Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/08/2024, 01:13

General

  • Target

    09f80e5b22639c198be1ef13793c7a0ade764ed89b20a0f09ab0830f3d77eaef.exe

  • Size

    608KB

  • MD5

    087a92aaf0a59bf4f54fafaae7b6a027

  • SHA1

    a00135a4131ee743347f0ca3b3ac14427d008360

  • SHA256

    09f80e5b22639c198be1ef13793c7a0ade764ed89b20a0f09ab0830f3d77eaef

  • SHA512

    3647d3c39bf93e5d6b429392296e469218d855e41894545a91fd51a5dbae5830784506a4c224e106824131e312c47944cf07b23b594d6de5e0b5eabec5cf5d1f

  • SSDEEP

    12288:VV8wtNDc2pZ/Mrr8ya2DG/ARyQg5f5Yk/Z3qOoUD6QA:fFcmZErIZ0zg59R3qNAl

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

as89

Decoy

followcb.site

salutemanagement.com

shishiganggang.com

vanthuhay.xyz

nujekos.info

duckylucknodepositbonus.icu

ilemuelgroup.com

healnap.com

rezekitoto41.com

magicians-amino.click

fqr4dh.club

00050153.xyz

touchless-scoreboard.com

journaganstruevalue.com

connectingconcepts.biz

winraja88.com

mezcantina.com

cosmosfashions.com

dltholdingsandinvestments.com

vonlineb.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09f80e5b22639c198be1ef13793c7a0ade764ed89b20a0f09ab0830f3d77eaef.exe
    "C:\Users\Admin\AppData\Local\Temp\09f80e5b22639c198be1ef13793c7a0ade764ed89b20a0f09ab0830f3d77eaef.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\09f80e5b22639c198be1ef13793c7a0ade764ed89b20a0f09ab0830f3d77eaef.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4736
    • C:\Users\Admin\AppData\Local\Temp\09f80e5b22639c198be1ef13793c7a0ade764ed89b20a0f09ab0830f3d77eaef.exe
      "C:\Users\Admin\AppData\Local\Temp\09f80e5b22639c198be1ef13793c7a0ade764ed89b20a0f09ab0830f3d77eaef.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fo3fql0g.vnh.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2232-6-0x0000000005AC0000-0x0000000005AD0000-memory.dmp

    Filesize

    64KB

  • memory/2232-2-0x0000000005B30000-0x00000000060D4000-memory.dmp

    Filesize

    5.6MB

  • memory/2232-3-0x0000000005480000-0x0000000005512000-memory.dmp

    Filesize

    584KB

  • memory/2232-4-0x0000000005470000-0x000000000547A000-memory.dmp

    Filesize

    40KB

  • memory/2232-5-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/2232-1-0x00000000009E0000-0x0000000000A7E000-memory.dmp

    Filesize

    632KB

  • memory/2232-7-0x0000000005AE0000-0x0000000005AEC000-memory.dmp

    Filesize

    48KB

  • memory/2232-8-0x00000000066E0000-0x0000000006756000-memory.dmp

    Filesize

    472KB

  • memory/2232-9-0x000000000C680000-0x000000000C71C000-memory.dmp

    Filesize

    624KB

  • memory/2232-12-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/2232-0-0x00000000749DE000-0x00000000749DF000-memory.dmp

    Filesize

    4KB

  • memory/2876-10-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2876-13-0x0000000000F30000-0x000000000127A000-memory.dmp

    Filesize

    3.3MB

  • memory/4736-27-0x0000000005ED0000-0x0000000006224000-memory.dmp

    Filesize

    3.3MB

  • memory/4736-35-0x0000000070870000-0x00000000708BC000-memory.dmp

    Filesize

    304KB

  • memory/4736-17-0x0000000005530000-0x0000000005552000-memory.dmp

    Filesize

    136KB

  • memory/4736-25-0x0000000074A50000-0x0000000075200000-memory.dmp

    Filesize

    7.7MB

  • memory/4736-26-0x0000000074A50000-0x0000000075200000-memory.dmp

    Filesize

    7.7MB

  • memory/4736-15-0x0000000074A5E000-0x0000000074A5F000-memory.dmp

    Filesize

    4KB

  • memory/4736-14-0x0000000002BC0000-0x0000000002BF6000-memory.dmp

    Filesize

    216KB

  • memory/4736-19-0x0000000005740000-0x00000000057A6000-memory.dmp

    Filesize

    408KB

  • memory/4736-18-0x00000000056D0000-0x0000000005736000-memory.dmp

    Filesize

    408KB

  • memory/4736-32-0x00000000064E0000-0x00000000064FE000-memory.dmp

    Filesize

    120KB

  • memory/4736-33-0x0000000006570000-0x00000000065BC000-memory.dmp

    Filesize

    304KB

  • memory/4736-34-0x0000000006A90000-0x0000000006AC2000-memory.dmp

    Filesize

    200KB

  • memory/4736-36-0x0000000074A50000-0x0000000075200000-memory.dmp

    Filesize

    7.7MB

  • memory/4736-16-0x0000000005860000-0x0000000005E88000-memory.dmp

    Filesize

    6.2MB

  • memory/4736-47-0x00000000074F0000-0x0000000007593000-memory.dmp

    Filesize

    652KB

  • memory/4736-48-0x0000000074A50000-0x0000000075200000-memory.dmp

    Filesize

    7.7MB

  • memory/4736-46-0x00000000074D0000-0x00000000074EE000-memory.dmp

    Filesize

    120KB

  • memory/4736-49-0x0000000074A50000-0x0000000075200000-memory.dmp

    Filesize

    7.7MB

  • memory/4736-50-0x0000000007E70000-0x00000000084EA000-memory.dmp

    Filesize

    6.5MB

  • memory/4736-51-0x0000000007830000-0x000000000784A000-memory.dmp

    Filesize

    104KB

  • memory/4736-52-0x00000000078A0000-0x00000000078AA000-memory.dmp

    Filesize

    40KB

  • memory/4736-53-0x0000000007AB0000-0x0000000007B46000-memory.dmp

    Filesize

    600KB

  • memory/4736-54-0x0000000007A30000-0x0000000007A41000-memory.dmp

    Filesize

    68KB

  • memory/4736-55-0x0000000007A60000-0x0000000007A6E000-memory.dmp

    Filesize

    56KB

  • memory/4736-56-0x0000000007A70000-0x0000000007A84000-memory.dmp

    Filesize

    80KB

  • memory/4736-57-0x0000000007B70000-0x0000000007B8A000-memory.dmp

    Filesize

    104KB

  • memory/4736-58-0x0000000007B50000-0x0000000007B58000-memory.dmp

    Filesize

    32KB

  • memory/4736-60-0x0000000074A50000-0x0000000075200000-memory.dmp

    Filesize

    7.7MB