Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe
Resource
win7-20240704-en
General
-
Target
70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe
-
Size
1.1MB
-
MD5
b81b2efb25b5fc8ef39c47adc71f4f0a
-
SHA1
01bdbc997333aec6197832be7a57c87e777ab007
-
SHA256
70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765
-
SHA512
a0f9851855321300710b5f98c3886eab042cf851363710f48fd8ce2eef1de2348831828e2644011dadbe2af30c093a984268e86afa15400c8f176bb5c7e71f56
-
SSDEEP
24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8aeraZ4gB0c2eV:VTvC/MTQYxsWR7aeYBD2
Malware Config
Extracted
formbook
4.1
jd21
bankownedproperties-0.bond
slab-leak-repair-74697.bond
tvtwenty20sr.top
scw-iot.net
circusenergy.online
030002787.xyz
propertiesforrentus11.bond
defi-banksystem.online
gkbet168.net
joycasino-ed46.top
sctttc-or.top
borghardt.xyz
therealtorpeddler.info
macexpress.online
bobbyharvey.store
dating-dd-de.info
thetrue.one
alqahtani.site
mahlubini.africa
truck-driver-jobs-42274.bond
packaging-services-17231.xyz
badcreditloans59.xyz
cellphonesfxw.today
applyzentavra.com
basscolofers.shop
knee-pain-treatment-140741.xyz
saltyfashion.shop
quantive.tech
cldvpn.sbs
bolehapasaja16.shop
nextdoor3.store
forklift-jobs-29768.bond
pools-99305.bond
3780.cyou
solveiterzsolutions.fun
key-ring.xyz
replyingendoplasmed.pro
infanbs.shop
apple0ficial-ld.info
stress-relief-44110.bond
r86gd377hi.rent
lww20.top
apartments-for-rent-series.sbs
emiratesnseic.top
senior-living-25596.bond
hostease.cloud
walk-in-tubs-30303.bond
childrenfirstcenter.xyz
45941978.top
pw7-golden-painting-ldm.lat
0yf.com
tyumk.xyz
utopartses.com
hearing-aids-77773.bond
frametoryframes.shop
mvtb.pics
speeddeals.online
cyber-eu.digital
hm23s.top
pools-80761.bond
2002w.app
authentication-app-69447.bond
legendhud.shop
xmld101.icu
weight-loss-003.today
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/3416-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3416-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2020-21-0x0000000000ED0000-0x0000000000EFF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4672 set thread context of 3416 4672 70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe 86 PID 3416 set thread context of 3360 3416 svchost.exe 56 PID 2020 set thread context of 3360 2020 wlanext.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3416 svchost.exe 3416 svchost.exe 3416 svchost.exe 3416 svchost.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe 2020 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4672 70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe 3416 svchost.exe 3416 svchost.exe 3416 svchost.exe 2020 wlanext.exe 2020 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3416 svchost.exe Token: SeDebugPrivilege 2020 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4672 70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe 4672 70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4672 70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe 4672 70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3360 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4672 wrote to memory of 3416 4672 70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe 86 PID 4672 wrote to memory of 3416 4672 70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe 86 PID 4672 wrote to memory of 3416 4672 70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe 86 PID 4672 wrote to memory of 3416 4672 70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe 86 PID 3360 wrote to memory of 2020 3360 Explorer.EXE 87 PID 3360 wrote to memory of 2020 3360 Explorer.EXE 87 PID 3360 wrote to memory of 2020 3360 Explorer.EXE 87 PID 2020 wrote to memory of 2552 2020 wlanext.exe 88 PID 2020 wrote to memory of 2552 2020 wlanext.exe 88 PID 2020 wrote to memory of 2552 2020 wlanext.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe"C:\Users\Admin\AppData\Local\Temp\70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\70ec27a0cb26c73b7dfe3d665a87234c55864972da956c4aca69393efc74c765.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3416
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2552
-
-