Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/08/2024, 07:56
Static task
static1
Behavioral task
behavioral1
Sample
Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe
Resource
win7-20240705-en
General
-
Target
Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe
-
Size
771KB
-
MD5
15cc82dce96d6980e2dc800b10a81495
-
SHA1
005a539c30f4a640457dcd8b047278e8a93dd61b
-
SHA256
7d39dde72383a557950523dfc9e5a64718323fcebf5d41aba286763c9ae7b39e
-
SHA512
5ceaf03a2187dd14f793d278730f17b5a4fe907d57a319fb512fc6ad686e49d06d9f6d57b98261b54c2c37397f4b0661c954cea2f07acccb560a51f82d6921e3
-
SSDEEP
12288:l8RMecnVV0TWQwZnBLhDqV/NX7WsfuyP1S3dktl8IfWoK811zF2JraZlJCjWcRQc:+43NdsVpWUQatlPlcJclJtcu
Malware Config
Extracted
formbook
4.1
pz12
paucanyes.com
autonwheels.com
cowboysandcaviarbar.com
fitnessengineeredworkouts.com
nuevobajonfavorito.com
dflx8.com
rothability.com
sxybet88.com
onesource.live
brenjitu1904.com
airdrop-zero1labs.com
guangdongqiangzhetc.com
apartments-for-rent-72254.bond
ombak99.lol
qqfoodsolutions.com
kyyzz.com
thepicklematch.com
ainth.com
missorris.com
gabbygomez.com
aromacuppa.com
kaskusbagus.com
zoox1.asia
hemophilia-treatment-41433.bond
meidupro.com
shrisona.com
sekanse.com
marcocostasax.com
loyalbahis356.com
mzmz97.com
ma-google.com
xiangadvanced.site
tuotalogis.com
xcxocef.shop
fidgetbottles.com
shuaninvolved.site
ambientelatino.com
98980901.com
singhbrothersframes.com
pureamyl.com
hgs0713.net
surejobzapp.com
slotgame99.bet
datalakeflow.com
ebehemin.com
vanessasmobilespa.com
317wb.com
motchillssss.top
huesch.net
salesgymshark.shop
mejorcompra99.com
tacubashop.com
jessicaxsimmons.com
roar-stores.com
chalkandthimble.com
84556.vip
luyutuwen.com
siliconcollege.icu
marvowhite.com
gjxuh82y0u3h6.top
e2taop5.top
businessbroadway.com
cripmz.xyz
4hu259.com
jnhdh8827.com
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1460-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1460-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3552-70-0x0000000000790000-0x00000000007BF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3280 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3240 set thread context of 1460 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 88 PID 1460 set thread context of 3516 1460 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 56 PID 3552 set thread context of 3516 3552 colorcpl.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 1460 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 1460 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 1460 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 1460 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 3280 powershell.exe 3280 powershell.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe 3552 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1460 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 1460 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 1460 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 3552 colorcpl.exe 3552 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe Token: SeDebugPrivilege 1460 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe Token: SeDebugPrivilege 3280 powershell.exe Token: SeShutdownPrivilege 3516 Explorer.EXE Token: SeCreatePagefilePrivilege 3516 Explorer.EXE Token: SeDebugPrivilege 3552 colorcpl.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3516 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3240 wrote to memory of 3280 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 86 PID 3240 wrote to memory of 3280 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 86 PID 3240 wrote to memory of 3280 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 86 PID 3240 wrote to memory of 1460 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 88 PID 3240 wrote to memory of 1460 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 88 PID 3240 wrote to memory of 1460 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 88 PID 3240 wrote to memory of 1460 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 88 PID 3240 wrote to memory of 1460 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 88 PID 3240 wrote to memory of 1460 3240 Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe 88 PID 3516 wrote to memory of 3552 3516 Explorer.EXE 89 PID 3516 wrote to memory of 3552 3516 Explorer.EXE 89 PID 3516 wrote to memory of 3552 3516 Explorer.EXE 89 PID 3552 wrote to memory of 1492 3552 colorcpl.exe 90 PID 3552 wrote to memory of 1492 3552 colorcpl.exe 90 PID 3552 wrote to memory of 1492 3552 colorcpl.exe 90
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3280
-
-
C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Bien nhan thanh toan Swift Message 38579130 VND8509509220_pdf.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1492
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82