Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe
Resource
win7-20240903-en
General
-
Target
c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe
-
Size
663KB
-
MD5
9806b5ef6bf254fdd4c0e934a4c070eb
-
SHA1
caa33c5cecee0b8a05a4b1c5f7f4f4c081fd0b77
-
SHA256
c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191
-
SHA512
824ce46df91db025a3e2fea193c394ad1290c681cf46e39b163036693d246078a2589eb34b56ba1c9ea62078e2b438477f7ccb292c469a99da55b79306a8385b
-
SSDEEP
12288:J7C27Jb5EMTIRjAH5rV20hkoJnnFc8AtAvJIUHTrU2fujnR/C6CqkR:1LTxZrLh9Jn68At+JIUzrcjnRip
Malware Config
Extracted
formbook
4.1
t94g
32188.top
mergencyroofrepair656460.online
jkahu.fun
ur4.autos
r0lba4cl0qkaws8.bond
eiliaowang.top
urjav.xyz
kidaman15.click
old-removal-p350.today
levatethismedia.info
h33323s40.top
dormy.click
5406.club
earlofwisdombook.pro
6980.app
ellwood999.biz
otdates.lol
164v.shop
thereal.app
takeget.online
andshakecap.info
urevitality.fit
hinabrasilexpressbr.shop
agacuan6.cloud
ehuacs.vip
ostbr.online
xh354.xyz
texhio.online
utoflightbookings.online
uikfox.top
razeonthego.net
ardenartpros.xyz
rain-pipe-cleaning-72352.bond
argoindah.online
ilo808.vip
urartexplore.top
likbet77ofc.net
olacecarenetwork.info
nfluencer-marketing-47216.bond
alerico.net
ywildchicken.net
8nj2.shop
alsam.bond
emaxvalley.xyz
uwevei8.pro
lwp6c7v.xyz
hongzhuankk02.yachts
kokbihi.online
kxt.xyz
ctivgym.online
he616comies.shop
loto.app
lpha-mn.dev
ungle-product.shop
duaus.fun
roduct-tester-jobs-48097.bond
ikkidigitalpro.net
oppr.fit
uxk-porn-slut.top
aoudimall.net
pessin.tech
ackhoffman.art
echonocat.fun
t-courses-mw-2.bond
uggernauty.net
Signatures
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/1012-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2560 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1620 set thread context of 1012 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 1012 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 2560 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe Token: SeDebugPrivilege 2560 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2560 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 30 PID 1620 wrote to memory of 2560 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 30 PID 1620 wrote to memory of 2560 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 30 PID 1620 wrote to memory of 2560 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 30 PID 1620 wrote to memory of 1012 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 32 PID 1620 wrote to memory of 1012 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 32 PID 1620 wrote to memory of 1012 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 32 PID 1620 wrote to memory of 1012 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 32 PID 1620 wrote to memory of 1012 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 32 PID 1620 wrote to memory of 1012 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 32 PID 1620 wrote to memory of 1012 1620 c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe"C:\Users\Admin\AppData\Local\Temp\c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
C:\Users\Admin\AppData\Local\Temp\c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe"C:\Users\Admin\AppData\Local\Temp\c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1012
-