Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/08/2024, 07:56
Static task
static1
Behavioral task
behavioral1
Sample
Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe
Resource
win7-20240705-en
General
-
Target
Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe
-
Size
771KB
-
MD5
15cc82dce96d6980e2dc800b10a81495
-
SHA1
005a539c30f4a640457dcd8b047278e8a93dd61b
-
SHA256
7d39dde72383a557950523dfc9e5a64718323fcebf5d41aba286763c9ae7b39e
-
SHA512
5ceaf03a2187dd14f793d278730f17b5a4fe907d57a319fb512fc6ad686e49d06d9f6d57b98261b54c2c37397f4b0661c954cea2f07acccb560a51f82d6921e3
-
SSDEEP
12288:l8RMecnVV0TWQwZnBLhDqV/NX7WsfuyP1S3dktl8IfWoK811zF2JraZlJCjWcRQc:+43NdsVpWUQatlPlcJclJtcu
Malware Config
Extracted
formbook
4.1
pz12
paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
aromacuppa.com
kaskusbagus.com
zoox1.asia
hemophilia-treatment-41433.bond
meidupro.com
shrisona.com
sekanse.com
marcocostasax.com
loyalbahis356.com
mzmz97.com
ma-google.com
xiangadvanced.site
tuotalogis.com
xcxocef.shop
fidgetbottles.com
shuaninvolved.site
ambientelatino.com
98980901.com
singhbrothersframes.com
pureamyl.com
hgs0713.net
surejobzapp.com
slotgame99.bet
datalakeflow.com
ebehemin.com
vanessasmobilespa.com
317wb.com
motchillssss.top
huesch.net
salesgymshark.shop
mejorcompra99.com
tacubashop.com
jessicaxsimmons.com
roar-stores.com
chalkandthimble.com
84556.vip
luyutuwen.com
siliconcollege.icu
marvowhite.com
gjxuh82y0u3h6.top
e2taop5.top
businessbroadway.com
cripmz.xyz
4hu259.com
jnhdh8827.com
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2420-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2420-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2420-25-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2084-29-0x0000000000110000-0x000000000013F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2608 powershell.exe -
Deletes itself 1 IoCs
pid Process 344 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 976 set thread context of 2420 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 31 PID 2420 set thread context of 1204 2420 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 21 PID 2420 set thread context of 1204 2420 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 21 PID 2084 set thread context of 1204 2084 msiexec.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 2420 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 2420 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 2608 powershell.exe 2420 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe 2084 msiexec.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2420 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 2420 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 2420 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 2420 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 2084 msiexec.exe 2084 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe Token: SeDebugPrivilege 2420 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe Token: SeDebugPrivilege 2608 powershell.exe Token: SeDebugPrivilege 2084 msiexec.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 976 wrote to memory of 2608 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 29 PID 976 wrote to memory of 2608 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 29 PID 976 wrote to memory of 2608 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 29 PID 976 wrote to memory of 2608 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 29 PID 976 wrote to memory of 2420 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 31 PID 976 wrote to memory of 2420 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 31 PID 976 wrote to memory of 2420 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 31 PID 976 wrote to memory of 2420 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 31 PID 976 wrote to memory of 2420 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 31 PID 976 wrote to memory of 2420 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 31 PID 976 wrote to memory of 2420 976 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 31 PID 1204 wrote to memory of 2084 1204 Explorer.EXE 79 PID 1204 wrote to memory of 2084 1204 Explorer.EXE 79 PID 1204 wrote to memory of 2084 1204 Explorer.EXE 79 PID 1204 wrote to memory of 2084 1204 Explorer.EXE 79 PID 1204 wrote to memory of 2084 1204 Explorer.EXE 79 PID 1204 wrote to memory of 2084 1204 Explorer.EXE 79 PID 1204 wrote to memory of 2084 1204 Explorer.EXE 79 PID 2084 wrote to memory of 344 2084 msiexec.exe 80 PID 2084 wrote to memory of 344 2084 msiexec.exe 80 PID 2084 wrote to memory of 344 2084 msiexec.exe 80 PID 2084 wrote to memory of 344 2084 msiexec.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2552
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2200
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2588
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2408
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2428
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2444
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2476
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2488
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2584
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2976
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2900
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2896
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2692
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1900
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1984
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2948
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1916
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1064
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:264
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1152
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:1616
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2472
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2480
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2596
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2672
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2720
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2724
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2740
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2748
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2752
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1472
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2768
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2208
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1864
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2292
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:780
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1484
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1100
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:624
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1200
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1696
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2204
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1848
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1608
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1936
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:680
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:580
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:344
-
-