Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
MalwareBazaar.exe
Resource
win7-20240708-en
General
-
Target
MalwareBazaar.exe
-
Size
1.1MB
-
MD5
f669243676d39c9b249440b0fbaa20f1
-
SHA1
504c020e507873d31baf55b961c4298e47788acc
-
SHA256
767f55f50dc1e54dc89051cfcf7875d2af6280d742ea0c24516debccf6664461
-
SHA512
f0736c6be6c0f546836f287165773e25a30586440d09d9c3f815892ac9773b216baf06392bbcbf7cd74b1593a1787a867bf3462d38763954de27de7bc72ba5d1
-
SSDEEP
24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8aUVWTpRHis:MTvC/MTQYxsWR7aUVWTpc
Malware Config
Extracted
formbook
4.1
ph01
23888.sbs
zvcj.sbs
raitpourtrait.net
ibraryfarmclub.online
omputercourses123.live
j88.doctor
atsue-color.click
epitalrentgrup.online
rvvpn.lol
i-signals.tech
cr-phoenix.best
frican-safari.online
c-games.zone
oardetest.online
f4md.shop
uke-saaac.buzz
arze.dev
nvestment-services-49610.bond
izatrip.sbs
ameron-paaaa.buzz
esourceshark.info
ovamedrx.net
yzena.tech
ichardsjewelers.shop
olar-panel-jobs-67676.bond
oreanewspapers.top
olcon.live
evzuatakademi.online
ackdoortwinks.net
s23301.top
ool-works.net
inhhuan5g.sbs
redit-cards-se-9.bond
9509.club
athroomremodeling-pa-us2.click
obbypetrino.shop
uliet707.vip
bvcaz.xyz
ppcashvip.online
d-animation-degree-99775.bond
p39.xyz
hatsapz8.top
eamidiots.shop
mujo57abmb6c9me.app
edinvest.tech
hiskerwonderspro.yachts
glczs.shop
andscaping-services-69969.bond
93wh245ds.autos
arubear.shop
yqwzijbfrh9.asia
hiramon.cloud
5cbrx.shop
ahjong168.vip
echanictrainingsearch.today
lientserver.cfd
eeklybyte.net
oanweb.live
astbaytreecareservice.info
47000.xyz
r-software-14916.bond
8376.club
ublimax.online
uckchina.net
ootdetoxes.shop
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/4112-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4112-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3588-20-0x0000000000F50000-0x0000000000F7F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 756 set thread context of 4112 756 MalwareBazaar.exe 86 PID 4112 set thread context of 3476 4112 svchost.exe 55 PID 3588 set thread context of 3476 3588 cmmon32.exe 55 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MalwareBazaar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmmon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4112 svchost.exe 4112 svchost.exe 4112 svchost.exe 4112 svchost.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe 3588 cmmon32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 756 MalwareBazaar.exe 4112 svchost.exe 4112 svchost.exe 4112 svchost.exe 3588 cmmon32.exe 3588 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4112 svchost.exe Token: SeDebugPrivilege 3588 cmmon32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 756 MalwareBazaar.exe 756 MalwareBazaar.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 756 MalwareBazaar.exe 756 MalwareBazaar.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3476 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 756 wrote to memory of 4112 756 MalwareBazaar.exe 86 PID 756 wrote to memory of 4112 756 MalwareBazaar.exe 86 PID 756 wrote to memory of 4112 756 MalwareBazaar.exe 86 PID 756 wrote to memory of 4112 756 MalwareBazaar.exe 86 PID 3476 wrote to memory of 3588 3476 Explorer.EXE 87 PID 3476 wrote to memory of 3588 3476 Explorer.EXE 87 PID 3476 wrote to memory of 3588 3476 Explorer.EXE 87 PID 3588 wrote to memory of 224 3588 cmmon32.exe 88 PID 3588 wrote to memory of 224 3588 cmmon32.exe 88 PID 3588 wrote to memory of 224 3588 cmmon32.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:224
-
-