Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 10:47
Static task
static1
Behavioral task
behavioral1
Sample
BonificoPagamento1032024pdf.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
BonificoPagamento1032024pdf.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Bonifico Pagamento1032024pdf.exe
Resource
win7-20240708-en
General
-
Target
Bonifico Pagamento1032024pdf.exe
-
Size
1.0MB
-
MD5
02b3fa038b7489af0c95067a0bed6eda
-
SHA1
5c6f4be028ca1eb8dada9d627bf3b2e58c6058cc
-
SHA256
0c3b74467b8178fcd51e50b037df967eb1f9a16bc0f0fcfe3379241fa9edd00f
-
SHA512
8afb9aabf3065b728198ff1ac5a221bc7f053ceaf8c4538962299383d52646a6b0bff0481a8e66158354811b2c6582119e1b5d85d705ca97c5e0d176effdb410
-
SSDEEP
24576:jAHnh+eWsN3skA4RV1Hom2KXMmHaWywAN0nNgfnC75:uh+ZkldoPK8YaWyUiK
Malware Config
Extracted
formbook
4.1
e23y
stiloeconforto.shop
79nn470gl.autos
ffg.autos
elix-saaac.buzz
tlasbet88win.sbs
inoliga.app
777.fun
avada-ga-3.press
avandakitchen.online
61ep864tr.autos
igitalonlineseva.online
ar-deals-15908.bond
sqqpkv.pro
368i8rnoy.xyz
lxspinsenin.lol
9y204r7eo.sbs
toptalkingaboutit.net
eeplab.xyz
filmyhit.vip
athroom-remodeling-59089.bond
hwqcoiu.xyz
ome-care-76206.bond
tudioalberto.online
anfocusedviews.shop
ibrarygym.online
emosjumpers.net
mg-marketing.online
19bet.xyz
7556r.club
sed-cars-35796.bond
liveiraeletro.online
iangshen56.cloud
aeempreendora.online
bets.net
sychology-degree-69585.bond
est-arthritis-therapy-9711.buzz
zkirv.top
8015.xyz
uwueriudsjkdjnfjkdjnkxzk.vip
etausaha.online
crubber-brush-64789.bond
iversitiendaplus.shop
wrzlak.buzz
b-999.top
ower-bank-za-4886348.world
2361.asia
believehim.net
leeconcerned.info
oland-flight-deal.today
c-marketing.net
wgxb.top
pboardresult.net
nitednationsofindia.net
oupondhakel.shop
elationship-coach-72450.bond
ounjaronaturaloferta.online
wpgs2448.vip
8080734.xyz
mvqimnpwkxcixccaeafmibpiq.top
arpediemwireless.net
eth-paaad.buzz
renvillemarianne.net
tephsmith.info
opinformation.net
reakinggroundtherapy.pro
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral4/memory/3584-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral4/memory/3584-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral4/memory/2280-19-0x0000000001220000-0x000000000124F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4816 set thread context of 3584 4816 Bonifico Pagamento1032024pdf.exe 82 PID 3584 set thread context of 3492 3584 svchost.exe 56 PID 2280 set thread context of 3492 2280 colorcpl.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bonifico Pagamento1032024pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3584 svchost.exe 3584 svchost.exe 3584 svchost.exe 3584 svchost.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe 2280 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4816 Bonifico Pagamento1032024pdf.exe 3584 svchost.exe 3584 svchost.exe 3584 svchost.exe 2280 colorcpl.exe 2280 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3584 svchost.exe Token: SeDebugPrivilege 2280 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4816 Bonifico Pagamento1032024pdf.exe 4816 Bonifico Pagamento1032024pdf.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4816 Bonifico Pagamento1032024pdf.exe 4816 Bonifico Pagamento1032024pdf.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4816 wrote to memory of 3584 4816 Bonifico Pagamento1032024pdf.exe 82 PID 4816 wrote to memory of 3584 4816 Bonifico Pagamento1032024pdf.exe 82 PID 4816 wrote to memory of 3584 4816 Bonifico Pagamento1032024pdf.exe 82 PID 4816 wrote to memory of 3584 4816 Bonifico Pagamento1032024pdf.exe 82 PID 3492 wrote to memory of 2280 3492 Explorer.EXE 83 PID 3492 wrote to memory of 2280 3492 Explorer.EXE 83 PID 3492 wrote to memory of 2280 3492 Explorer.EXE 83 PID 2280 wrote to memory of 2272 2280 colorcpl.exe 84 PID 2280 wrote to memory of 2272 2280 colorcpl.exe 84 PID 2280 wrote to memory of 2272 2280 colorcpl.exe 84
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\Bonifico Pagamento1032024pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bonifico Pagamento1032024pdf.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Bonifico Pagamento1032024pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3584
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2272
-
-