Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/10/2024, 08:32
Static task
static1
Behavioral task
behavioral1
Sample
HUAWEI New PO [#16426900].exe
Resource
win7-20240903-en
General
-
Target
HUAWEI New PO [#16426900].exe
-
Size
580KB
-
MD5
e0e6e7d9c723993d7172fc5cf35ed241
-
SHA1
77b6944a9c19fb00172d436f4146bfa255013306
-
SHA256
a2780a43ac1e90a6945c78cbcbd929863ab89c72ff1f86380f48303d051bc7d4
-
SHA512
c8e85c71dfd68a31200a0ce760c104e868c35863027789c7523126c2c1335a1e6da6279459be4652cdb0927aa2c21cff160688b9bee44bd483684fd01406dc55
-
SSDEEP
12288:HVf0ws2B6rJq5b/BnXF0kfT4RwLMbX1UXLMcNymOJ:HV3sE6qV10y4X5UAYOJ
Malware Config
Extracted
formbook
4.1
cu29
qidr.shop
usinessaviationconsulting.net
68716329.xyz
nd-los.net
ealthironcladguarantee.shop
oftware-download-69354.bond
48372305.top
omeownershub.top
mall-chilli.top
ajakgoid.online
ire-changer-53482.bond
rugsrx.shop
oyang123.info
azino-forum-pro.online
817715.rest
layman.vip
eb777.club
ovatonica.net
urgaslotvip.website
inn-paaaa.buzz
reativedreams.design
upremehomes.shop
ames-saaab.buzz
phonelock.xyz
ideandseekvacations.xyz
77179ksuhr.top
ental-bridges-87553.bond
7win2.bet
ainan.company
5mwhs.top
hopp9.top
65fhgejd3.xyz
olandopaintingllc.online
n-wee.buzz
reshcasinoinfo2.top
5734.party
qtbyj.live
gil.lat
siabgc4d.online
fios.top
sed-cars-89003.bond
nlineschools-2507-001-sap.click
upiloffatemotors.online
ordf.top
achhonglan.shop
irex.info
oursmile.vip
leachlondonstore.online
asukacro.online
panish-classes-64045.bond
apita.top
srtio.xyz
kdsclci.bond
ochacha.sbs
oldsteps.buzz
yzq0n.top
npostl.xyz
ladder-cancer-symptoms-mine.sbs
400725iimfyuj120.top
3589.photo
rasilhojenoticias.online
ependableequipment.online
itusbandar126.info
ohns.app
f6b-crxy.top
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/1700-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1700-39-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1960-76-0x0000000000920000-0x000000000094F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4832 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation HUAWEI New PO [#16426900].exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3680 set thread context of 1700 3680 HUAWEI New PO [#16426900].exe 91 PID 1700 set thread context of 3500 1700 HUAWEI New PO [#16426900].exe 56 PID 1960 set thread context of 3500 1960 svchost.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUAWEI New PO [#16426900].exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4740 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4832 powershell.exe 1700 HUAWEI New PO [#16426900].exe 1700 HUAWEI New PO [#16426900].exe 1700 HUAWEI New PO [#16426900].exe 1700 HUAWEI New PO [#16426900].exe 4832 powershell.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe 1960 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1700 HUAWEI New PO [#16426900].exe 1700 HUAWEI New PO [#16426900].exe 1700 HUAWEI New PO [#16426900].exe 1960 svchost.exe 1960 svchost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4832 powershell.exe Token: SeDebugPrivilege 1700 HUAWEI New PO [#16426900].exe Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeDebugPrivilege 1960 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3680 wrote to memory of 4832 3680 HUAWEI New PO [#16426900].exe 87 PID 3680 wrote to memory of 4832 3680 HUAWEI New PO [#16426900].exe 87 PID 3680 wrote to memory of 4832 3680 HUAWEI New PO [#16426900].exe 87 PID 3680 wrote to memory of 4740 3680 HUAWEI New PO [#16426900].exe 89 PID 3680 wrote to memory of 4740 3680 HUAWEI New PO [#16426900].exe 89 PID 3680 wrote to memory of 4740 3680 HUAWEI New PO [#16426900].exe 89 PID 3680 wrote to memory of 1700 3680 HUAWEI New PO [#16426900].exe 91 PID 3680 wrote to memory of 1700 3680 HUAWEI New PO [#16426900].exe 91 PID 3680 wrote to memory of 1700 3680 HUAWEI New PO [#16426900].exe 91 PID 3680 wrote to memory of 1700 3680 HUAWEI New PO [#16426900].exe 91 PID 3680 wrote to memory of 1700 3680 HUAWEI New PO [#16426900].exe 91 PID 3680 wrote to memory of 1700 3680 HUAWEI New PO [#16426900].exe 91 PID 3500 wrote to memory of 1960 3500 Explorer.EXE 92 PID 3500 wrote to memory of 1960 3500 Explorer.EXE 92 PID 3500 wrote to memory of 1960 3500 Explorer.EXE 92 PID 1960 wrote to memory of 4160 1960 svchost.exe 95 PID 1960 wrote to memory of 4160 1960 svchost.exe 95 PID 1960 wrote to memory of 4160 1960 svchost.exe 95
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\HUAWEI New PO [#16426900].exe"C:\Users\Admin\AppData\Local\Temp\HUAWEI New PO [#16426900].exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YRdJVRLxI.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YRdJVRLxI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE493.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4740
-
-
C:\Users\Admin\AppData\Local\Temp\HUAWEI New PO [#16426900].exe"C:\Users\Admin\AppData\Local\Temp\HUAWEI New PO [#16426900].exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\HUAWEI New PO [#16426900].exe"3⤵
- System Location Discovery: System Language Discovery
PID:4160
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD53e1e01e116d9312a0a2cecf8c99d466d
SHA1cd312085e537996a912a4b878842c36310c9f026
SHA256a1450f21f3ac9dc74d24cd8c6fff060b6b2953b0124ebd4c6c70b59498dfab73
SHA512505918fe0b8716670bb57cedf7207ab7c912112f5013578168082106a79dcf24983d49ce431d79ef9afb884ba5314d10bff551e239ec12342d9666b733651e4f