Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 02:01
Static task
static1
Behavioral task
behavioral1
Sample
EDG950202407.exe
Resource
win7-20240903-en
General
-
Target
EDG950202407.exe
-
Size
1.1MB
-
MD5
997638b13b3e24a155d45cb73bee1624
-
SHA1
9e97cfec83e40a8f847c953aff08309c06cccf6a
-
SHA256
4fe0627df409d563c49daaace6f559559c940ccf1d19e73dc3480a33f86ed9a3
-
SHA512
11c37787e1c340d0674103b9b8c3e64b9a324a14f1f20cf045e03c766f9220065b81cf99793ab45c0a40c7fea019f0e57263fc70160fb3291d5544db03c54970
-
SSDEEP
24576:7AHnh+eWsN3skA4RV1Hom2KXMmHaisMQtytsGy5:Wh+ZkldoPK8YaisMQt9H
Malware Config
Extracted
formbook
4.1
bi05
ollow-the-bit.online
aopho.autos
14ra567dp.autos
48651301.top
ussian-dating-54714.bond
sychology-degree-80838.bond
lytracker.xyz
strology-forest.sbs
swjbcl3.top
ridgenexttechnologies.partners
lroy.sbs
kyscreen.vip
anhit.live
uckyheart.xyz
orddserials.online
hetune.shop
nherited-traits-ant.bond
stanaslot-1.xyz
sychologist-therapy-36914.bond
iandramonami.net
5125.photo
p-fmweb002c684.top
x-scissor-lifts-glob-512.today
7winvn.net
oudya.shop
enks.top
ashion247.shop
oadtekpaving.net
istinctcsolutions.net
sjin.info
ata-protection-30362.bond
pfrt-22-mb.click
ucknowgames.info
nnovadis.online
gent.business
ffordableimpoundedcars.online
ort.lol
kwow.top
s-usdt.top
vnaiinew.info
rm888.shop
hnbakery.shop
hisismylguana.xyz
panish-classes-87877.bond
olan-paaaa.buzz
lkiv.xyz
hp520.xyz
uocdiengiai.website
fx168.shop
erapiacontraeldolor.net
ortal-bfl.online
antoshy.online
ruises-treatment-93183.bond
ursociotheory.xyz
9243.net
ingerie-43588.bond
udistsex.top
refabricated-homes-72652.bond
mail-marketing-91020.bond
d7xey20.top
7-casino-zsl.buzz
isualquotations.xyz
dn8pvdr.forum
dormy.click
hyma.cyou
Signatures
-
Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/5436-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3964-18-0x0000000000FD0000-0x0000000000FFF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1056 set thread context of 5436 1056 EDG950202407.exe 87 PID 5436 set thread context of 3568 5436 svchost.exe 56 PID 3964 set thread context of 3568 3964 chkdsk.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDG950202407.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chkdsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 5436 svchost.exe 5436 svchost.exe 5436 svchost.exe 5436 svchost.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe 3964 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1056 EDG950202407.exe 5436 svchost.exe 5436 svchost.exe 5436 svchost.exe 3964 chkdsk.exe 3964 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5436 svchost.exe Token: SeDebugPrivilege 3964 chkdsk.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1056 EDG950202407.exe 1056 EDG950202407.exe 1056 EDG950202407.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1056 EDG950202407.exe 1056 EDG950202407.exe 1056 EDG950202407.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3568 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1056 wrote to memory of 5436 1056 EDG950202407.exe 87 PID 1056 wrote to memory of 5436 1056 EDG950202407.exe 87 PID 1056 wrote to memory of 5436 1056 EDG950202407.exe 87 PID 1056 wrote to memory of 5436 1056 EDG950202407.exe 87 PID 3568 wrote to memory of 3964 3568 Explorer.EXE 88 PID 3568 wrote to memory of 3964 3568 Explorer.EXE 88 PID 3568 wrote to memory of 3964 3568 Explorer.EXE 88 PID 3964 wrote to memory of 5772 3964 chkdsk.exe 89 PID 3964 wrote to memory of 5772 3964 chkdsk.exe 89 PID 3964 wrote to memory of 5772 3964 chkdsk.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\EDG950202407.exe"C:\Users\Admin\AppData\Local\Temp\EDG950202407.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\EDG950202407.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5436
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:5772
-
-