Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 07:34
Static task
static1
Behavioral task
behavioral1
Sample
dd674329e193ad3d072e07fe1b442340N.exe
Resource
win7-20240903-en
General
-
Target
dd674329e193ad3d072e07fe1b442340N.exe
-
Size
741KB
-
MD5
dd674329e193ad3d072e07fe1b442340
-
SHA1
9064b660c5643e0104bb81f9a6a71b340f7d5f1a
-
SHA256
8a26bda9ab6bcbd3ef5a008db1bc15e46677ab1545bd2aac4e081ea3df5077e9
-
SHA512
a24311e04ca3604069fc0f9feb736897a8598102abba6cdc600bd502870de689cd3437d97241ad801a388d13b1c1c081e591e119fc4f31aceffa03d1af472584
-
SSDEEP
12288:Ex5zjLf30WH0TwOqp0eXIBq2VhXpAOnTveaIEC+O22XPtJV6HAfiL8IftFuMy:gjj0ywkpr0q2vjNtC+O9XPn+A4/9
Malware Config
Extracted
formbook
4.1
b48n
anifestmindset.net
ommybahamabigsales.shop
3tcxr.xyz
iano-world.net
rconf23.net
atherpa.shop
trllrpartners.club
5sawit777.pro
ctbhuxcdreioijresol.top
opinatlas.app
pinstar.xyz
mfengwa.top
8games13.xyz
tickpaket.online
iphuodongallbbtbtm.top
ental-bridges-51593.bond
laywithkemon.rest
lkpiou.xyz
a88.land
igfloppafan.club
12k5t7i2j.sbs
lubfitgrowth.xyz
uro-news.live
espets1.buzz
uccessfuldatingtips.info
sed-cars-93620.bond
epatitis-treatment-25621.bond
ocakges.click
yai54.top
estbuy-purchase.online
itesmiledl.net
power.services
olar-systems-panels-31076.bond
5571.club
ffg7.autos
reespins.claims
arriage-therapy-60427.bond
3am.sbs
tk-m.online
atami-suzuki.net
op-smartphone-deals.today
acik.rest
srsvrfive.xyz
6561.xyz
ajubasah1.buzz
t83t56zshegbbo.sbs
dma.xyz
xrduxsd220.xyz
leaningcompanies-near-me.today
aregiverjobs-2507-ns.click
reensick.online
rmunx.shop
ewllife.net
tp3-pick4d.shop
ianju-ljef097.vip
oxshop1.online
wuogi.top
46rr211sm.autos
saac-xaaab.buzz
zaohh.online
ontosdabiblia.online
ackson-xaaab.buzz
v5t7.xyz
udo-flix.pro
5ldym2.shop
Signatures
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/3004-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1732 set thread context of 3004 1732 dd674329e193ad3d072e07fe1b442340N.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd674329e193ad3d072e07fe1b442340N.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3004 dd674329e193ad3d072e07fe1b442340N.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1732 wrote to memory of 3004 1732 dd674329e193ad3d072e07fe1b442340N.exe 31 PID 1732 wrote to memory of 3004 1732 dd674329e193ad3d072e07fe1b442340N.exe 31 PID 1732 wrote to memory of 3004 1732 dd674329e193ad3d072e07fe1b442340N.exe 31 PID 1732 wrote to memory of 3004 1732 dd674329e193ad3d072e07fe1b442340N.exe 31 PID 1732 wrote to memory of 3004 1732 dd674329e193ad3d072e07fe1b442340N.exe 31 PID 1732 wrote to memory of 3004 1732 dd674329e193ad3d072e07fe1b442340N.exe 31 PID 1732 wrote to memory of 3004 1732 dd674329e193ad3d072e07fe1b442340N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd674329e193ad3d072e07fe1b442340N.exe"C:\Users\Admin\AppData\Local\Temp\dd674329e193ad3d072e07fe1b442340N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\dd674329e193ad3d072e07fe1b442340N.exe"C:\Users\Admin\AppData\Local\Temp\dd674329e193ad3d072e07fe1b442340N.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3004
-