Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2024, 08:21

General

  • Target

    MalwareBazaar.exe

  • Size

    620KB

  • MD5

    035c35bf6a68763ba391504a7c6a4993

  • SHA1

    2fb903b75098baf7d39fdc3db68cfb35e03100e8

  • SHA256

    b731e1e07da1ab601c2773e2124f60e482f30f81bf2d1d64c3363c5d1f4ec08d

  • SHA512

    4c6cbdcfed65bdcf1c37f93d02f6cf0ae839a3ac6016b594ff690a1d24615ba9abdeeb651734bb4b237c8cc9045e91c5ac25e1ed30b7762abe62a93a7170f049

  • SSDEEP

    12288:j4lz4cX9/R3FcFCstoAsfqYFPV7PGuj9zcU/Nk8emr1y6m7H2ph1hRvjndCrkR:jcz4c7eFCseACJhzcU/Nkarub2fJvjdF

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ss24

Decoy

agingwellhc.com

unikbetanggur.autos

eb2024yl.top

ja380.xyz

thehalcyon.studio

maudsoogrim.com

esteler10.click

mewtcp.xyz

www-zjbf1.club

kucinglucu.online

lunwencheck.com

65597.photos

erbxeu358h.top

startable.online

yousend.xyz

csharksg.com

centricoatings.com

ntruhslearn.xyz

achabakra.xyz

zuntool.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
      "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4584
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DUsLon.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3096
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DUsLon" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD63C.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1908
      • C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
        "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
        3⤵
          PID:5064
        • C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
          "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2404
      • C:\Windows\SysWOW64\NETSTAT.EXE
        "C:\Windows\SysWOW64\NETSTAT.EXE"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Gathers network information
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3252
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4084

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0xyupw4g.4hu.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpD63C.tmp

      Filesize

      1KB

      MD5

      3c04b3024ae0eb15a00226704699655f

      SHA1

      7f10125a4f21c5a9279e3d1f939b44cfa4f93473

      SHA256

      50c439e5d85bf4e13fe9e982f684c6d97bb015c5566c5df148d733ea2cb1e3ec

      SHA512

      74d6953b5b77b4c6706d38a359f07b2aec1c0683b900f6a62ceb151ba021997bd325426d3f9ec2d016bb71bdc883c920fd2643759a42703973d29fdf555c07b0

    • memory/2404-38-0x0000000001590000-0x00000000018DA000-memory.dmp

      Filesize

      3.3MB

    • memory/2404-39-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2404-40-0x0000000000FE0000-0x0000000000FF4000-memory.dmp

      Filesize

      80KB

    • memory/2404-27-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3096-16-0x0000000005500000-0x0000000005B28000-memory.dmp

