Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe
Resource
win7-20240903-en
General
-
Target
5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe
-
Size
1.1MB
-
MD5
5edb0f8e0ef6dd1e0d402f644c874e0f
-
SHA1
46e50727606336dbe5257ba0c9e77006b7b710e0
-
SHA256
5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8
-
SHA512
8129e3a284ed8514ed71367d03e8afd537d6636a78dce7995d2f48f32857a67a87dcdca102a45b33ab56e5e6486c45205d552b51b6907eda801def655288e6a8
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaC6WzN6M6ZdLNX50DEMhc:7JZoQrbTFZY1iaC6sb6TnAc
Malware Config
Extracted
formbook
4.1
c24t
ealthbridgeccs.online
ngelicais.art
uktuksu1.sbs
fapoker.asia
hecreature.tech
orenzoplaybest14.xyz
op-smartphones-deal.today
delark.click
7395.asia
otnews.cfd
j16e.xyz
oko.events
fscxb.top
roudtxliberals.vote
asas-br.bond
ourhealthyourlife.shop
fbpd.top
j9u9.xyz
uijiuw.top
aming-chair-37588.bond
uaweiharmony.top
458881233.men
ewancash.boats
mss-rb2.net
472.top
yhomeshop.online
j88.travel
02s-pest-control-us-ze.fun
oinl.club
ouseware.today
1385.net
eviewmadu.top
khizmetlergirisyapzzz2024.net
dcnn.net
aketrtpmvpslot88.info
hoys.club
ealerslot.net
consuyt.xyz
ilw.legal
aithful.events
est-life-insurance-2507.today
rvinsadeli.dev
sx9u.shop
23fd595ig.autos
yrhbt.shop
commerce-74302.bond
lc-driving-school.net
7y1ps.shop
earing-tests-69481.bond
amilablackwell.online
venir-bienne.info
024tengxun396.buzz
ocoani.shop
arage-door-repair-1.today
entista-esp.today
vto.stream
loud-computing-intl-3455364.fyi
9790.club
us-inbox-messages.online
aser-hair-removal-90284.bond
etangkhap99.lol
leaningjobs-cz.today
nline-courses-classes-lv-1.bond
essislotgoal14.xyz
ridges-freezers-56090.bond
Signatures
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2736-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2736-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2656-11-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2964 set thread context of 2736 2964 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe 30 PID 2736 set thread context of 1232 2736 svchost.exe 21 PID 2656 set thread context of 1232 2656 chkdsk.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chkdsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2736 svchost.exe 2736 svchost.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe 2656 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2964 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe 2736 svchost.exe 2736 svchost.exe 2736 svchost.exe 2656 chkdsk.exe 2656 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2736 svchost.exe Token: SeDebugPrivilege 2656 chkdsk.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2964 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe 2964 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe 1232 Explorer.EXE 1232 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2964 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe 2964 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2736 2964 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe 30 PID 2964 wrote to memory of 2736 2964 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe 30 PID 2964 wrote to memory of 2736 2964 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe 30 PID 2964 wrote to memory of 2736 2964 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe 30 PID 2964 wrote to memory of 2736 2964 5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe 30 PID 1232 wrote to memory of 2656 1232 Explorer.EXE 31 PID 1232 wrote to memory of 2656 1232 Explorer.EXE 31 PID 1232 wrote to memory of 2656 1232 Explorer.EXE 31 PID 1232 wrote to memory of 2656 1232 Explorer.EXE 31 PID 2656 wrote to memory of 2716 2656 chkdsk.exe 32 PID 2656 wrote to memory of 2716 2656 chkdsk.exe 32 PID 2656 wrote to memory of 2716 2656 chkdsk.exe 32 PID 2656 wrote to memory of 2716 2656 chkdsk.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe"C:\Users\Admin\AppData\Local\Temp\5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\5282b57b495bb6cca55225f7de91b203403b8ce35e41e62703e803f4aa134eb8.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2716
-
-