Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    15/08/2024, 02:46

General

  • Target

    $PLUGINSDIR/iewybf.dll

  • Size

    29KB

  • MD5

    4256ddc7ba4f2ab39fb28f081e870cfa

  • SHA1

    8c1f0f6e94b68510bbffbf81143c5f26ebd913b6

  • SHA256

    d519f718eca42250c87657b679a8a9d1766d331e6ee242d18bd739998bf44350

  • SHA512

    a71ac74ad9d95c6b755858b0a75beaa3ec26e20eca252445a2d1541156d96bd39e39c30daa5eda28bafe8de2e2d67c2c70b25dce6b7f38f4ac0a0dfa60599c1a

  • SSDEEP

    768:ubYYsBQJDh7wN4Ce10NUW5gPO8P9MOVAiTtm/MNJ:+IBQJDPGgPO8P9vAVm

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bkye

Decoy

lawnandgardenzone.com

eazymoneyindia.com

macroscopicsystem.com

aocsw.com

maisonetjardinltd.com

khadijahtv.com

shashameneland.com

kildebasen.com

lovetxts.com

easycompanyarmory.com

surviveit.info

greenterra.solutions

ushergiving.com

stickyickybakery.com

pyesquard.com

dailyinformerblog.com

thekimchilife.com

rainbow-bm.com

bosonetwork.com

bestacnetreatmentever.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\iewybf.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\iewybf.dll,#1
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\iewybf.dll,#1
          4⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2028
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2112
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\rundll32.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1204-7-0x0000000006AF0000-0x0000000006C37000-memory.dmp

    Filesize

    1.3MB

  • memory/1204-11-0x0000000006AF0000-0x0000000006C37000-memory.dmp

    Filesize

    1.3MB

  • memory/2028-1-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2028-4-0x00000000020A0000-0x00000000023A3000-memory.dmp

    Filesize

    3.0MB

  • memory/2028-6-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2028-5-0x00000000001A0000-0x00000000001B4000-memory.dmp

    Filesize

    80KB

  • memory/2112-9-0x00000000008E0000-0x00000000008E8000-memory.dmp

    Filesize

    32KB

  • memory/2112-8-0x00000000008E0000-0x00000000008E8000-memory.dmp

    Filesize

    32KB

  • memory/2504-0-0x0000000010000000-0x000000001000B000-memory.dmp

    Filesize

    44KB

  • memory/2504-2-0x0000000010000000-0x000000001000B000-memory.dmp

    Filesize

    44KB