Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 20:18
Static task
static1
Behavioral task
behavioral1
Sample
r8ykXfy52F9CXd5d.exe
Resource
win7-20240903-en
General
-
Target
r8ykXfy52F9CXd5d.exe
-
Size
759KB
-
MD5
6341110aa0627431093ef3c502f65669
-
SHA1
12dd6b363e9d841bce3fd0c007b1e84796909149
-
SHA256
761930655c92d23751075c7399bc4d384270fdeab881a8c486de0362a976b4d0
-
SHA512
2aee95c0f40f86f6c505cabeb2797aab5e587b3021c40156c2f5bff0ebc5d6787c5975a1978a4747a303e7cdba637498bac923a7e633931dd79b62feffaa8224
-
SSDEEP
12288:IQ11UoIG5MPUNDguQL6/Vt+uIMtBLn6TnfymJVDgP5BhMW+:lUobySgu26t/IMt16OmJidMW+
Malware Config
Extracted
formbook
4.1
he2a
070001606.xyz
jesuseascriancas.online
as-eltransport.xyz
bankditalia-company.online
linkedin-stijngraat.online
sportsbetd.xyz
spanish-classes-76893.bond
infonation.pro
nxwzbze.forum
rush-pay.biz
fulfillmissions.lat
infolungcancer.xyz
aqario.xyz
omepro.solar
jackmanmueshl.shop
amcart.store
ishanaudichya.xyz
sun4rk.shop
depression-test-74287.bond
chipit.shop
aulagaminggear.shop
bxc3465.top
credit-rapide-sans-refus.bond
securesavings.ltd
hasanbasriuzun.shop
apolo77meledak.fun
notbokin.online
ethost.biz
cicek-suslemeleri.shop
fashionistahaven.net
opentelemetry.shop
bunny-decor.shop
mersar.fun
send-me-your-feet.pics
intap.shop
supergeoet.best
security-apps-89466.bond
ldentityone.net
b9h.pro
farms-sophon.xyz
shadow-walker.online
jjkdd.vip
yrotf.top
influencer-marketing-47216.bond
dfbfanclub.shop
quarterdeck.cfd
mexico-vacations-packages.today
online-gaming-66785.bond
crowsecurity.online
fmi-lostdevice.live
protesisdentalfijaprecio.bond
tcfsi.info
memecoin.vote
walk-in-tubs-65827.bond
linkvin777.top
serenitymassage.top
hostmyworld.net
searchgpt.world
blankmedspa.gallery
mattress-17708.bond
sedanghokiorg.info
funzone365.shop
metacuore.net
coldzero.top
sdcollections.shop
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/644-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/644-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1900-21-0x0000000000310000-0x000000000033F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 232 set thread context of 644 232 r8ykXfy52F9CXd5d.exe 94 PID 644 set thread context of 3612 644 r8ykXfy52F9CXd5d.exe 56 PID 1900 set thread context of 3612 1900 help.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language r8ykXfy52F9CXd5d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language help.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 232 r8ykXfy52F9CXd5d.exe 232 r8ykXfy52F9CXd5d.exe 644 r8ykXfy52F9CXd5d.exe 644 r8ykXfy52F9CXd5d.exe 644 r8ykXfy52F9CXd5d.exe 644 r8ykXfy52F9CXd5d.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe 1900 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 644 r8ykXfy52F9CXd5d.exe 644 r8ykXfy52F9CXd5d.exe 644 r8ykXfy52F9CXd5d.exe 1900 help.exe 1900 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 232 r8ykXfy52F9CXd5d.exe Token: SeDebugPrivilege 644 r8ykXfy52F9CXd5d.exe Token: SeDebugPrivilege 1900 help.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3612 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 232 wrote to memory of 468 232 r8ykXfy52F9CXd5d.exe 93 PID 232 wrote to memory of 468 232 r8ykXfy52F9CXd5d.exe 93 PID 232 wrote to memory of 468 232 r8ykXfy52F9CXd5d.exe 93 PID 232 wrote to memory of 644 232 r8ykXfy52F9CXd5d.exe 94 PID 232 wrote to memory of 644 232 r8ykXfy52F9CXd5d.exe 94 PID 232 wrote to memory of 644 232 r8ykXfy52F9CXd5d.exe 94 PID 232 wrote to memory of 644 232 r8ykXfy52F9CXd5d.exe 94 PID 232 wrote to memory of 644 232 r8ykXfy52F9CXd5d.exe 94 PID 232 wrote to memory of 644 232 r8ykXfy52F9CXd5d.exe 94 PID 3612 wrote to memory of 1900 3612 Explorer.EXE 95 PID 3612 wrote to memory of 1900 3612 Explorer.EXE 95 PID 3612 wrote to memory of 1900 3612 Explorer.EXE 95 PID 1900 wrote to memory of 4092 1900 help.exe 96 PID 1900 wrote to memory of 4092 1900 help.exe 96 PID 1900 wrote to memory of 4092 1900 help.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\r8ykXfy52F9CXd5d.exe"C:\Users\Admin\AppData\Local\Temp\r8ykXfy52F9CXd5d.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\r8ykXfy52F9CXd5d.exe"C:\Users\Admin\AppData\Local\Temp\r8ykXfy52F9CXd5d.exe"3⤵PID:468
-
-
C:\Users\Admin\AppData\Local\Temp\r8ykXfy52F9CXd5d.exe"C:\Users\Admin\AppData\Local\Temp\r8ykXfy52F9CXd5d.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:644
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\r8ykXfy52F9CXd5d.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4092
-
-