Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 06:45
Static task
static1
Behavioral task
behavioral1
Sample
Narudžbenica 08BIH2024.exe
Resource
win7-20240729-en
General
-
Target
Narudžbenica 08BIH2024.exe
-
Size
656KB
-
MD5
dae6a17dd50c76b58fb2c7d980e801d9
-
SHA1
8b1fce08ff057639bd4eb7ebd6231417569b6494
-
SHA256
60bc892c0d2392091394c2ba22701447e399860c4b8d9a0dee014db3da78b1a6
-
SHA512
9453a2389c54b524adfeee11bf90284168b2fff30c7c962fe48cdc3e7e1c893dfc45a64107067900440834be95f0cf02e83c7c7a8c2e673a2d73ef311f6bda04
-
SSDEEP
12288:2M23a/zmcDXmxqPbKwII+foXlIHdHfQJkE1ij7qObjjTCYT59Whpehsh9kR:2V3aakXenBmSokE1ivcGshhg
Malware Config
Extracted
formbook
4.1
md02
onsen1508.com
partymaxclubmen36.click
texasshelvingwarehouse.com
tiantiying.com
taxcredits-pr.com
33mgbet.com
equipoleiremnacional.com
andrewghita.com
zbbnp.xyz
englandbreaking.com
a1b5v.xyz
vizamag.com
h0lg3.rest
ux-design-courses-17184.bond
of84.top
qqkartel88v1.com
avalynkate.com
cpuk-finance.com
yeslabs.xyz
webuyandsellpa.com
barnesassetrecovery.store
hecxion.xyz
theopencomputeproject.net
breezyvw.christmas
mumazyl.com
woby.xyz
jalaios10.vip
lynxpire.com
sparkbpo.com
333689z.com
rslotrank.win
adscendmfmarketing.com
detroitreels.com
xojiliv1.com
mzhhxxff.xyz
hitcomply.com
piedge-taiko.net
chiri.lat
bookmygaddi.com
hjemfinesse.shop
zruypj169g.top
solarfundis.com
pittsparking.com
teplo-invest.com
j3k7n.xyz
coloradoskinwellness.com
z8ggd.com
coinbureau.xyz
mamasprinkleofjoy.com
xotj7a.xyz
nijssenadventures.com
ysa-cn.com
tigajco69.fun
localhomeservicesadvisor.com
attorney-services-8344642.zone
rnwaifu.xyz
nyverian.com
family-lawyers-7009103.world
117myw.com
kingdom66.lat
tdshomesolution.com
momof2filiricans.com
saeutah.com
rakring.com
upcyclecharms.com
Signatures
-
Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/2752-35-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4892-91-0x00000000001A0000-0x00000000001CF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4444 powershell.exe 1640 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation Narudžbenica 08BIH2024.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4712 set thread context of 2752 4712 Narudžbenica 08BIH2024.exe 94 PID 2752 set thread context of 3380 2752 RegSvcs.exe 56 PID 4892 set thread context of 3380 4892 systray.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Narudžbenica 08BIH2024.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1540 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 4712 Narudžbenica 08BIH2024.exe 4712 Narudžbenica 08BIH2024.exe 1640 powershell.exe 4444 powershell.exe 4712 Narudžbenica 08BIH2024.exe 2752 RegSvcs.exe 2752 RegSvcs.exe 2752 RegSvcs.exe 2752 RegSvcs.exe 1640 powershell.exe 4444 powershell.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe 4892 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2752 RegSvcs.exe 2752 RegSvcs.exe 2752 RegSvcs.exe 4892 systray.exe 4892 systray.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 4712 Narudžbenica 08BIH2024.exe Token: SeDebugPrivilege 1640 powershell.exe Token: SeDebugPrivilege 4444 powershell.exe Token: SeDebugPrivilege 2752 RegSvcs.exe Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE Token: SeDebugPrivilege 4892 systray.exe Token: SeShutdownPrivilege 3380 Explorer.EXE Token: SeCreatePagefilePrivilege 3380 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3380 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4712 wrote to memory of 1640 4712 Narudžbenica 08BIH2024.exe 88 PID 4712 wrote to memory of 1640 4712 Narudžbenica 08BIH2024.exe 88 PID 4712 wrote to memory of 1640 4712 Narudžbenica 08BIH2024.exe 88 PID 4712 wrote to memory of 4444 4712 Narudžbenica 08BIH2024.exe 90 PID 4712 wrote to memory of 4444 4712 Narudžbenica 08BIH2024.exe 90 PID 4712 wrote to memory of 4444 4712 Narudžbenica 08BIH2024.exe 90 PID 4712 wrote to memory of 1540 4712 Narudžbenica 08BIH2024.exe 92 PID 4712 wrote to memory of 1540 4712 Narudžbenica 08BIH2024.exe 92 PID 4712 wrote to memory of 1540 4712 Narudžbenica 08BIH2024.exe 92 PID 4712 wrote to memory of 2752 4712 Narudžbenica 08BIH2024.exe 94 PID 4712 wrote to memory of 2752 4712 Narudžbenica 08BIH2024.exe 94 PID 4712 wrote to memory of 2752 4712 Narudžbenica 08BIH2024.exe 94 PID 4712 wrote to memory of 2752 4712 Narudžbenica 08BIH2024.exe 94 PID 4712 wrote to memory of 2752 4712 Narudžbenica 08BIH2024.exe 94 PID 4712 wrote to memory of 2752 4712 Narudžbenica 08BIH2024.exe 94 PID 3380 wrote to memory of 4892 3380 Explorer.EXE 96 PID 3380 wrote to memory of 4892 3380 Explorer.EXE 96 PID 3380 wrote to memory of 4892 3380 Explorer.EXE 96 PID 4892 wrote to memory of 3304 4892 systray.exe 97 PID 4892 wrote to memory of 3304 4892 systray.exe 97 PID 4892 wrote to memory of 3304 4892 systray.exe 97
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\Narudžbenica 08BIH2024.exe"C:\Users\Admin\AppData\Local\Temp\Narudžbenica 08BIH2024.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Narudžbenica 08BIH2024.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BGELwANFeozDW.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BGELwANFeozDW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAB9.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1540
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1852
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3304
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD50a2b16377f31e63412cc18d3038eec01
SHA15e7336f0140b447b39212457fd04f0c1218b3d6b
SHA2568a2cc14c2ec61069693c176aacacb00bc8026de03c43fedb896c26431b87cb1b
SHA5120ba1961621fa17b8ef0c0fe9728993a40bac3a4adae2f41aa85b8f5103b9541cb5bc9fa9a39d055fc883dc96be83cc0e280f09bb8c02b2a3e2acf0a9020b273d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5aee54b5afc0db61212e25e14098941bc
SHA1fcff1e4cfadc14ab005dc486e0866d5463df7370
SHA256618d2bd482c3a2b5d7fce534870e262f3b882db36ecd5b9a8c76e856b2a41372
SHA512e450944e0689245d3a31450786099083d2d019f1c661246ddbb9b76fe7982fbbb8e8f8f85b16ad28bd94c7a10476077dcb883ebcbd0dade3dff7b35de7484fb5