Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 06:45

General

  • Target

    Narudžbenica 08BIH2024.exe

  • Size

    656KB

  • MD5

    dae6a17dd50c76b58fb2c7d980e801d9

  • SHA1

    8b1fce08ff057639bd4eb7ebd6231417569b6494

  • SHA256

    60bc892c0d2392091394c2ba22701447e399860c4b8d9a0dee014db3da78b1a6

  • SHA512

    9453a2389c54b524adfeee11bf90284168b2fff30c7c962fe48cdc3e7e1c893dfc45a64107067900440834be95f0cf02e83c7c7a8c2e673a2d73ef311f6bda04

  • SSDEEP

    12288:2M23a/zmcDXmxqPbKwII+foXlIHdHfQJkE1ij7qObjjTCYT59Whpehsh9kR:2V3aakXenBmSokE1ivcGshhg

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

md02

Decoy

onsen1508.com

partymaxclubmen36.click

texasshelvingwarehouse.com

tiantiying.com

taxcredits-pr.com

33mgbet.com

equipoleiremnacional.com

andrewghita.com

zbbnp.xyz

englandbreaking.com

a1b5v.xyz

vizamag.com

h0lg3.rest

ux-design-courses-17184.bond

of84.top

qqkartel88v1.com

avalynkate.com

cpuk-finance.com

yeslabs.xyz

webuyandsellpa.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Users\Admin\AppData\Local\Temp\Narudžbenica 08BIH2024.exe
      "C:\Users\Admin\AppData\Local\Temp\Narudžbenica 08BIH2024.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Narudžbenica 08BIH2024.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1640
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BGELwANFeozDW.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4444
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BGELwANFeozDW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAB9.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1540
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2752
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:1852
      • C:\Windows\SysWOW64\systray.exe
        "C:\Windows\SysWOW64\systray.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4892
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3304

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      0a2b16377f31e63412cc18d3038eec01

      SHA1

      5e7336f0140b447b39212457fd04f0c1218b3d6b

      SHA256

      8a2cc14c2ec61069693c176aacacb00bc8026de03c43fedb896c26431b87cb1b

      SHA512

      0ba1961621fa17b8ef0c0fe9728993a40bac3a4adae2f41aa85b8f5103b9541cb5bc9fa9a39d055fc883dc96be83cc0e280f09bb8c02b2a3e2acf0a9020b273d

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qn32acb5.gda.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpAB9.tmp

      Filesize

      1KB

      MD5

      aee54b5afc0db61212e25e14098941bc

      SHA1

      fcff1e4cfadc14ab005dc486e0866d5463df7370

      SHA256

      618d2bd482c3a2b5d7fce534870e262f3b882db36ecd5b9a8c76e856b2a41372

      SHA512

      e450944e0689245d3a31450786099083d2d019f1c661246ddbb9b76fe7982fbbb8e8f8f85b16ad28bd94c7a10476077dcb883ebcbd0dade3dff7b35de7484fb5

