Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe
Resource
win7-20240903-en
General
-
Target
2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe
-
Size
671KB
-
MD5
08e03e1ac072ae4e33b1483cd77621e8
-
SHA1
c349bb0f328ada0a3324ff01d4159aac2c591017
-
SHA256
2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a
-
SHA512
656b6a16ff32ddb4afe7dbbb143914e0dcba6d1649b4e7e79b644f950f90d1cea29c3de3c81eaef77cd2bc2aada3eae322538aad1d51a64e65cfde26984448ba
-
SSDEEP
12288:1A1tMlqW2L+IRadx/4fqYS8R6FBREVrRFi49hkR:1GtMGL+IRm/YqY1R6LiJry
Malware Config
Extracted
formbook
4.1
m49z
ormswarm.xyz
awn-care-63587.bond
uymetanail5.online
mergencyloan007.xyz
545.top
eiliao596.pro
ackersandmoverschennai.net
ehdiahmadvandmusicbest.click
tlgxmb2024.cloud
ulfcoastharborhopper.pro
rohns-disease-early-signs.today
oldenhorizonsbgcl.click
weetindulgencepro.xyz
yexoiup.xyz
yself-solar.net
kfirsatimla.online
bropub3.online
ouljourney.online
usvf76f.shop
onnaberich.online
erminia.net
nline-advertising-91281.bond
pt-23.live
ayhentai.vip
ockyjapan.net
est-mortgage-loan-2507.today
uikfox.click
870077.vip
hzjjys88.vip
hayrain.shop
63638d.xyz
ines.cafe
oomed.shop
addy-cazino.online
ellybharat.net
razeonthego.net
ickbrady.dev
872277.vip
nwoebz.shop
udatoga.xyz
j10j.xyz
utogongcom.net
14oz957dd.autos
sgarasjeport.online
xrmxfh150.xyz
3win2.top
alrv9s8.christmas
0847.photo
aturally-canadian.beauty
artnelide.top
ropertiesforrentfr.bond
j11j.xyz
otaislifexd.xyz
zesuteta.shop
avaburrn.rest
azavivianonline.tech
ealthcare-software-96535.bond
atrixdon.online
group.tech
ertiberiaterra.net
pneesxw.christmas
assaporteapn.shop
hangwuyi.cfd
ounter-courses.world
ysticastrospain.online
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2216-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2216-22-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2940-23-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2920 powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3044 set thread context of 2216 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 33 PID 2216 set thread context of 1076 2216 RegSvcs.exe 18 PID 2940 set thread context of 1076 2940 help.exe 18 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language help.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2216 RegSvcs.exe 2216 RegSvcs.exe 2920 powershell.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe 2940 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2216 RegSvcs.exe 2216 RegSvcs.exe 2216 RegSvcs.exe 2940 help.exe 2940 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2216 RegSvcs.exe Token: SeDebugPrivilege 2920 powershell.exe Token: SeDebugPrivilege 2940 help.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2920 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 31 PID 3044 wrote to memory of 2920 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 31 PID 3044 wrote to memory of 2920 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 31 PID 3044 wrote to memory of 2920 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 31 PID 3044 wrote to memory of 2216 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 33 PID 3044 wrote to memory of 2216 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 33 PID 3044 wrote to memory of 2216 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 33 PID 3044 wrote to memory of 2216 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 33 PID 3044 wrote to memory of 2216 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 33 PID 3044 wrote to memory of 2216 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 33 PID 3044 wrote to memory of 2216 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 33 PID 3044 wrote to memory of 2216 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 33 PID 3044 wrote to memory of 2216 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 33 PID 3044 wrote to memory of 2216 3044 2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe 33 PID 1076 wrote to memory of 2940 1076 Explorer.EXE 34 PID 1076 wrote to memory of 2940 1076 Explorer.EXE 34 PID 1076 wrote to memory of 2940 1076 Explorer.EXE 34 PID 1076 wrote to memory of 2940 1076 Explorer.EXE 34 PID 2940 wrote to memory of 2868 2940 help.exe 35 PID 2940 wrote to memory of 2868 2940 help.exe 35 PID 2940 wrote to memory of 2868 2940 help.exe 35 PID 2940 wrote to memory of 2868 2940 help.exe 35
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe"C:\Users\Admin\AppData\Local\Temp\2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2868
-
-