Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2024, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
MalwareBazaar.exe
Resource
win7-20240705-en
General
-
Target
MalwareBazaar.exe
-
Size
651KB
-
MD5
622fec48546a83b6c146074a7c6de40d
-
SHA1
3cc90d360795455fa69b6bf12ccf36ae0e09106e
-
SHA256
a96c7253cab161d289efdea709091608649deeb1423a4df65d1cd13ad28642ae
-
SHA512
fe3048d55396bfea180146a37225cd42f8bcc21cf56cec063f02fb5a48b52bf9f316a072adb6733fc52488b21987d4f19b0262010cc1caa803343785892bed04
-
SSDEEP
12288:3tJ6BgKTNRh02gF64s3leiYpIRsLI4L0i/xgQnrQstn8CMEaSLIMz+t:3tJofHgF83siW04L0i/xgKftn8CMEpLy
Malware Config
Extracted
formbook
4.1
de94
gx899.top
whoistommy.info
vabex.shop
vduwum.rest
betbox2351.com
ch3kat0.online
kaduexpress.com
sibonline.shop
bt365918.com
betterlabs.app
denversandandgravel.net
webzlp.xyz
tdodtn263q.xyz
zamaninvest.com
vcxwpo.xyz
myastrolyfe.com
lsm8v87jnkrqcnr.buzz
ilregnodellecozze.com
auroraskynholistics.com
sewassist.com
trafficbomber.com
grupocontigoalimentacion.com
game845.bet
amandaaustininteriors.com
shucka.xyz
sa98hd.xyz
yewlmfxt.xyz
soumayagreendevelopers.online
ciaochowciao.com
datafocuslab.com
jastastringfestival2023.com
bonktate.com
ko66.services
176981243862439370.xyz
socradex.com
utxlq6q.fun
bbsbras.com
phoenix-partners.net
whi.info
kingkong212.online
snapdashers.com
socalpropertymanagers.com
www843xz11.com
jihanshop.com
marillyaffewedding.com
grouplearning.net
bot888.vip
rdljx.com
pragmajobs.com
wakeywakey.xyz
cueconsultants.com
prosportsjourney.com
tetesa.xyz
velocimeterep.com
ltjlh.com
beton24naro-fominsk.online
firstcitypr.com
tires-fast.store
li00.icu
pinkineverything.com
jvkw3r8qi6kf67e.buzz
yc92w.top
gk64.top
176123.photos
azublog1.com
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/3244-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3244-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1312-20-0x00000000005A0000-0x00000000005CF000-memory.dmp formbook -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 956 set thread context of 3244 956 MalwareBazaar.exe 86 PID 3244 set thread context of 3468 3244 MalwareBazaar.exe 56 PID 1312 set thread context of 3468 1312 cscript.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MalwareBazaar.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2951562807-3718269429-4208157415-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 3244 MalwareBazaar.exe 3244 MalwareBazaar.exe 3244 MalwareBazaar.exe 3244 MalwareBazaar.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3244 MalwareBazaar.exe 3244 MalwareBazaar.exe 3244 MalwareBazaar.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe 1312 cscript.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3244 MalwareBazaar.exe Token: SeDebugPrivilege 1312 cscript.exe Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3468 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 956 wrote to memory of 3244 956 MalwareBazaar.exe 86 PID 956 wrote to memory of 3244 956 MalwareBazaar.exe 86 PID 956 wrote to memory of 3244 956 MalwareBazaar.exe 86 PID 956 wrote to memory of 3244 956 MalwareBazaar.exe 86 PID 956 wrote to memory of 3244 956 MalwareBazaar.exe 86 PID 956 wrote to memory of 3244 956 MalwareBazaar.exe 86 PID 3468 wrote to memory of 1312 3468 Explorer.EXE 87 PID 3468 wrote to memory of 1312 3468 Explorer.EXE 87 PID 3468 wrote to memory of 1312 3468 Explorer.EXE 87 PID 1312 wrote to memory of 540 1312 cscript.exe 88 PID 1312 wrote to memory of 540 1312 cscript.exe 88 PID 1312 wrote to memory of 540 1312 cscript.exe 88 PID 1312 wrote to memory of 4052 1312 cscript.exe 90 PID 1312 wrote to memory of 4052 1312 cscript.exe 90 PID 1312 wrote to memory of 4052 1312 cscript.exe 90
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
- System Location Discovery: System Language Discovery
PID:540
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4052
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5a182561a527f929489bf4b8f74f65cd7
SHA18cd6866594759711ea1836e86a5b7ca64ee8911f
SHA25642aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA5129bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
-
Filesize
76KB
MD52ca51d0a1eb381aefb7b0d0685deb14d
SHA1bcd212a6d5a74718b5b92cc85f9c1177977c8f9d
SHA25630da8a3fa2d93e3761bd3e8feb812304dd1bcf097253538be02d06f6bebc2188
SHA5127a7d85f799b2f655b2b28ef8dc19fc26884b3351db9b274c4ef32805a80906e7c5a622b65e96ac614bfb847ad8813592167e52ff0bf25df668422acbbe794f65
-
Filesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
Filesize
38B
MD54aadf49fed30e4c9b3fe4a3dd6445ebe
SHA11e332822167c6f351b99615eada2c30a538ff037
SHA25675034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
SHA512eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
872B
MD5bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4