Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/10/2024, 10:47

241003-mvlj9szhmg 10

03/10/2024, 10:20

241003-mc6sgszgjf 10

Analysis

  • max time kernel
    148s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 10:47

General

  • Target

    Bonifico Pagamento1032024pdf.exe

  • Size

    1.0MB

  • MD5

    02b3fa038b7489af0c95067a0bed6eda

  • SHA1

    5c6f4be028ca1eb8dada9d627bf3b2e58c6058cc

  • SHA256

    0c3b74467b8178fcd51e50b037df967eb1f9a16bc0f0fcfe3379241fa9edd00f

  • SHA512

    8afb9aabf3065b728198ff1ac5a221bc7f053ceaf8c4538962299383d52646a6b0bff0481a8e66158354811b2c6582119e1b5d85d705ca97c5e0d176effdb410

  • SSDEEP

    24576:jAHnh+eWsN3skA4RV1Hom2KXMmHaWywAN0nNgfnC75:uh+ZkldoPK8YaWyUiK

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e23y

Decoy

stiloeconforto.shop

79nn470gl.autos

ffg.autos

elix-saaac.buzz

tlasbet88win.sbs

inoliga.app

777.fun

avada-ga-3.press

avandakitchen.online

61ep864tr.autos

igitalonlineseva.online

ar-deals-15908.bond

sqqpkv.pro

368i8rnoy.xyz

lxspinsenin.lol

9y204r7eo.sbs

toptalkingaboutit.net

eeplab.xyz

filmyhit.vip

athroom-remodeling-59089.bond

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Users\Admin\AppData\Local\Temp\Bonifico Pagamento1032024pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Bonifico Pagamento1032024pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4816
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\Bonifico Pagamento1032024pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3584
    • C:\Windows\SysWOW64\colorcpl.exe
      "C:\Windows\SysWOW64\colorcpl.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2280-17-0x0000000000160000-0x0000000000179000-memory.dmp

    Filesize

    100KB

  • memory/2280-19-0x0000000001220000-0x000000000124F000-memory.dmp

    Filesize

    188KB

  • memory/2280-18-0x0000000000160000-0x0000000000179000-memory.dmp

    Filesize

    100KB

  • memory/3492-20-0x0000000002EF0000-0x0000000003029000-memory.dmp

    Filesize

    1.2MB

  • memory/3492-16-0x0000000002EF0000-0x0000000003029000-memory.dmp

    Filesize

    1.2MB

  • memory/3492-23-0x0000000008950000-0x0000000008A16000-memory.dmp

    Filesize

    792KB

  • memory/3492-24-0x0000000008950000-0x0000000008A16000-memory.dmp

    Filesize

    792KB

  • memory/3492-26-0x0000000008950000-0x0000000008A16000-memory.dmp

    Filesize

    792KB

  • memory/3584-14-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3584-15-0x0000000001990000-0x00000000019A4000-memory.dmp

    Filesize

    80KB

  • memory/3584-12-0x0000000001C00000-0x0000000001F4A000-memory.dmp

    Filesize

    3.3MB

  • memory/3584-11-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/4816-10-0x00000000020E0000-0x00000000020E4000-memory.dmp

    Filesize

    16KB