Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
DHL SHIPPING DOCUMENT.exe
Resource
win7-20240708-en
General
-
Target
DHL SHIPPING DOCUMENT.exe
-
Size
1.1MB
-
MD5
aeffc423b2e483ccad4ffef8ff7195a7
-
SHA1
85b40f249df8b988bdf42aad6be931d0fcacf79b
-
SHA256
c66ec112e6247a7dd5171f17a0559695d0adc051b285ed2df42fe738c83efe94
-
SHA512
692c07a901cc99be0d0b0f2d7f1272a9a6541a531494f34d43338a3e6beec9a3b6a3fbe9e42d2506459599dc7f17f59530eee893660788f08ec995f39e66cc9e
-
SSDEEP
24576:JqDEvCTbMWu7rQYlBQcBiT6rprG8a3DtLxBLGV/:JTvC/MTQYxsWR7a3Dd+
Malware Config
Extracted
formbook
4.1
jd21
bankownedproperties-0.bond
slab-leak-repair-74697.bond
tvtwenty20sr.top
scw-iot.net
circusenergy.online
030002787.xyz
propertiesforrentus11.bond
defi-banksystem.online
gkbet168.net
joycasino-ed46.top
sctttc-or.top
borghardt.xyz
therealtorpeddler.info
macexpress.online
bobbyharvey.store
dating-dd-de.info
thetrue.one
alqahtani.site
mahlubini.africa
truck-driver-jobs-42274.bond
packaging-services-17231.xyz
badcreditloans59.xyz
cellphonesfxw.today
applyzentavra.com
basscolofers.shop
knee-pain-treatment-140741.xyz
saltyfashion.shop
quantive.tech
cldvpn.sbs
bolehapasaja16.shop
nextdoor3.store
forklift-jobs-29768.bond
pools-99305.bond
3780.cyou
solveiterzsolutions.fun
key-ring.xyz
replyingendoplasmed.pro
infanbs.shop
apple0ficial-ld.info
stress-relief-44110.bond
r86gd377hi.rent
lww20.top
apartments-for-rent-series.sbs
emiratesnseic.top
senior-living-25596.bond
hostease.cloud
walk-in-tubs-30303.bond
childrenfirstcenter.xyz
45941978.top
pw7-golden-painting-ldm.lat
0yf.com
tyumk.xyz
utopartses.com
hearing-aids-77773.bond
frametoryframes.shop
mvtb.pics
speeddeals.online
cyber-eu.digital
hm23s.top
pools-80761.bond
2002w.app
authentication-app-69447.bond
legendhud.shop
xmld101.icu
weight-loss-003.today
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1320-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1320-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1248-20-0x0000000000F70000-0x0000000000F9F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4080 set thread context of 1320 4080 DHL SHIPPING DOCUMENT.exe 86 PID 1320 set thread context of 3488 1320 svchost.exe 56 PID 1248 set thread context of 3488 1248 help.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHL SHIPPING DOCUMENT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language help.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4080 DHL SHIPPING DOCUMENT.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1320 svchost.exe 1320 svchost.exe 1320 svchost.exe 1320 svchost.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe 1248 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4080 DHL SHIPPING DOCUMENT.exe 1320 svchost.exe 1320 svchost.exe 1320 svchost.exe 1248 help.exe 1248 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1320 svchost.exe Token: SeDebugPrivilege 1248 help.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4080 DHL SHIPPING DOCUMENT.exe 4080 DHL SHIPPING DOCUMENT.exe 3488 Explorer.EXE 3488 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4080 DHL SHIPPING DOCUMENT.exe 4080 DHL SHIPPING DOCUMENT.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3488 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4080 wrote to memory of 1320 4080 DHL SHIPPING DOCUMENT.exe 86 PID 4080 wrote to memory of 1320 4080 DHL SHIPPING DOCUMENT.exe 86 PID 4080 wrote to memory of 1320 4080 DHL SHIPPING DOCUMENT.exe 86 PID 4080 wrote to memory of 1320 4080 DHL SHIPPING DOCUMENT.exe 86 PID 3488 wrote to memory of 1248 3488 Explorer.EXE 87 PID 3488 wrote to memory of 1248 3488 Explorer.EXE 87 PID 3488 wrote to memory of 1248 3488 Explorer.EXE 87 PID 1248 wrote to memory of 4980 1248 help.exe 88 PID 1248 wrote to memory of 4980 1248 help.exe 88 PID 1248 wrote to memory of 4980 1248 help.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOCUMENT.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOCUMENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4980
-
-