Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 01:44
Static task
static1
Behavioral task
behavioral1
Sample
NEW PO - 24101.exe
Resource
win7-20240903-en
General
-
Target
NEW PO - 24101.exe
-
Size
1.1MB
-
MD5
2101224c25b008724832b22df4b2f33f
-
SHA1
1ab2163ad4933dfa6e9b7c9809bdd47f0d3f8ed1
-
SHA256
ed3c955db72dc944a905068be7dc2c7668c4de73be2c5efe3307b16e60e901a3
-
SHA512
c0d9f0a4294e06d25d7f94efe1ea82d4c98a2500abd1174d5979f97f8a0b01ac24a256d468b39609356a313521866942ba596012e34bc7f2b00dd7a8e6f77a3e
-
SSDEEP
24576:ffmMv6Ckr7Mny5QLP9dGCLj5+F3kJnwahiA1:f3v+7/5QLP9dDLj5Q0VXh31
Malware Config
Extracted
formbook
4.1
c24t
ealthbridgeccs.online
ngelicais.art
uktuksu1.sbs
fapoker.asia
hecreature.tech
orenzoplaybest14.xyz
op-smartphones-deal.today
delark.click
7395.asia
otnews.cfd
j16e.xyz
oko.events
fscxb.top
roudtxliberals.vote
asas-br.bond
ourhealthyourlife.shop
fbpd.top
j9u9.xyz
uijiuw.top
aming-chair-37588.bond
uaweiharmony.top
458881233.men
ewancash.boats
mss-rb2.net
472.top
yhomeshop.online
j88.travel
02s-pest-control-us-ze.fun
oinl.club
ouseware.today
1385.net
eviewmadu.top
khizmetlergirisyapzzz2024.net
dcnn.net
aketrtpmvpslot88.info
hoys.club
ealerslot.net
consuyt.xyz
ilw.legal
aithful.events
est-life-insurance-2507.today
rvinsadeli.dev
sx9u.shop
23fd595ig.autos
yrhbt.shop
commerce-74302.bond
lc-driving-school.net
7y1ps.shop
earing-tests-69481.bond
amilablackwell.online
venir-bienne.info
024tengxun396.buzz
ocoani.shop
arage-door-repair-1.today
entista-esp.today
vto.stream
loud-computing-intl-3455364.fyi
9790.club
us-inbox-messages.online
aser-hair-removal-90284.bond
etangkhap99.lol
leaningjobs-cz.today
nline-courses-classes-lv-1.bond
essislotgoal14.xyz
ridges-freezers-56090.bond
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/2828-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2828-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1988-11-0x0000000000E30000-0x0000000000E5F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 912 set thread context of 2828 912 NEW PO - 24101.exe 84 PID 2828 set thread context of 3496 2828 svchost.exe 56 PID 1988 set thread context of 3496 1988 chkdsk.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW PO - 24101.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chkdsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe 1988 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 912 NEW PO - 24101.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 1988 chkdsk.exe 1988 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2828 svchost.exe Token: SeDebugPrivilege 1988 chkdsk.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 912 wrote to memory of 2828 912 NEW PO - 24101.exe 84 PID 912 wrote to memory of 2828 912 NEW PO - 24101.exe 84 PID 912 wrote to memory of 2828 912 NEW PO - 24101.exe 84 PID 912 wrote to memory of 2828 912 NEW PO - 24101.exe 84 PID 3496 wrote to memory of 1988 3496 Explorer.EXE 85 PID 3496 wrote to memory of 1988 3496 Explorer.EXE 85 PID 3496 wrote to memory of 1988 3496 Explorer.EXE 85 PID 1988 wrote to memory of 5100 1988 chkdsk.exe 86 PID 1988 wrote to memory of 5100 1988 chkdsk.exe 86 PID 1988 wrote to memory of 5100 1988 chkdsk.exe 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\NEW PO - 24101.exe"C:\Users\Admin\AppData\Local\Temp\NEW PO - 24101.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\NEW PO - 24101.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:5100
-
-