Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
293s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/09/2024, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
DHL_APC2_240708172813545_8476086290.pdf.exe
Resource
win7-20240903-en
General
-
Target
DHL_APC2_240708172813545_8476086290.pdf.exe
-
Size
1.1MB
-
MD5
76c40149b0f69c5665d385b82902886e
-
SHA1
764943417c9e7210f665573062af350d91e0da87
-
SHA256
cfd3622bf94fdc5308862e61697d0fc00a6038493fe5686a230979b9e7f2fe0e
-
SHA512
9d41a030755fcad143f391fa48069872969ed90828cf882420289d8c4e25b9b59d29758d699d5698d46a83472fac7887ab4fd0a8eddd4b570c7f53ed6ba504bd
-
SSDEEP
24576:v4lavt0LkLL9IMixoEgeax7Lnu1Op+baHZMf5fiq9MmCS:qkwkn9IMHeax7TiOH/aPCS
Malware Config
Extracted
formbook
4.1
rn94
st68v.xyz
conciergenotary.net
qwechaotk.top
rtpdonatoto29.xyz
8ad.xyz
powermove.top
cameras-30514.bond
vanguardcoffee.shop
umoe53fxc1bsujv.buzz
consultoriamax.net
hplxx.com
ndu.wtf
yzh478c.xyz
bigbrown999.site
xiake07.asia
resdai.xyz
the35678.shop
ba6rf.rest
ceo688.com
phimxhot.xyz
010101-11122-2222.cloud
champion-casino-skw.buzz
laku77.bar
popumail.net
stargazerastrology.click
beauty.university
t460.top
sparkyos.app
day2go.net
minrungis.shop
cognigrid.com
abandoned-houses-39863.bond
liderparti.store
hinet.tech
moviemax.live
business-printer-22001.bond
yakintv.pro
longmaosol.xyz
hello4d.dev
vestircool.store
surpriseinside.net
betflixfan.asia
ln2m1.shop
5302mcavt.website
conf-contact.online
31140.ooo
bdkasinoxox.xyz
nicoleb.tech
mainz-cruise-deals.today
run-run.tokyo
practicalfranchises.info
usmanovbanki-uz.space
superlottery.top
zabbet911.bet
ambassadorshipvottings.click
sangforln.tech
expertoffersusa.lat
plong.cloud
cryptoautomata.dev
dq33xa.xyz
handtools-16660.bond
24763wbk.hair
sportswear-30530.bond
lusuidnx.shop
laske.xyz
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2824-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2824-24-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2648-30-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
pid Process 2760 name.exe -
Loads dropped DLL 1 IoCs
pid Process 3012 DHL_APC2_240708172813545_8476086290.pdf.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0006000000017415-7.dat autoit_exe behavioral1/memory/2760-18-0x0000000000140000-0x000000000025C000-memory.dmp autoit_exe behavioral1/memory/2760-21-0x0000000000140000-0x000000000025C000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2760 set thread context of 2824 2760 name.exe 31 PID 2824 set thread context of 1232 2824 svchost.exe 21 PID 2648 set thread context of 1232 2648 msdt.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHL_APC2_240708172813545_8476086290.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language name.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2824 svchost.exe 2824 svchost.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe 2648 msdt.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2760 name.exe 2824 svchost.exe 2824 svchost.exe 2824 svchost.exe 2648 msdt.exe 2648 msdt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2824 svchost.exe Token: SeDebugPrivilege 2648 msdt.exe Token: SeShutdownPrivilege 1232 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 3012 DHL_APC2_240708172813545_8476086290.pdf.exe 3012 DHL_APC2_240708172813545_8476086290.pdf.exe 2760 name.exe 2760 name.exe 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3012 DHL_APC2_240708172813545_8476086290.pdf.exe 3012 DHL_APC2_240708172813545_8476086290.pdf.exe 2760 name.exe 2760 name.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2760 3012 DHL_APC2_240708172813545_8476086290.pdf.exe 30 PID 3012 wrote to memory of 2760 3012 DHL_APC2_240708172813545_8476086290.pdf.exe 30 PID 3012 wrote to memory of 2760 3012 DHL_APC2_240708172813545_8476086290.pdf.exe 30 PID 3012 wrote to memory of 2760 3012 DHL_APC2_240708172813545_8476086290.pdf.exe 30 PID 2760 wrote to memory of 2824 2760 name.exe 31 PID 2760 wrote to memory of 2824 2760 name.exe 31 PID 2760 wrote to memory of 2824 2760 name.exe 31 PID 2760 wrote to memory of 2824 2760 name.exe 31 PID 2760 wrote to memory of 2824 2760 name.exe 31 PID 1232 wrote to memory of 2648 1232 Explorer.EXE 32 PID 1232 wrote to memory of 2648 1232 Explorer.EXE 32 PID 1232 wrote to memory of 2648 1232 Explorer.EXE 32 PID 1232 wrote to memory of 2648 1232 Explorer.EXE 32 PID 2648 wrote to memory of 2508 2648 msdt.exe 33 PID 2648 wrote to memory of 2508 2648 msdt.exe 33 PID 2648 wrote to memory of 2508 2648 msdt.exe 33 PID 2648 wrote to memory of 2508 2648 msdt.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\DHL_APC2_240708172813545_8476086290.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL_APC2_240708172813545_8476086290.pdf.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\DHL_APC2_240708172813545_8476086290.pdf.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\DHL_APC2_240708172813545_8476086290.pdf.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2508
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD576c40149b0f69c5665d385b82902886e
SHA1764943417c9e7210f665573062af350d91e0da87
SHA256cfd3622bf94fdc5308862e61697d0fc00a6038493fe5686a230979b9e7f2fe0e
SHA5129d41a030755fcad143f391fa48069872969ed90828cf882420289d8c4e25b9b59d29758d699d5698d46a83472fac7887ab4fd0a8eddd4b570c7f53ed6ba504bd