Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    06/08/2024, 17:01

General

  • Target

    MalwareBazaar.exe

  • Size

    1.2MB

  • MD5

    6b4c8e0e5006698940118d954da9ea6b

  • SHA1

    c9c1b519d8c44a25c14f054660a14a8c73f11ee4

  • SHA256

    461a2375bc1ab191cca91667ea8aecd498fad2b524bc81ca49eb7d5674063331

  • SHA512

    7484cc2ea73961b39462c9973ba79f57bf5741405f35b1a31b9a2e238cbb2e4ab082e72a46a70b5f3a5365c40ee95eabddf6c594f5159e41cb970431d6b5546b

  • SSDEEP

    24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8aul4pf4edYK:ETvC/MTQYxsWR7aucTO

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pt46

Decoy

twinportslocal.com

rovor.store

98169.club

mdywl.com

jrd3s.rest

aston1717.top

floridawoodworkingmachinery.com

17tk555t.com

ankitsho.shop

seclameh.com

realrecordlabel.com

trenchonbirmingham.com

af28.top

rtp1kenzototo.com

theselflovesite.com

promotegetpaid.info

strategiclogisticsagency.com

learneracademy.net

per-watch.com

betbox2341.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
      "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2180
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/400-11-0x0000000000160000-0x0000000000164000-memory.dmp

    Filesize

    16KB

  • memory/1444-23-0x0000000007890000-0x00000000079E8000-memory.dmp

    Filesize

    1.3MB

  • memory/1444-31-0x00000000079F0000-0x0000000007B7E000-memory.dmp

    Filesize

    1.6MB

  • memory/1444-28-0x00000000079F0000-0x0000000007B7E000-memory.dmp

    Filesize

    1.6MB

  • memory/1444-27-0x00000000079F0000-0x0000000007B7E000-memory.dmp

    Filesize

    1.6MB

  • memory/1444-17-0x0000000007890000-0x00000000079E8000-memory.dmp

    Filesize

    1.3MB

  • memory/2180-15-0x0000000000200000-0x0000000000214000-memory.dmp

    Filesize

    80KB

  • memory/2180-13-0x0000000000720000-0x0000000000A23000-memory.dmp

    Filesize

    3.0MB

  • memory/2180-16-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2180-12-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2440-20-0x00000000007B0000-0x00000000007D2000-memory.dmp

    Filesize

    136KB

  • memory/2440-21-0x0000000000070000-0x000000000009F000-memory.dmp

    Filesize

    188KB

  • memory/2440-18-0x00000000007B0000-0x00000000007D2000-memory.dmp

    Filesize

    136KB