Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
296s -
max time network
284s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/09/2024, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
DHL_APC2_240708172813545_8476086290.pdf.exe
Resource
win7-20240903-en
General
-
Target
DHL_APC2_240708172813545_8476086290.pdf.exe
-
Size
1.1MB
-
MD5
76c40149b0f69c5665d385b82902886e
-
SHA1
764943417c9e7210f665573062af350d91e0da87
-
SHA256
cfd3622bf94fdc5308862e61697d0fc00a6038493fe5686a230979b9e7f2fe0e
-
SHA512
9d41a030755fcad143f391fa48069872969ed90828cf882420289d8c4e25b9b59d29758d699d5698d46a83472fac7887ab4fd0a8eddd4b570c7f53ed6ba504bd
-
SSDEEP
24576:v4lavt0LkLL9IMixoEgeax7Lnu1Op+baHZMf5fiq9MmCS:qkwkn9IMHeax7TiOH/aPCS
Malware Config
Extracted
formbook
4.1
rn94
st68v.xyz
conciergenotary.net
qwechaotk.top
rtpdonatoto29.xyz
8ad.xyz
powermove.top
cameras-30514.bond
vanguardcoffee.shop
umoe53fxc1bsujv.buzz
consultoriamax.net
hplxx.com
ndu.wtf
yzh478c.xyz
bigbrown999.site
xiake07.asia
resdai.xyz
the35678.shop
ba6rf.rest
ceo688.com
phimxhot.xyz
010101-11122-2222.cloud
champion-casino-skw.buzz
laku77.bar
popumail.net
stargazerastrology.click
beauty.university
t460.top
sparkyos.app
day2go.net
minrungis.shop
cognigrid.com
abandoned-houses-39863.bond
liderparti.store
hinet.tech
moviemax.live
business-printer-22001.bond
yakintv.pro
longmaosol.xyz
hello4d.dev
vestircool.store
surpriseinside.net
betflixfan.asia
ln2m1.shop
5302mcavt.website
conf-contact.online
31140.ooo
bdkasinoxox.xyz
nicoleb.tech
mainz-cruise-deals.today
run-run.tokyo
practicalfranchises.info
usmanovbanki-uz.space
superlottery.top
zabbet911.bet
ambassadorshipvottings.click
sangforln.tech
expertoffersusa.lat
plong.cloud
cryptoautomata.dev
dq33xa.xyz
handtools-16660.bond
24763wbk.hair
sportswear-30530.bond
lusuidnx.shop
laske.xyz
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/668-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/668-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/668-24-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4000-32-0x0000000000FA0000-0x0000000000FCF000-memory.dmp formbook -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
pid Process 1600 name.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0003000000022d07-8.dat autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1600 set thread context of 668 1600 name.exe 87 PID 668 set thread context of 3412 668 svchost.exe 56 PID 668 set thread context of 3412 668 svchost.exe 56 PID 4000 set thread context of 3412 4000 raserver.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHL_APC2_240708172813545_8476086290.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language name.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 668 svchost.exe 668 svchost.exe 668 svchost.exe 668 svchost.exe 668 svchost.exe 668 svchost.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe 4000 raserver.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1600 name.exe 668 svchost.exe 668 svchost.exe 668 svchost.exe 668 svchost.exe 4000 raserver.exe 4000 raserver.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 668 svchost.exe Token: SeDebugPrivilege 4000 raserver.exe Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4740 DHL_APC2_240708172813545_8476086290.pdf.exe 4740 DHL_APC2_240708172813545_8476086290.pdf.exe 1600 name.exe 1600 name.exe 3412 Explorer.EXE 3412 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4740 DHL_APC2_240708172813545_8476086290.pdf.exe 4740 DHL_APC2_240708172813545_8476086290.pdf.exe 1600 name.exe 1600 name.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3412 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4740 wrote to memory of 1600 4740 DHL_APC2_240708172813545_8476086290.pdf.exe 86 PID 4740 wrote to memory of 1600 4740 DHL_APC2_240708172813545_8476086290.pdf.exe 86 PID 4740 wrote to memory of 1600 4740 DHL_APC2_240708172813545_8476086290.pdf.exe 86 PID 1600 wrote to memory of 668 1600 name.exe 87 PID 1600 wrote to memory of 668 1600 name.exe 87 PID 1600 wrote to memory of 668 1600 name.exe 87 PID 1600 wrote to memory of 668 1600 name.exe 87 PID 668 wrote to memory of 4000 668 svchost.exe 94 PID 668 wrote to memory of 4000 668 svchost.exe 94 PID 668 wrote to memory of 4000 668 svchost.exe 94 PID 4000 wrote to memory of 3392 4000 raserver.exe 95 PID 4000 wrote to memory of 3392 4000 raserver.exe 95 PID 4000 wrote to memory of 3392 4000 raserver.exe 95
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\DHL_APC2_240708172813545_8476086290.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL_APC2_240708172813545_8476086290.pdf.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\DHL_APC2_240708172813545_8476086290.pdf.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\DHL_APC2_240708172813545_8476086290.pdf.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"5⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"6⤵
- System Location Discovery: System Language Discovery
PID:3392
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185KB
MD56ab735ad89398d1574f60eb6c721c1ae
SHA12994ecc08dbc49073b245fceb32f87658c0e02d5
SHA2565fcbd18d7bd4d4ce387e08b0b0cf003051994501e3be11c443ac2c82f7a54a10
SHA512ab3892cfbbd40754eb4c2a674b3bb1ad1e7cdfb646dafbf969d08a7aa539ee506aad6bb87aff5b647fc9aeab0b082d58d76456741062cb5460e3c2cdce5cbe85
-
Filesize
1.1MB
MD576c40149b0f69c5665d385b82902886e
SHA1764943417c9e7210f665573062af350d91e0da87
SHA256cfd3622bf94fdc5308862e61697d0fc00a6038493fe5686a230979b9e7f2fe0e
SHA5129d41a030755fcad143f391fa48069872969ed90828cf882420289d8c4e25b9b59d29758d699d5698d46a83472fac7887ab4fd0a8eddd4b570c7f53ed6ba504bd