Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 04:58
Static task
static1
Behavioral task
behavioral1
Sample
PFmJ9j7Ndg2NERo.exe
Resource
win7-20240903-en
General
-
Target
PFmJ9j7Ndg2NERo.exe
-
Size
644KB
-
MD5
82f8c097337d6303b9b600515237006b
-
SHA1
91baaee26748c313f01940a6da9248b05b52187c
-
SHA256
3ba65c5187bfaf51f020ce9e3f36fe8b4effd7b91c5f2b1ff46b245580ade156
-
SHA512
7da9392c1a6db5ad0728a566fb1cd7cb3aef38a8e496f7d9931e02ce0ea86e8cbc303a402aa4cf10d667e23be3be303fadf3cbe9ad068530c7b71af88e446f04
-
SSDEEP
12288:3DzJpZqhzZQ2+P5SNJFS5lWW9jkWsTSuNt0/PIViwt5XHU:PdqhzaTyJFi9j/UN+/Psiw5
Malware Config
Extracted
formbook
4.1
b31a
enjamin-paaac.buzz
mail-marketing-40950.bond
pusems28-post.cyou
hindo.top
ruck-company-be.today
asinos-deutschland.net
ewancash.boats
etdopovo.casino
rcher-saaac.buzz
871166.vip
manuel.app
g3yqo.shop
-9way.xyz
qawgytfexe.bond
iefi6834.vip
ental-health-35901.bond
idat-merkez18.top
rojectleadzone.website
lirudolph.top
migloballlc.online
utebolshirts.shop
i-tools-57602.bond
itchen-889.bond
hewieandfriends.info
tlchurch.net
arolmodasgpuava.online
indjuvedermdoctorsnearby.today
auwin-daftar.xyz
arden-sheds-23886.bond
2239d3.christmas
irablog.xyz
remation-services-88863.bond
ehxk3u7.forum
resdai.xyz
61pk48ln.autos
-web-p102.buzz
eb2125.info
ole-xaaaa.buzz
lc-driving-school.net
igh-class-jewelry.info
66gd660du.bond
ixi.asia
aemoruhagic.click
entalcare-us2-borysfb.today
olf-cart-82894.bond
algrup.net
usanscanneritaly63.sbs
ames666.xyz
ockycanada.net
bykmr.shop
gpmedia.app
avada-ga-34.press
igraine-treatment-33058.bond
heodore-saaab.buzz
ashforhouse19.online
48827496.top
mazonun.top
lstrk.fun
hegdg.net
nssmodule.center
sksiniaja7.buzz
uneytozgur.online
orri.shop
ras-us-1.bond
awlc7038.vip
Signatures
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2288-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2288-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2288-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2996-28-0x0000000000070000-0x000000000009F000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2644 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2136 set thread context of 2288 2136 PFmJ9j7Ndg2NERo.exe 28 PID 2288 set thread context of 1216 2288 PFmJ9j7Ndg2NERo.exe 21 PID 2288 set thread context of 1216 2288 PFmJ9j7Ndg2NERo.exe 21 PID 2996 set thread context of 1216 2996 cscript.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFmJ9j7Ndg2NERo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2136 PFmJ9j7Ndg2NERo.exe 2136 PFmJ9j7Ndg2NERo.exe 2288 PFmJ9j7Ndg2NERo.exe 2288 PFmJ9j7Ndg2NERo.exe 2288 PFmJ9j7Ndg2NERo.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe 2996 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2288 PFmJ9j7Ndg2NERo.exe 2288 PFmJ9j7Ndg2NERo.exe 2288 PFmJ9j7Ndg2NERo.exe 2288 PFmJ9j7Ndg2NERo.exe 2996 cscript.exe 2996 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2136 PFmJ9j7Ndg2NERo.exe Token: SeDebugPrivilege 2288 PFmJ9j7Ndg2NERo.exe Token: SeDebugPrivilege 2996 cscript.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2288 2136 PFmJ9j7Ndg2NERo.exe 28 PID 2136 wrote to memory of 2288 2136 PFmJ9j7Ndg2NERo.exe 28 PID 2136 wrote to memory of 2288 2136 PFmJ9j7Ndg2NERo.exe 28 PID 2136 wrote to memory of 2288 2136 PFmJ9j7Ndg2NERo.exe 28 PID 2136 wrote to memory of 2288 2136 PFmJ9j7Ndg2NERo.exe 28 PID 2136 wrote to memory of 2288 2136 PFmJ9j7Ndg2NERo.exe 28 PID 2136 wrote to memory of 2288 2136 PFmJ9j7Ndg2NERo.exe 28 PID 1216 wrote to memory of 2996 1216 Explorer.EXE 31 PID 1216 wrote to memory of 2996 1216 Explorer.EXE 31 PID 1216 wrote to memory of 2996 1216 Explorer.EXE 31 PID 1216 wrote to memory of 2996 1216 Explorer.EXE 31 PID 2996 wrote to memory of 2644 2996 cscript.exe 32 PID 2996 wrote to memory of 2644 2996 cscript.exe 32 PID 2996 wrote to memory of 2644 2996 cscript.exe 32 PID 2996 wrote to memory of 2644 2996 cscript.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\PFmJ9j7Ndg2NERo.exe"C:\Users\Admin\AppData\Local\Temp\PFmJ9j7Ndg2NERo.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\PFmJ9j7Ndg2NERo.exe"C:\Users\Admin\AppData\Local\Temp\PFmJ9j7Ndg2NERo.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PFmJ9j7Ndg2NERo.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2644
-
-