      Filesize

      6.2MB

    • memory/3096-63-0x0000000007990000-0x0000000007A26000-memory.dmp

      Filesize

      600KB

    • memory/3096-72-0x0000000074A40000-0x00000000751F0000-memory.dmp

      Filesize

      7.7MB

    • memory/3096-69-0x0000000007A30000-0x0000000007A38000-memory.dmp

      Filesize

      32KB

    • memory/3096-14-0x0000000002AD0000-0x0000000002B06000-memory.dmp

      Filesize

      216KB

    • memory/3096-68-0x0000000007A50000-0x0000000007A6A000-memory.dmp

      Filesize

      104KB

    • memory/3096-15-0x0000000074A40000-0x00000000751F0000-memory.dmp

      Filesize

      7.7MB

    • memory/3096-67-0x0000000007950000-0x0000000007964000-memory.dmp

      Filesize

      80KB

    • memory/3096-21-0x0000000074A40000-0x00000000751F0000-memory.dmp

      Filesize

      7.7MB

    • memory/3096-65-0x0000000007940000-0x000000000794E000-memory.dmp

      Filesize

      56KB

    • memory/3096-64-0x0000000007910000-0x0000000007921000-memory.dmp

      Filesize

      68KB

    • memory/3096-62-0x0000000007780000-0x000000000778A000-memory.dmp

      Filesize

      40KB

    • memory/3096-61-0x0000000007710000-0x000000000772A000-memory.dmp

      Filesize

      104KB

    • memory/3096-28-0x0000000005E30000-0x0000000006184000-memory.dmp

      Filesize

      3.3MB

    • memory/3096-20-0x0000000005DC0000-0x0000000005E26000-memory.dmp

      Filesize

      408KB

    • memory/3096-19-0x0000000005BA0000-0x0000000005C06000-memory.dmp

      Filesize

      408KB

    • memory/3096-18-0x0000000005430000-0x0000000005452000-memory.dmp

      Filesize

      136KB

    • memory/3096-60-0x0000000007D50000-0x00000000083CA000-memory.dmp

      Filesize

      6.5MB

    • memory/3096-59-0x0000000007610000-0x00000000076B3000-memory.dmp

      Filesize

      652KB

    • memory/3096-56-0x0000000006A10000-0x0000000006A2E000-memory.dmp

      Filesize

      120KB

    • memory/3096-57-0x0000000002B50000-0x0000000002B60000-memory.dmp

      Filesize

      64KB

    • memory/3096-58-0x0000000002B50000-0x0000000002B60000-memory.dmp

      Filesize

      64KB

    • memory/3096-42-0x00000000063F0000-0x000000000640E000-memory.dmp

      Filesize

      120KB

    • memory/3096-43-0x00000000064A0000-0x00000000064EC000-memory.dmp

      Filesize

      304KB

    • memory/3096-44-0x000000007F3A0000-0x000000007F3B0000-memory.dmp

      Filesize

      64KB

    • memory/3096-45-0x00000000069B0000-0x00000000069E2000-memory.dmp

      Filesize

      200KB

    • memory/3096-46-0x00000000752D0000-0x000000007531C000-memory.dmp

      Filesize

      304KB

    • memory/3252-66-0x0000000000E70000-0x0000000000E7B000-memory.dmp

      Filesize

      44KB

    • memory/3252-73-0x00000000012E0000-0x000000000130F000-memory.dmp

      Filesize

      188KB

    • memory/3456-78-0x0000000008350000-0x0000000008456000-memory.dmp

      Filesize

      1.0MB

    • memory/3456-76-0x00000000081E0000-0x0000000008349000-memory.dmp

      Filesize

      1.4MB

    • memory/3456-41-0x00000000081E0000-0x0000000008349000-memory.dmp

      Filesize

      1.4MB

    • memory/4584-5-0x0000000004D80000-0x0000000004D8A000-memory.dmp

      Filesize

      40KB

    • memory/4584-29-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

      Filesize

      4KB

    • memory/4584-7-0x0000000008220000-0x000000000822E000-memory.dmp

      Filesize

      56KB

    • memory/4584-37-0x0000000074A40000-0x00000000751F0000-memory.dmp

      Filesize

      7.7MB

    • memory/4584-4-0x0000000074A40000-0x00000000751F0000-memory.dmp

      Filesize

      7.7MB

    • memory/4584-35-0x0000000074A40000-0x00000000751F0000-memory.dmp

      Filesize

      7.7MB

    • memory/4584-6-0x0000000005000000-0x0000000005016000-memory.dmp

      Filesize

      88KB

    • memory/4584-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

      Filesize

      4KB

    • memory/4584-9-0x0000000008500000-0x000000000859C000-memory.dmp

      Filesize

      624KB

    • memory/4584-8-0x0000000008240000-0x00000000082B6000-memory.dmp

      Filesize

      472KB

    • memory/4584-3-0x0000000004D90000-0x0000000004E22000-memory.dmp

      Filesize

      584KB

    • memory/4584-2-0x00000000052A0000-0x0000000005844000-memory.dmp

      Filesize

      5.6MB

    • memory/4584-1-0x00000000002E0000-0x000000000037E000-memory.dmp

      Filesize

      632KB