.xyz
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/2404-27-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2404-39-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3252-73-0x00000000012E0000-0x000000000130F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3096 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1266786182-1874524688-71015548-1000\Control Panel\International\Geo\Nation MalwareBazaar.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4584 set thread context of 2404 4584 MalwareBazaar.exe 91 PID 2404 set thread context of 3456 2404 MalwareBazaar.exe 55 PID 3252 set thread context of 3456 3252 NETSTAT.EXE 55 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MalwareBazaar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3252 NETSTAT.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1908 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3096 powershell.exe 4584 MalwareBazaar.exe 4584 MalwareBazaar.exe 2404 MalwareBazaar.exe 2404 MalwareBazaar.exe 2404 MalwareBazaar.exe 2404 MalwareBazaar.exe 3096 powershell.exe 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE 3252 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2404 MalwareBazaar.exe 2404 MalwareBazaar.exe 2404 MalwareBazaar.exe 3252 NETSTAT.EXE 3252 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3096 powershell.exe Token: SeDebugPrivilege 4584 MalwareBazaar.exe Token: SeDebugPrivilege 2404 MalwareBazaar.exe Token: SeDebugPrivilege 3252 NETSTAT.EXE Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3456 Explorer.EXE 3456 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3456 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4584 wrote to memory of 3096 4584 MalwareBazaar.exe 86 PID 4584 wrote to memory of 3096 4584 MalwareBazaar.exe 86 PID 4584 wrote to memory of 3096 4584 MalwareBazaar.exe 86 PID 4584 wrote to memory of 1908 4584 MalwareBazaar.exe 88 PID 4584 wrote to memory of 1908 4584 MalwareBazaar.exe 88 PID 4584 wrote to memory of 1908 4584 MalwareBazaar.exe 88 PID 4584 wrote to memory of 5064 4584 MalwareBazaar.exe 90 PID 4584 wrote to memory of 5064 4584 MalwareBazaar.exe 90 PID 4584 wrote to memory of 5064 4584 MalwareBazaar.exe 90 PID 4584 wrote to memory of 2404 4584 MalwareBazaar.exe 91 PID 4584 wrote to memory of 2404 4584 MalwareBazaar.exe 91 PID 4584 wrote to memory of 2404 4584 MalwareBazaar.exe 91 PID 4584 wrote to memory of 2404 4584 MalwareBazaar.exe 91 PID 4584 wrote to memory of 2404 4584 MalwareBazaar.exe 91 PID 4584 wrote to memory of 2404 4584 MalwareBazaar.exe 91 PID 3456 wrote to memory of 3252 3456 Explorer.EXE 92 PID 3456 wrote to memory of 3252 3456 Explorer.EXE 92 PID 3456 wrote to memory of 3252 3456 Explorer.EXE 92 PID 3252 wrote to memory of 4084 3252 NETSTAT.EXE 93 PID 3252 wrote to memory of 4084 3252 NETSTAT.EXE 93 PID 3252 wrote to memory of 4084 3252 NETSTAT.EXE 93
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DUsLon.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DUsLon" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD63C.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1908
-
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵PID:5064
-
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4084
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD53c04b3024ae0eb15a00226704699655f
SHA17f10125a4f21c5a9279e3d1f939b44cfa4f93473
SHA25650c439e5d85bf4e13fe9e982f684c6d97bb015c5566c5df148d733ea2cb1e3ec
SHA51274d6953b5b77b4c6706d38a359f07b2aec1c0683b900f6a62ceb151ba021997bd325426d3f9ec2d016bb71bdc883c920fd2643759a42703973d29fdf555c07b0