Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 03:49
Static task
static1
Behavioral task
behavioral1
Sample
LVThgpHFRmrdHY0.exe
Resource
win7-20240903-en
General
-
Target
LVThgpHFRmrdHY0.exe
-
Size
611KB
-
MD5
509cdfecf3cf6fe8d3def69f6c64e9de
-
SHA1
d2b20716d3b7601506fb31551d5f235a117d4277
-
SHA256
c601518d243a95bd69059eee0bd30095ecd0bc33f2ffce671b695145429913b1
-
SHA512
c93a06b7df80ac9896bf40bacce1d64036a4d5ace3ef94fb456c4f5c7df98fecb8bfde421bb95c2e2f57552ce5349d6f243f5e521dfffe7374ebb47dddc5f233
-
SSDEEP
12288:YP7kvDoQ7+M+fjf+oH3bMyuhVAJ2LsBwaUJ/H1S0DM:YPonR+fj2bpVA4B+0I
Malware Config
Extracted
formbook
4.1
b31a
enjamin-paaac.buzz
mail-marketing-40950.bond
pusems28-post.cyou
hindo.top
ruck-company-be.today
asinos-deutschland.net
ewancash.boats
etdopovo.casino
rcher-saaac.buzz
871166.vip
manuel.app
g3yqo.shop
-9way.xyz
qawgytfexe.bond
iefi6834.vip
ental-health-35901.bond
idat-merkez18.top
rojectleadzone.website
lirudolph.top
migloballlc.online
utebolshirts.shop
i-tools-57602.bond
itchen-889.bond
hewieandfriends.info
tlchurch.net
arolmodasgpuava.online
indjuvedermdoctorsnearby.today
auwin-daftar.xyz
arden-sheds-23886.bond
2239d3.christmas
irablog.xyz
remation-services-88863.bond
ehxk3u7.forum
resdai.xyz
61pk48ln.autos
-web-p102.buzz
eb2125.info
ole-xaaaa.buzz
lc-driving-school.net
igh-class-jewelry.info
66gd660du.bond
ixi.asia
aemoruhagic.click
entalcare-us2-borysfb.today
olf-cart-82894.bond
algrup.net
usanscanneritaly63.sbs
ames666.xyz
ockycanada.net
bykmr.shop
gpmedia.app
avada-ga-34.press
igraine-treatment-33058.bond
heodore-saaab.buzz
ashforhouse19.online
48827496.top
mazonun.top
lstrk.fun
hegdg.net
nssmodule.center
sksiniaja7.buzz
uneytozgur.online
orri.shop
ras-us-1.bond
awlc7038.vip
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/2280-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2280-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2280-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1344-27-0x0000000001070000-0x000000000109F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 744 set thread context of 2280 744 LVThgpHFRmrdHY0.exe 87 PID 2280 set thread context of 3380 2280 LVThgpHFRmrdHY0.exe 56 PID 2280 set thread context of 3380 2280 LVThgpHFRmrdHY0.exe 56 PID 1344 set thread context of 3380 1344 mstsc.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVThgpHFRmrdHY0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 744 LVThgpHFRmrdHY0.exe 744 LVThgpHFRmrdHY0.exe 2280 LVThgpHFRmrdHY0.exe 2280 LVThgpHFRmrdHY0.exe 2280 LVThgpHFRmrdHY0.exe 2280 LVThgpHFRmrdHY0.exe 2280 LVThgpHFRmrdHY0.exe 2280 LVThgpHFRmrdHY0.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe 1344 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2280 LVThgpHFRmrdHY0.exe 2280 LVThgpHFRmrdHY0.exe 2280 LVThgpHFRmrdHY0.exe 2280 LVThgpHFRmrdHY0.exe 1344 mstsc.exe 1344 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 744 LVThgpHFRmrdHY0.exe Token: SeDebugPrivilege 2280 LVThgpHFRmrdHY0.exe Token: SeDebugPrivilege 1344 mstsc.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3380 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 744 wrote to memory of 2280 744 LVThgpHFRmrdHY0.exe 87 PID 744 wrote to memory of 2280 744 LVThgpHFRmrdHY0.exe 87 PID 744 wrote to memory of 2280 744 LVThgpHFRmrdHY0.exe 87 PID 744 wrote to memory of 2280 744 LVThgpHFRmrdHY0.exe 87 PID 744 wrote to memory of 2280 744 LVThgpHFRmrdHY0.exe 87 PID 744 wrote to memory of 2280 744 LVThgpHFRmrdHY0.exe 87 PID 3380 wrote to memory of 1344 3380 Explorer.EXE 92 PID 3380 wrote to memory of 1344 3380 Explorer.EXE 92 PID 3380 wrote to memory of 1344 3380 Explorer.EXE 92 PID 1344 wrote to memory of 4596 1344 mstsc.exe 94 PID 1344 wrote to memory of 4596 1344 mstsc.exe 94 PID 1344 wrote to memory of 4596 1344 mstsc.exe 94
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\LVThgpHFRmrdHY0.exe"C:\Users\Admin\AppData\Local\Temp\LVThgpHFRmrdHY0.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\LVThgpHFRmrdHY0.exe"C:\Users\Admin\AppData\Local\Temp\LVThgpHFRmrdHY0.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\LVThgpHFRmrdHY0.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4596
-
-