Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 02:34
Static task
static1
Behavioral task
behavioral1
Sample
pago.exe
Resource
win7-20240704-en
General
-
Target
pago.exe
-
Size
588KB
-
MD5
cc0a03d130918f8d5c8d6b46833967b1
-
SHA1
35edc921398ba4d5689e5bcced856c0f2d561c70
-
SHA256
1d5c6a9f196dc3d9f2e483744d7b872f01a96b8320ce3ffdc66b66542cb7a899
-
SHA512
78316ff0363c7cc9cc5dedab407b9dc3394c27eb15fba416a04996f117b473814a808e6847c4c2b779ceaa66f22d843b13b36530e969c675edc1222d76c99873
-
SSDEEP
12288:2aTdEMYimT/D37YF6oRZyWwJAA9X8gnd7/OKImE3hoTSO3XHL:CMo30pZxwJAA9X8Y/ohoTx37
Malware Config
Extracted
formbook
4.1
m10i
rmani.today
ifebork.xyz
randovation.net
itchen-remodeling-65686.bond
himu.world
reverie.net
9038.top
rowahome.live
obility-scooters-63189.bond
iangchunqiu.top
yhd.fun
eniorsforseniors.biz
z9zs2.shop
kkjinni.buzz
22av373vu.autos
allnyy.fun
qst.digital
rcap.info
745.top
earfulabjectshirkwashclothe.cfd
ntercadpay24.buzz
s8888.cyou
nder168.xyz
all-panels-33592.bond
hristopher-saaac.buzz
mba-online-us-726.online
ddnzctx.skin
rkuvatov.online
63ce562zy.bond
averickhealth.online
earing-clinic-support.xyz
athroom-remodeling-33073.bond
erkalo-champion-casino-esx.buzz
z0725d9ajj.cloud
ental-health-34951.bond
yfish.info
dmstandard.net
ood-packing-job-ww3.today
u263.top
olototo.website
blezuy.xyz
jamiliakha.online
otorcycle-license-80718.bond
orazon.group
uberginefoesgfl.shop
mlprod.vip
1lotary.fun
antacatalina.info
rody-paaac.buzz
nline-teaching-41955.bond
x91589.lol
aradisosogrenciyurdu.xyz
ymigrationdocuments.net
ortalsaludvida.online
tyhbv.xyz
2zd3.bond
okuj2346.vip
oolster.shop
lairnso.top
789.xyz
iepenstock-luedenscheid.audi
hittonrealty.net
ransfer-wise.net
hathamhouse.digital
assioninstitute.online
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/3924-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3924-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3200-73-0x0000000000B80000-0x0000000000BAF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3036 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation pago.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 432 set thread context of 3924 432 pago.exe 94 PID 3924 set thread context of 3452 3924 pago.exe 56 PID 3200 set thread context of 3452 3200 raserver.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pago.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 3924 pago.exe 3924 pago.exe 3924 pago.exe 3924 pago.exe 3036 powershell.exe 3036 powershell.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe 3200 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3924 pago.exe 3924 pago.exe 3924 pago.exe 3200 raserver.exe 3200 raserver.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3924 pago.exe Token: SeDebugPrivilege 3036 powershell.exe Token: SeDebugPrivilege 3200 raserver.exe Token: SeShutdownPrivilege 3452 Explorer.EXE Token: SeCreatePagefilePrivilege 3452 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3452 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 432 wrote to memory of 3036 432 pago.exe 92 PID 432 wrote to memory of 3036 432 pago.exe 92 PID 432 wrote to memory of 3036 432 pago.exe 92 PID 432 wrote to memory of 3924 432 pago.exe 94 PID 432 wrote to memory of 3924 432 pago.exe 94 PID 432 wrote to memory of 3924 432 pago.exe 94 PID 432 wrote to memory of 3924 432 pago.exe 94 PID 432 wrote to memory of 3924 432 pago.exe 94 PID 432 wrote to memory of 3924 432 pago.exe 94 PID 3452 wrote to memory of 3200 3452 Explorer.EXE 95 PID 3452 wrote to memory of 3200 3452 Explorer.EXE 95 PID 3452 wrote to memory of 3200 3452 Explorer.EXE 95 PID 3200 wrote to memory of 1632 3200 raserver.exe 97 PID 3200 wrote to memory of 1632 3200 raserver.exe 97 PID 3200 wrote to memory of 1632 3200 raserver.exe 97
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\pago.exe"C:\Users\Admin\AppData\Local\Temp\pago.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\pago.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
C:\Users\Admin\AppData\Local\Temp\pago.exe"C:\Users\Admin\AppData\Local\Temp\pago.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pago.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1632
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82