    • memory/1640-50-0x00000000062E0000-0x000000000632C000-memory.dmp

      Filesize

      304KB

    • memory/1640-16-0x0000000005360000-0x0000000005988000-memory.dmp

      Filesize

      6.2MB

    • memory/1640-81-0x0000000007920000-0x000000000793A000-memory.dmp

      Filesize

      104KB

    • memory/1640-78-0x00000000077E0000-0x00000000077F1000-memory.dmp

      Filesize

      68KB

    • memory/1640-75-0x00000000075E0000-0x00000000075FA000-memory.dmp

      Filesize

      104KB

    • memory/1640-63-0x00000000750F0000-0x000000007513C000-memory.dmp

      Filesize

      304KB

    • memory/1640-34-0x0000000074860000-0x0000000075010000-memory.dmp

      Filesize

      7.7MB

    • memory/1640-15-0x0000000004CE0000-0x0000000004D16000-memory.dmp

      Filesize

      216KB

    • memory/1640-17-0x0000000074860000-0x0000000075010000-memory.dmp

      Filesize

      7.7MB

    • memory/1640-82-0x0000000007900000-0x0000000007908000-memory.dmp

      Filesize

      32KB

    • memory/1640-18-0x0000000074860000-0x0000000075010000-memory.dmp

      Filesize

      7.7MB

    • memory/1640-20-0x00000000052F0000-0x0000000005312000-memory.dmp

      Filesize

      136KB

    • memory/1640-88-0x0000000074860000-0x0000000075010000-memory.dmp

      Filesize

      7.7MB

    • memory/1640-22-0x0000000005A70000-0x0000000005AD6000-memory.dmp

      Filesize

      408KB

    • memory/1640-33-0x0000000005D60000-0x00000000060B4000-memory.dmp

      Filesize

      3.3MB

    • memory/1640-21-0x0000000005A00000-0x0000000005A66000-memory.dmp

      Filesize

      408KB

    • memory/2752-35-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3380-94-0x0000000008AF0000-0x0000000008C5E000-memory.dmp

      Filesize

      1.4MB

    • memory/4444-29-0x0000000074860000-0x0000000075010000-memory.dmp

      Filesize

      7.7MB

    • memory/4444-76-0x0000000007C20000-0x0000000007C2A000-memory.dmp

      Filesize

      40KB

    • memory/4444-89-0x0000000074860000-0x0000000075010000-memory.dmp

      Filesize

      7.7MB

    • memory/4444-80-0x0000000007DF0000-0x0000000007E04000-memory.dmp

      Filesize

      80KB

    • memory/4444-49-0x0000000006310000-0x000000000632E000-memory.dmp

      Filesize

      120KB

    • memory/4444-79-0x0000000007DE0000-0x0000000007DEE000-memory.dmp

      Filesize

      56KB

    • memory/4444-51-0x0000000007A50000-0x0000000007A82000-memory.dmp

      Filesize

      200KB

    • memory/4444-36-0x0000000074860000-0x0000000075010000-memory.dmp

      Filesize

      7.7MB

    • memory/4444-62-0x0000000006E30000-0x0000000006E4E000-memory.dmp

      Filesize

      120KB

    • memory/4444-52-0x00000000750F0000-0x000000007513C000-memory.dmp

      Filesize

      304KB

    • memory/4444-73-0x0000000007AA0000-0x0000000007B43000-memory.dmp

      Filesize

      652KB

    • memory/4444-74-0x00000000081F0000-0x000000000886A000-memory.dmp

      Filesize

      6.5MB

    • memory/4444-77-0x0000000007E30000-0x0000000007EC6000-memory.dmp

      Filesize

      600KB

    • memory/4712-9-0x0000000009060000-0x00000000090D6000-memory.dmp

      Filesize

      472KB

    • memory/4712-0-0x000000007486E000-0x000000007486F000-memory.dmp

      Filesize

      4KB

    • memory/4712-7-0x0000000005530000-0x000000000553E000-memory.dmp

      Filesize

      56KB

    • memory/4712-10-0x000000000C170000-0x000000000C20C000-memory.dmp

      Filesize

      624KB

    • memory/4712-48-0x0000000074860000-0x0000000075010000-memory.dmp

      Filesize

      7.7MB

    • memory/4712-6-0x0000000005460000-0x0000000005478000-memory.dmp

      Filesize

      96KB

    • memory/4712-5-0x0000000074860000-0x0000000075010000-memory.dmp

      Filesize

      7.7MB

    • memory/4712-8-0x0000000005550000-0x0000000005566000-memory.dmp

      Filesize

      88KB

    • memory/4712-4-0x00000000052B0000-0x00000000052BA000-memory.dmp

      Filesize

      40KB

    • memory/4712-3-0x0000000005330000-0x00000000053C2000-memory.dmp

      Filesize

      584KB

    • memory/4712-2-0x0000000005840000-0x0000000005DE4000-memory.dmp

      Filesize

      5.6MB

    • memory/4712-1-0x0000000000860000-0x0000000000908000-memory.dmp

      Filesize

      672KB

    • memory/4892-91-0x00000000001A0000-0x00000000001CF000-memory.dmp

      Filesize

      188KB

    • memory/4892-90-0x00000000006B0000-0x00000000006B6000-memory.dmp

      Filesize

      24KB