Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 07:06
Behavioral task
behavioral1
Sample
Invoice, Parking List.exe
Resource
win7-20240903-en
General
-
Target
Invoice, Parking List.exe
-
Size
758KB
-
MD5
6e39ee33f6527364cac3cc4bbf276f26
-
SHA1
a7c12eef84ae778ce5158327d419508eb5b199c8
-
SHA256
1a52416bc054c0f2a46f2fd215d73d3285334fcdacf02ed449935bd93fb70863
-
SHA512
d06164091fe866df2626377b2d2589d9da291c73aff55b40db1844e32290c1f5e37b1ba8155ee02a351366df5a8862ce0b2e5b28a9b14b65cd568064cde28a78
-
SSDEEP
12288:v6Wq4aaE6KwyF5L0Y2D1PqLVRX3OyQsAhJYUVTx6AflSeqz2jqPB88bYVUCYH5g:tthEVaPqL7nvQlhJYATxDYeHjqPB88ZO
Malware Config
Extracted
formbook
4.1
c89p
ftersaleb.top
dcustomdesgins.net
ostbet2024.live
rhgtrdjdjytkyhretrdjfytd.buzz
atauniversity.tech
idoctor365.net
x-design-courses-29670.bond
ellowold-pc.top
ransportationmmsytpro.top
areerfest.xyz
artiresbah-in.today
ijie.pro
torehousestudio.info
69-11-luxury-watches.shop
earing-tests-44243.bond
hits.shop
hzl9.bond
lood-test-jp-1.bond
livialiving.online
usymomsmakingmoney.online
olar-systems-panels-61747.bond
hinawinner.top
oldensky10.xyz
oginsuperking777.click
oviepicker.net
partment-rental05.online
ldkp.net
sofaerb.shop
ydh5.beauty
aston-saaaa.buzz
acuum-cleaner-84018.bond
usiness-printer-37559.bond
dindadisini12.click
j7zd12m.xyz
plesacv.xyz
trustcapital247.online
asapembuatanpatung.online
ent-all.xyz
r64mh1.vip
aser-cap-hair-growth.today
amattva.company
herightfits.top
uickautoquote.net
ctu36ojboz6w2cl.asia
oursmile.vip
astysavor.website
iam-saaab.buzz
igmoto.info
itchellcohen.net
un-sea.fun
steticavonixx.shop
arklife.shop
bsboffchatrussummsa.online
iuxing.asia
okenexchange.art
llhealthreview.online
refabricated-homes-53685.bond
atercraze.net
osmits.net
rail.cruises
utanginamo.sbs
hapanda.fun
arehouse-inventory-29693.bond
innivip.bio
aycare-service-99683.bond
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1484-4-0x00000000004B0000-0x00000000004DF000-memory.dmp formbook behavioral2/memory/1484-10-0x00000000004B0000-0x00000000004DF000-memory.dmp formbook behavioral2/memory/1480-16-0x0000000000800000-0x000000000082F000-memory.dmp formbook -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3660-8-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3660 set thread context of 1484 3660 Invoice, Parking List.exe 82 PID 1484 set thread context of 3436 1484 svchost.exe 56 PID 1480 set thread context of 3436 1480 raserver.exe 56 -
resource yara_rule behavioral2/memory/3660-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3660-8-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Invoice, Parking List.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1484 svchost.exe 1484 svchost.exe 1484 svchost.exe 1484 svchost.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe 1480 raserver.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3660 Invoice, Parking List.exe 3660 Invoice, Parking List.exe 1484 svchost.exe 1484 svchost.exe 1484 svchost.exe 1480 raserver.exe 1480 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1484 svchost.exe Token: SeDebugPrivilege 1480 raserver.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 3660 Invoice, Parking List.exe 3660 Invoice, Parking List.exe 3660 Invoice, Parking List.exe 3660 Invoice, Parking List.exe 3660 Invoice, Parking List.exe 3660 Invoice, Parking List.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 3660 Invoice, Parking List.exe 3660 Invoice, Parking List.exe 3660 Invoice, Parking List.exe 3660 Invoice, Parking List.exe 3660 Invoice, Parking List.exe 3660 Invoice, Parking List.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3660 wrote to memory of 1484 3660 Invoice, Parking List.exe 82 PID 3660 wrote to memory of 1484 3660 Invoice, Parking List.exe 82 PID 3660 wrote to memory of 1484 3660 Invoice, Parking List.exe 82 PID 3660 wrote to memory of 1484 3660 Invoice, Parking List.exe 82 PID 3436 wrote to memory of 1480 3436 Explorer.EXE 83 PID 3436 wrote to memory of 1480 3436 Explorer.EXE 83 PID 3436 wrote to memory of 1480 3436 Explorer.EXE 83 PID 1480 wrote to memory of 2872 1480 raserver.exe 88 PID 1480 wrote to memory of 2872 1480 raserver.exe 88 PID 1480 wrote to memory of 2872 1480 raserver.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\Invoice, Parking List.exe"C:\Users\Admin\AppData\Local\Temp\Invoice, Parking List.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Invoice, Parking List.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1484
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2872
-
-