Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2024, 08:31

General

  • Target

    MalwareBazaar.exe

  • Size

    651KB

  • MD5

    622fec48546a83b6c146074a7c6de40d

  • SHA1

    3cc90d360795455fa69b6bf12ccf36ae0e09106e

  • SHA256

    a96c7253cab161d289efdea709091608649deeb1423a4df65d1cd13ad28642ae

  • SHA512

    fe3048d55396bfea180146a37225cd42f8bcc21cf56cec063f02fb5a48b52bf9f316a072adb6733fc52488b21987d4f19b0262010cc1caa803343785892bed04

  • SSDEEP

    12288:3tJ6BgKTNRh02gF64s3leiYpIRsLI4L0i/xgQnrQstn8CMEaSLIMz+t:3tJofHgF83siW04L0i/xgKftn8CMEpLy

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

de94

Decoy

gx899.top

whoistommy.info

vabex.shop

vduwum.rest

betbox2351.com

ch3kat0.online

kaduexpress.com

sibonline.shop

bt365918.com

betterlabs.app

denversandandgravel.net

webzlp.xyz

tdodtn263q.xyz

zamaninvest.com

vcxwpo.xyz

myastrolyfe.com

lsm8v87jnkrqcnr.buzz

ilregnodellecozze.com

auroraskynholistics.com

sewassist.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Formbook payload 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3468
    • C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
      "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:956
      • C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
        "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3244
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Windows\SysWOW64\cmd.exe
        /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
        3⤵
        • System Location Discovery: System Language Discovery
        PID:540
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:4052

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\DB1

      Filesize

      40KB

      MD5

      a182561a527f929489bf4b8f74f65cd7

      SHA1

      8cd6866594759711ea1836e86a5b7ca64ee8911f

      SHA256

      42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

      SHA512

      9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

    • C:\Users\Admin\AppData\Roaming\KNPQ4AV3\KNPlogim.jpeg

      Filesize

      76KB

      MD5

      2ca51d0a1eb381aefb7b0d0685deb14d

      SHA1

      bcd212a6d5a74718b5b92cc85f9c1177977c8f9d

      SHA256

      30da8a3fa2d93e3761bd3e8feb812304dd1bcf097253538be02d06f6bebc2188

      SHA512

      7a7d85f799b2f655b2b28ef8dc19fc26884b3351db9b274c4ef32805a80906e7c5a622b65e96ac614bfb847ad8813592167e52ff0bf25df668422acbbe794f65

    • C:\Users\Admin\AppData\Roaming\KNPQ4AV3\KNPlogrf.ini

      Filesize

      40B

      MD5

      2f245469795b865bdd1b956c23d7893d

      SHA1

      6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

      SHA256

      1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

      SHA512

      909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

    • C:\Users\Admin\AppData\Roaming\KNPQ4AV3\KNPlogrg.ini

      Filesize

      38B

      MD5

      4aadf49fed30e4c9b3fe4a3dd6445ebe

      SHA1

      1e332822167c6f351b99615eada2c30a538ff037

      SHA256

      75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

      SHA512

      eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

    • C:\Users\Admin\AppData\Roaming\KNPQ4AV3\KNPlogri.ini

      Filesize

      40B

      MD5

      d63a82e5d81e02e399090af26db0b9cb

      SHA1

      91d0014c8f54743bba141fd60c9d963f869d76c9

      SHA256

      eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

      SHA512

      38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

    • C:\Users\Admin\AppData\Roaming\KNPQ4AV3\KNPlogrv.ini

      Filesize

      872B

      MD5

      bbc41c78bae6c71e63cb544a6a284d94

      SHA1

      33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

      SHA256

      ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

      SHA512

      0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

    • memory/956-7-0x00000000069F0000-0x00000000069FE000-memory.dmp

      Filesize

      56KB

    • memory/956-5-0x0000000074DD0000-0x0000000075580000-memory.dmp

      Filesize

      7.7MB

    • memory/956-8-0x0000000006A20000-0x0000000006A96000-memory.dmp

      Filesize

      472KB

    • memory/956-9-0x0000000006CE0000-0x0000000006D7C000-memory.dmp

      Filesize

      624KB

    • memory/956-2-0x0000000005D40000-0x00000000062E4000-memory.dmp

      Filesize

      5.6MB

    • memory/956-12-0x0000000074DD0000-0x0000000075580000-memory.dmp

      Filesize

      7.7MB

    • memory/956-6-0x0000000005D30000-0x0000000005D42000-memory.dmp

      Filesize

      72KB

    • memory/956-3-0x0000000005870000-0x0000000005902000-memory.dmp

      Filesize

      584KB

    • memory/956-0-0x0000000074DDE000-0x0000000074DDF000-memory.dmp

      Filesize

      4KB

    • memory/956-4-0x0000000005930000-0x000000000593A000-memory.dmp

      Filesize

      40KB

    • memory/956-1-0x0000000000F20000-0x0000000000FC8000-memory.dmp

      Filesize

      672KB

    • memory/1312-18-0x0000000000570000-0x0000000000597000-memory.dmp

      Filesize

      156KB

    • memory/1312-20-0x00000000005A0000-0x00000000005CF000-memory.dmp

      Filesize

      188KB

    • memory/1312-19-0x0000000000570000-0x0000000000597000-memory.dmp

      Filesize

      156KB

    • memory/3244-15-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3244-16-0x00000000017B0000-0x00000000017C5000-memory.dmp

      Filesize

      84KB

    • memory/3244-13-0x00000000018A0000-0x0000000001BEA000-memory.dmp

      Filesize

      3.3MB

    • memory/3244-10-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3468-39-0x0000000003120000-0x0000000003200000-memory.dmp

      Filesize

      896KB

    • memory/3468-40-0x0000000003120000-0x0000000003200000-memory.dmp

      Filesize

      896KB

    • memory/3468-36-0x0000000008680000-0x00000000087C4000-memory.dmp

      Filesize

      1.3MB

    • memory/3468-17-0x0000000008680000-0x00000000087C4000-memory.dmp

      Filesize

      1.3MB

    • memory/3468-48-0x0000000003120000-0x0000000003200000-memory.dmp

      Filesize

      896KB