Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 08:48

General

  • Target

    Swift_92be67ab-e027-4955-b6fc-64bd720.exe

  • Size

    1.1MB

  • MD5

    b5687b090278f6446be5046b802dd2a0

  • SHA1

    5ffcad717c3ca822aed7a6e7eb311e43f8ccc294

  • SHA256

    94ed3b01fe4b13ebd1d354f87387a8b09ca26829115306b86bbdc2d1d07a0b3e

  • SHA512

    31a633db41275c8c19614de0a09550e993206189c898ee1e21bf76f05c5a363b8e3da0e08a1bf54a706b90e85891dd639dffe836ec482ca2af5b07191ab0f375

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QL9uklsL2aRnGnJXgVuy6PG+ROusD:f3v+7/5QL9uk69W26RRfsD

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e62s

Decoy

ellinksa.shop

uckyspinph.xyz

owdark.net

arriage-therapy-72241.bond

w7ijko4rv4p97b.top

heirbuzzwords.buzz

aspart.shop

ctivemail5-kagoya-com.info

shacertification9.shop

zitcd65k3.buzz

llkosoi.info

ru8.info

rhgtrdjdjykyetrdjftd.buzz

yschoollist.kiwi

oftfolio.online

rograma-de-almacen-2.online

oudoarms.top

mwquas.xyz

orjagaucha.website

nlinechat-mh.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 3 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Users\Admin\AppData\Local\Temp\Swift_92be67ab-e027-4955-b6fc-64bd720.exe
      "C:\Users\Admin\AppData\Local\Temp\Swift_92be67ab-e027-4955-b6fc-64bd720.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\Swift_92be67ab-e027-4955-b6fc-64bd720.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2008
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4164
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:876
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3980,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
    1⤵
      PID:1916

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1056-2-0x00000000040B0000-0x00000000042B0000-memory.dmp

      Filesize

      2.0MB

    • memory/2008-3-0x00000000004B0000-0x00000000004DF000-memory.dmp

      Filesize

      188KB

    • memory/2008-6-0x0000000000E00000-0x000000000114A000-memory.dmp

      Filesize

      3.3MB

    • memory/2008-8-0x0000000001390000-0x00000000013A5000-memory.dmp

      Filesize

      84KB

    • memory/2008-7-0x00000000004B0000-0x00000000004DF000-memory.dmp

      Filesize

      188KB

    • memory/3552-13-0x0000000008210000-0x0000000008344000-memory.dmp

      Filesize

      1.2MB

    • memory/3552-9-0x0000000008210000-0x0000000008344000-memory.dmp

      Filesize

      1.2MB

    • memory/3552-17-0x0000000008B70000-0x0000000008CFB000-memory.dmp

      Filesize

      1.5MB

    • memory/3552-18-0x0000000008B70000-0x0000000008CFB000-memory.dmp

      Filesize

      1.5MB

    • memory/3552-20-0x0000000008B70000-0x0000000008CFB000-memory.dmp

      Filesize

      1.5MB

    • memory/4164-10-0x0000000000630000-0x000000000063C000-memory.dmp

      Filesize

      48KB

    • memory/4164-11-0x0000000000630000-0x000000000063C000-memory.dmp

      Filesize

      48KB

    • memory/4164-12-0x0000000000FA0000-0x0000000000FCF000-memory.dmp

      Filesize

      188KB