Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2024, 01:52

General

  • Target

    7b6405f519c37ee3e0ffd997d6b986b05d415eb21583168b0a9de3ddf042a90f.exe

  • Size

    2.5MB

  • MD5

    d90c90f39b8bf8bc6af9998c546f1df1

  • SHA1

    7358a2cc616bb26f246e4b2bd08ce1c9ca9a0c07

  • SHA256

    7b6405f519c37ee3e0ffd997d6b986b05d415eb21583168b0a9de3ddf042a90f

  • SHA512

    8b6611ad8e281040fce3bf1f5d4abc492570310572ae2dab5022b25c3addb139ecb540ce56bef086c3d3018bf18ded4126cfa2452d7c9ef80a6a7f518b192fdb

  • SSDEEP

    24576:fftLp4xZDonb36xA4XuYaZvpa8pWl2Nootef5OWe16YjlixVPOOmm91U/2TxLauS:d2D1l2No

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

e62s

Decoy

ellinksa.shop

uckyspinph.xyz

owdark.net

arriage-therapy-72241.bond

w7ijko4rv4p97b.top

heirbuzzwords.buzz

aspart.shop

ctivemail5-kagoya-com.info

shacertification9.shop

zitcd65k3.buzz

llkosoi.info

ru8.info

rhgtrdjdjykyetrdjftd.buzz

yschoollist.kiwi

oftfolio.online

rograma-de-almacen-2.online

oudoarms.top

mwquas.xyz

orjagaucha.website

nlinechat-mh.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Formbook payload 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Users\Admin\AppData\Local\Temp\7b6405f519c37ee3e0ffd997d6b986b05d415eb21583168b0a9de3ddf042a90f.exe
      "C:\Users\Admin\AppData\Local\Temp\7b6405f519c37ee3e0ffd997d6b986b05d415eb21583168b0a9de3ddf042a90f.exe"
      2⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3440
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:1692
    • C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\SysWOW64\chkdsk.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1184-1101-0x00000000009A0000-0x00000000009AA000-memory.dmp

    Filesize

    40KB

  • memory/1692-1094-0x0000000001170000-0x00000000014BA000-memory.dmp

    Filesize

    3.3MB

  • memory/1692-1097-0x00000000010E0000-0x00000000010F5000-memory.dmp

    Filesize

    84KB

  • memory/1692-1096-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1692-1092-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3440-28-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-1089-0x00000000052A0000-0x00000000052F4000-memory.dmp

    Filesize

    336KB

  • memory/3440-2-0x0000000004D10000-0x0000000004E0E000-memory.dmp

    Filesize

    1016KB

  • memory/3440-6-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-30-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-58-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-60-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-64-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-62-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-56-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-54-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-52-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-50-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-48-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-44-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-42-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-40-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-38-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-36-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-66-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-34-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-32-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-46-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-0-0x000000007531E000-0x000000007531F000-memory.dmp

    Filesize

    4KB

  • memory/3440-1-0x00000000000D0000-0x0000000000350000-memory.dmp

    Filesize

    2.5MB

  • memory/3440-26-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-3-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-18-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-14-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-12-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-10-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-8-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-24-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-16-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-4-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-20-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-1077-0x0000000075310000-0x0000000075AC0000-memory.dmp

    Filesize

    7.7MB

  • memory/3440-1079-0x0000000004E70000-0x0000000004EBC000-memory.dmp

    Filesize

    304KB

  • memory/3440-1078-0x0000000004ED0000-0x0000000004F48000-memory.dmp

    Filesize

    480KB

  • memory/3440-1080-0x00000000050A0000-0x0000000005132000-memory.dmp

    Filesize

    584KB

  • memory/3440-1082-0x00000000051B0000-0x0000000005216000-memory.dmp

    Filesize

    408KB

  • memory/3440-1081-0x00000000058C0000-0x0000000005E64000-memory.dmp

    Filesize

    5.6MB

  • memory/3440-1087-0x0000000075310000-0x0000000075AC0000-memory.dmp

    Filesize

    7.7MB

  • memory/3440-1088-0x0000000075310000-0x0000000075AC0000-memory.dmp

    Filesize

    7.7MB

  • memory/3440-22-0x0000000004D10000-0x0000000004E08000-memory.dmp

    Filesize

    992KB

  • memory/3440-1086-0x0000000075310000-0x0000000075AC0000-memory.dmp

    Filesize

    7.7MB

  • memory/3440-1093-0x0000000075310000-0x0000000075AC0000-memory.dmp

    Filesize

    7.7MB

  • memory/3464-1098-0x0000000003220000-0x00000000032EF000-memory.dmp

    Filesize

    828KB

  • memory/3464-1103-0x0000000003220000-0x00000000032EF000-memory.dmp

    Filesize

    828KB

  • memory/3464-1107-0x0000000003950000-0x0000000003A05000-memory.dmp

    Filesize

    724KB

  • memory/3464-1110-0x0000000003950000-0x0000000003A05000-memory.dmp

    Filesize

    724KB