Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 01:26
Static task
static1
Behavioral task
behavioral1
Sample
8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe
Resource
win7-20240708-en
General
-
Target
8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe
-
Size
2.1MB
-
MD5
3d93ad3d9374e100842fc9a5c683d86b
-
SHA1
6d84040392c2b071dd1546a85ce7c8f527d7e1b3
-
SHA256
8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac
-
SHA512
d87baae4c95e41bf82c60c705638d010e3e6e7aa66a95adb9e4280ab2f9acf8b6f633c919f9ef4bc69bac0d700f010c2d72643aacffac4878e7855b3528e40f1
-
SSDEEP
12288:LB9rRHQ435jKIJE/yGcn5k9BTFE1ksbRz0A7JFVTr/EJ:d9rpQ4BGcATFokMT/n8
Malware Config
Extracted
formbook
4.1
oi12
exobello.bio
boinga.xyz
animasriversurf.com
gamesflashg.com
hayatbagievleri.online
washington-living.com
july7.store
x-pod-technologies.com
farmhouseflaire.com
qb52aa.top
datasynthing.xyz
5v28n.rest
legacycommerceltd.com
mundodelosjuguetes.com
wjblades.com
z9b6g8.com
eskimotech.net
dreziuy.xyz
bestsolarcompanies.services
vertemisconsulting.com
rockinrioviagogo.com
acimed.net
tdrfwb.shop
xd4tp.top
bihungoreng19.click
tcnhbv301y.top
triumphbusinessconsultancy.com
menuconfig.store
seikoubento.com
defiram.com
bespokearomatics.com
yellprint.com
flickeringlc.christmas
aidiagnostics.xyz
ok66g.app
z3o6i8.com
dacoylomarkemilcajes.online
rummymeett.xyz
arazivearsa.xyz
crystalpalaces.store
qtsandbox.com
wkbbb.com
abusedcode.com
puzzle-escape.info
jagoboss.com
seguro-pagamento.life
luxindicator.site
mxtp.coffee
okumafishing.xyz
gaffelshop.shop
optimusgs.com
qtsandbox.com
bt365332.com
kernphoto.art
p0uhx.pro
agsaydinlatma.online
korbidholdings.net
nsservicescorp.com
healthcare-trends-22748.bond
xtraslot.link
travelblitarjuandabmtrans.com
linlinda.com
gnonhcav.xyz
05544.xyz
selalujadipemenang.com
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2672-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2672-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2052-19-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2958949473-3205530200-1453100116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run systray.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\U2_XV488_HW = "C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe" systray.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2660 set thread context of 2672 2660 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe 31 PID 2672 set thread context of 1244 2672 wmplayer.exe 21 PID 2052 set thread context of 1244 2052 systray.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systray.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2958949473-3205530200-1453100116-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2672 wmplayer.exe 2672 wmplayer.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2672 wmplayer.exe 2672 wmplayer.exe 2672 wmplayer.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe 2052 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2672 wmplayer.exe Token: SeShutdownPrivilege 1244 Explorer.EXE Token: SeDebugPrivilege 2052 systray.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2672 2660 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe 31 PID 2660 wrote to memory of 2672 2660 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe 31 PID 2660 wrote to memory of 2672 2660 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe 31 PID 2660 wrote to memory of 2672 2660 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe 31 PID 2660 wrote to memory of 2672 2660 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe 31 PID 2660 wrote to memory of 2672 2660 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe 31 PID 2660 wrote to memory of 2672 2660 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe 31 PID 2660 wrote to memory of 2652 2660 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe 32 PID 2660 wrote to memory of 2652 2660 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe 32 PID 2660 wrote to memory of 2652 2660 8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe 32 PID 1244 wrote to memory of 2052 1244 Explorer.EXE 33 PID 1244 wrote to memory of 2052 1244 Explorer.EXE 33 PID 1244 wrote to memory of 2052 1244 Explorer.EXE 33 PID 1244 wrote to memory of 2052 1244 Explorer.EXE 33 PID 2052 wrote to memory of 2180 2052 systray.exe 34 PID 2052 wrote to memory of 2180 2052 systray.exe 34 PID 2052 wrote to memory of 2180 2052 systray.exe 34 PID 2052 wrote to memory of 2180 2052 systray.exe 34 PID 2052 wrote to memory of 2180 2052 systray.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe"C:\Users\Admin\AppData\Local\Temp\8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2660 -s 6283⤵PID:2652
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2180
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD512df40f6ff24d81b533f4b67ded21e71
SHA17d09b8a2a74aeea8da95b0e1fcd96f2be27b825f
SHA2569fff9471cf4b7f35558c86ff9e9edf61dc21b2d8b7497fbf098e30bb6f8ab382
SHA512111bdf22e0c6d029ad58a7db5cb0f61e518765781dce0581fdf68c56e00c6507c03dc4a4a2a00638f3a0474d4a37e8bbcf3b0c7c3f50c7da521658c2b9c42060
-
Filesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf