Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
247s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/09/2024, 07:27
Static task
static1
Behavioral task
behavioral1
Sample
fattura di pagamento.exe
Resource
win7-20240903-en
General
-
Target
fattura di pagamento.exe
-
Size
1.1MB
-
MD5
1b279ea4e3f5c082c7ec98c138e86c1c
-
SHA1
7f4a38dadd8891334f49d07359933d41c8830f67
-
SHA256
77fa31d14cbf45df9fb36ebe8a7252e18cffca5add1d9a52a601b44367b5aad5
-
SHA512
e441b8967f27a4f03fd5bbd1140e00394190cb92afd9c4eb3c7076ac50a424ed2102ce3e478f4550f5e3f03cb87f892733703d745637a3cdafe834b1ea4a46ca
-
SSDEEP
24576:0RmJkcoQricOIQxiZY1iaBPXyiJqQEa7bEw20doU7OiCjNd:RJZoQrbTFZY1iaBPseEw20frid
Malware Config
Extracted
formbook
4.1
nu01
ickleball.codes
avornow.top
rejike.shop
zean.pro
yanbeyan.net
atwithsushi.fun
heimpactphilanthropy.info
ersonal-loans-82514.bond
pringfestpro.xyz
eniorhousings.live
anda-tax.online
d8ul135j.top
nder168.xyz
ealthcare-softwares-my-pl.xyz
7w1q.bond
83167836550.online
etinjo.net
hukira.xyz
ocalip.cloud
cqnh6.digital
503.top
lockchaincommunity.africa
q2vtm.club
6yy.xyz
inling.world
edroomsinmx-in.bond
oing3.cfd
ite.style
v7spf78.christmas
lein-curacao.info
rkyzgnmwd.xyz
ar-loans-86831.bond
outh32hubs.top
agamento-aiiepress.online
utritionistscourse.shop
nvaya.info
ygqntly.shop
heur365swiss.net
uelcard112.shop
eluniverses.xyz
panish-classes-62417.bond
ndsm.top
g6z5ndpx.mobi
ociobuzzyour.top
hiagency.net
ankeverything.net
nline-dating-sf-dz.online
all.school
0f57.bond
arinelayersaleshops.shop
askuda.pro
pttraining.info
riginaltheme.shop
nlinesuccesswithben.biz
jane1620.club
ysnails.net
ompleteconciergeliving.xyz
u-opts.shop
eamkakakads177.buzz
ealthcare-trends-60670.bond
t0rm23.top
gfdro.xyz
oundwav.xyz
ugarshift.net
trategicgrowthpartner.app
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2828-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2828-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1188-12-0x0000000000070000-0x000000000009F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2420 set thread context of 2828 2420 fattura di pagamento.exe 29 PID 2828 set thread context of 1364 2828 svchost.exe 20 PID 1188 set thread context of 1364 1188 cscript.exe 20 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fattura di pagamento.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 2828 svchost.exe 2828 svchost.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe 1188 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2420 fattura di pagamento.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 1188 cscript.exe 1188 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2828 svchost.exe Token: SeDebugPrivilege 1188 cscript.exe Token: SeShutdownPrivilege 1364 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2828 2420 fattura di pagamento.exe 29 PID 2420 wrote to memory of 2828 2420 fattura di pagamento.exe 29 PID 2420 wrote to memory of 2828 2420 fattura di pagamento.exe 29 PID 2420 wrote to memory of 2828 2420 fattura di pagamento.exe 29 PID 2420 wrote to memory of 2828 2420 fattura di pagamento.exe 29 PID 1364 wrote to memory of 1188 1364 Explorer.EXE 30 PID 1364 wrote to memory of 1188 1364 Explorer.EXE 30 PID 1364 wrote to memory of 1188 1364 Explorer.EXE 30 PID 1364 wrote to memory of 1188 1364 Explorer.EXE 30 PID 1188 wrote to memory of 2868 1188 cscript.exe 31 PID 1188 wrote to memory of 2868 1188 cscript.exe 31 PID 1188 wrote to memory of 2868 1188 cscript.exe 31 PID 1188 wrote to memory of 2868 1188 cscript.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\fattura di pagamento.exe"C:\Users\Admin\AppData\Local\Temp\fattura di pagamento.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\fattura di pagamento.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2868
-
-