Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/08/2024, 01:17

General

  • Target

    636597dd8c59135be43119197ee60db2268abaa5d8a60f4c0ac296acd9dc444f.exe

  • Size

    1.1MB

  • MD5

    6bbfded2baa5a18cc97d10516ee91c78

  • SHA1

    9e39944c9d057d134b119c677be07975704e546e

  • SHA256

    636597dd8c59135be43119197ee60db2268abaa5d8a60f4c0ac296acd9dc444f

  • SHA512

    4d952c2ed6a876bd639b2a9e4baa5eeadbf01f314bcd1a2c80da564c4594330a5b26dc351c528b5c0d574e7013b387349ce77a274257b0df902a48e707545605

  • SSDEEP

    24576:nqDEvCTbMWu7rQYlBQcBiT6rprG8a4dz681iuw:nTvC/MTQYxsWR7a4h6Eiu

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

jd21

Decoy

bankownedproperties-0.bond

slab-leak-repair-74697.bond

tvtwenty20sr.top

scw-iot.net

circusenergy.online

030002787.xyz

propertiesforrentus11.bond

defi-banksystem.online

gkbet168.net

joycasino-ed46.top

sctttc-or.top

borghardt.xyz

therealtorpeddler.info

macexpress.online

bobbyharvey.store

dating-dd-de.info

thetrue.one

alqahtani.site

mahlubini.africa

truck-driver-jobs-42274.bond

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 4 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Users\Admin\AppData\Local\Temp\636597dd8c59135be43119197ee60db2268abaa5d8a60f4c0ac296acd9dc444f.exe
      "C:\Users\Admin\AppData\Local\Temp\636597dd8c59135be43119197ee60db2268abaa5d8a60f4c0ac296acd9dc444f.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4132
      • C:\Users\Admin\AppData\Local\directory\name.exe
        "C:\Users\Admin\AppData\Local\Temp\636597dd8c59135be43119197ee60db2268abaa5d8a60f4c0ac296acd9dc444f.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\636597dd8c59135be43119197ee60db2268abaa5d8a60f4c0ac296acd9dc444f.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2108
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 704
          4⤵
          • Program crash
          PID:2824
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\SysWOW64\mstsc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4784
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2040 -ip 2040
    1⤵
      PID:4520

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\molecast

      Filesize

      28KB

      MD5

      ee4cf49f57dbe9b317975148fc646c5a

      SHA1

      d108703eb6fcd1cce8ec0d2ef6cd0a8724de207d

      SHA256

      b9d18f83221f16f2f21ff6596e108562172c0e51ee1e78fae29fd4d512f9dc54

      SHA512

      5178a4e46d5d964f6ae9352749dcb29402ac6f75f85b117d4179fb04af1fd4faf8c2f588d1cb62d107e67fa9a3c4212c5c60bd9ada662f7989eec9acdf6732da

    • C:\Users\Admin\AppData\Local\directory\name.exe

      Filesize

      1.1MB

      MD5

      6bbfded2baa5a18cc97d10516ee91c78

      SHA1

      9e39944c9d057d134b119c677be07975704e546e

      SHA256

      636597dd8c59135be43119197ee60db2268abaa5d8a60f4c0ac296acd9dc444f

      SHA512

      4d952c2ed6a876bd639b2a9e4baa5eeadbf01f314bcd1a2c80da564c4594330a5b26dc351c528b5c0d574e7013b387349ce77a274257b0df902a48e707545605

    • memory/2108-38-0x0000000003530000-0x0000000003545000-memory.dmp

      Filesize

      84KB

    • memory/2108-30-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2108-31-0x0000000001700000-0x0000000001A4A000-memory.dmp

      Filesize

      3.3MB

    • memory/2108-34-0x0000000001C20000-0x0000000001C35000-memory.dmp

      Filesize

      84KB

    • memory/2108-33-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2108-37-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/3460-35-0x0000000009320000-0x00000000094C5000-memory.dmp

      Filesize

      1.6MB

    • memory/3460-39-0x0000000008BD0000-0x0000000008CB1000-memory.dmp

      Filesize

      900KB

    • memory/3460-45-0x0000000009320000-0x00000000094C5000-memory.dmp

      Filesize

      1.6MB

    • memory/3460-46-0x0000000008BD0000-0x0000000008CB1000-memory.dmp

      Filesize

      900KB

    • memory/3460-48-0x0000000009040000-0x000000000916D000-memory.dmp

      Filesize

      1.2MB

    • memory/4132-11-0x0000000000E00000-0x0000000000E04000-memory.dmp

      Filesize

      16KB

    • memory/4608-40-0x0000000000A30000-0x0000000000B6A000-memory.dmp

      Filesize

      1.2MB

    • memory/4608-42-0x0000000000A30000-0x0000000000B6A000-memory.dmp

      Filesize

      1.2MB

    • memory/4608-43-0x0000000000110000-0x000000000013F000-memory.dmp

      Filesize

      188KB