Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/10/2024, 13:35
Static task
static1
Behavioral task
behavioral1
Sample
fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe
Resource
win7-20240729-en
General
-
Target
fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe
-
Size
1.6MB
-
MD5
3364dc2488f8444000a9da4c6d999fc4
-
SHA1
19cf9bd0f6976d75f7738ec74d2b326edee5bdde
-
SHA256
fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4
-
SHA512
24778076f2e3fbd0ab39675bab98bd7da9feaa08e276d720da2fca252377ceb2c7b1da1b9c3b862e2acbea9b6e0c29e77e093c9cff366055d894a969545ea921
-
SSDEEP
49152:AAodtaG9kS2U84B+FLan9k5TRM9zlcVj7vdLJ7t:A/B18P7t
Malware Config
Extracted
formbook
4.1
md02
onsen1508.com
partymaxclubmen36.click
texasshelvingwarehouse.com
tiantiying.com
taxcredits-pr.com
33mgbet.com
equipoleiremnacional.com
andrewghita.com
zbbnp.xyz
englandbreaking.com
a1b5v.xyz
vizamag.com
h0lg3.rest
ux-design-courses-17184.bond
of84.top
qqkartel88v1.com
avalynkate.com
cpuk-finance.com
yeslabs.xyz
webuyandsellpa.com
barnesassetrecovery.store
hecxion.xyz
theopencomputeproject.net
breezyvw.christmas
mumazyl.com
woby.xyz
jalaios10.vip
lynxpire.com
sparkbpo.com
333689z.com
rslotrank.win
adscendmfmarketing.com
detroitreels.com
xojiliv1.com
mzhhxxff.xyz
hitcomply.com
piedge-taiko.net
chiri.lat
bookmygaddi.com
hjemfinesse.shop
zruypj169g.top
solarfundis.com
pittsparking.com
teplo-invest.com
j3k7n.xyz
coloradoskinwellness.com
z8ggd.com
coinbureau.xyz
mamasprinkleofjoy.com
xotj7a.xyz
nijssenadventures.com
ysa-cn.com
tigajco69.fun
localhomeservicesadvisor.com
attorney-services-8344642.zone
rnwaifu.xyz
nyverian.com
family-lawyers-7009103.world
117myw.com
kingdom66.lat
tdshomesolution.com
momof2filiricans.com
saeutah.com
rakring.com
upcyclecharms.com
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2920-0-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2920-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2912-9-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run raserver.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HZ-DPL3P_2 = "C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe" raserver.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2300 set thread context of 2920 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 38 PID 2920 set thread context of 1396 2920 wmplayer.exe 21 PID 2912 set thread context of 1396 2912 raserver.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2703099537-420551529-3771253338-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Runs regedit.exe 1 IoCs
pid Process 2756 regedit.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2920 wmplayer.exe 2920 wmplayer.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2920 wmplayer.exe 2920 wmplayer.exe 2920 wmplayer.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe 2912 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe Token: SeDebugPrivilege 2920 wmplayer.exe Token: SeDebugPrivilege 2912 raserver.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 2300 wrote to memory of 3036 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 31 PID 2300 wrote to memory of 3036 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 31 PID 2300 wrote to memory of 3036 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 31 PID 2300 wrote to memory of 3036 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 31 PID 2300 wrote to memory of 3036 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 31 PID 2300 wrote to memory of 3036 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 31 PID 2300 wrote to memory of 3036 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 31 PID 2300 wrote to memory of 484 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 32 PID 2300 wrote to memory of 484 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 32 PID 2300 wrote to memory of 484 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 32 PID 2300 wrote to memory of 484 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 32 PID 2300 wrote to memory of 484 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 32 PID 2300 wrote to memory of 484 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 32 PID 2300 wrote to memory of 484 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 32 PID 2300 wrote to memory of 2980 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 33 PID 2300 wrote to memory of 2980 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 33 PID 2300 wrote to memory of 2980 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 33 PID 2300 wrote to memory of 2980 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 33 PID 2300 wrote to memory of 2980 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 33 PID 2300 wrote to memory of 2984 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 34 PID 2300 wrote to memory of 2984 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 34 PID 2300 wrote to memory of 2984 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 34 PID 2300 wrote to memory of 2984 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 34 PID 2300 wrote to memory of 2984 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 34 PID 2300 wrote to memory of 1908 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 35 PID 2300 wrote to memory of 1908 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 35 PID 2300 wrote to memory of 1908 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 35 PID 2300 wrote to memory of 1908 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 35 PID 2300 wrote to memory of 1908 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 35 PID 2300 wrote to memory of 1908 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 35 PID 2300 wrote to memory of 1908 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 35 PID 2300 wrote to memory of 2796 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 36 PID 2300 wrote to memory of 2796 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 36 PID 2300 wrote to memory of 2796 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 36 PID 2300 wrote to memory of 2796 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 36 PID 2300 wrote to memory of 2796 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 36 PID 2300 wrote to memory of 2756 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 37 PID 2300 wrote to memory of 2756 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 37 PID 2300 wrote to memory of 2756 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 37 PID 2300 wrote to memory of 2756 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 37 PID 2300 wrote to memory of 2756 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 37 PID 2300 wrote to memory of 2920 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 38 PID 2300 wrote to memory of 2920 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 38 PID 2300 wrote to memory of 2920 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 38 PID 2300 wrote to memory of 2920 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 38 PID 2300 wrote to memory of 2920 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 38 PID 2300 wrote to memory of 2920 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 38 PID 2300 wrote to memory of 2920 2300 fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe 38 PID 1396 wrote to memory of 2912 1396 Explorer.EXE 39 PID 1396 wrote to memory of 2912 1396 Explorer.EXE 39 PID 1396 wrote to memory of 2912 1396 Explorer.EXE 39 PID 1396 wrote to memory of 2912 1396 Explorer.EXE 39 PID 2912 wrote to memory of 2816 2912 raserver.exe 40 PID 2912 wrote to memory of 2816 2912 raserver.exe 40 PID 2912 wrote to memory of 2816 2912 raserver.exe 40 PID 2912 wrote to memory of 2816 2912 raserver.exe 40 PID 2912 wrote to memory of 2816 2912 raserver.exe 40
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe"C:\Users\Admin\AppData\Local\Temp\fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:3036
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"3⤵PID:484
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"3⤵PID:2980
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"3⤵PID:2984
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"3⤵PID:1908
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"3⤵PID:2796
-
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"3⤵
- Runs regedit.exe
PID:2756
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2816
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5da8d5570f513f606d9d363b45d8e27e6
SHA1b187c06fe313969f59e19c67840da89012e7be40
SHA256458b1ca9922a7b86c5852f53828560af3f78e7ac304b8cdeb9638f1f4f039a16
SHA512429810bd17ee2ffed94047a05e9790a0e23d24b66f7bf7dbde2056170090966a5aaf3dd4501b5596efdd15a566cfa9080c32b096b35ef5eb65385201f32bce44
-
Filesize
40B
MD52f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
Filesize
40B
MD5d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
Filesize
40B
MD5ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf