Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21/12/2024, 21:44

General

  • Target

    a3d145e3c72db7ea3e18a306410a0445222a8ce83235794dc404dd470843caf2.exe

  • Size

    771KB

  • MD5

    061af339cbf1835f53f9b84ff1c49c21

  • SHA1

    7da36c353e199e2c097233653d48b26ae3de0c43

  • SHA256

    a3d145e3c72db7ea3e18a306410a0445222a8ce83235794dc404dd470843caf2

  • SHA512

    ba657afd8c62539d93f696fcc0a2c0ea4315f5172592cdddbf9aae9f686d8193bad5a6419fd50d08df5fdb537f9ebaf3a5f61261f822b67f76695d0bf2dd9f42

  • SSDEEP

    12288:4X3bbJTSjkURroDEor+HXtqbL2cikjfCYV:k3RInyysbL2cr

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

o27j

Decoy

jimchim.club

aerovistasllc.com

gpdy5-zxs4j-8-ee.xyz

ilzro.tech

tesringnyc.com

dubulk.com

humiservice.com

torrentpa.com

kiralikbahisayfalari.com

tokoporn.xyz

pihgos.xyz

ultimateguirtar.com

awanpetir.com

mywafflehelps.com

synergy.cfd

spatialdraftingsolutions.com

psmf.xyz

jazzontime.com

blns-law.com

more2moors.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3d145e3c72db7ea3e18a306410a0445222a8ce83235794dc404dd470843caf2.exe
    "C:\Users\Admin\AppData\Local\Temp\a3d145e3c72db7ea3e18a306410a0445222a8ce83235794dc404dd470843caf2.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a3d145e3c72db7ea3e18a306410a0445222a8ce83235794dc404dd470843caf2.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1088
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gtHrTmufpkwAg.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2432
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gtHrTmufpkwAg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA267.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2872
    • C:\Users\Admin\AppData\Local\Temp\a3d145e3c72db7ea3e18a306410a0445222a8ce83235794dc404dd470843caf2.exe
      "C:\Users\Admin\AppData\Local\Temp\a3d145e3c72db7ea3e18a306410a0445222a8ce83235794dc404dd470843caf2.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpA267.tmp

    Filesize

    1KB

    MD5

    efc5fe495d5a2c61b7884df59284b81a

    SHA1

    652b7e7215dbb02bd7b728b3f2c7438a84e220f3

    SHA256

    7c848d526b2c873bce37731032ace1c4e3c2ab5b6f49aa67ec6a3d18b7af6cad

    SHA512

    1664ea0e8aa9177abcafcb079a6f9247f085f8e93f347e046bb4ed00d82d44e03989dfa98d85b4114dcea38f67f5ddad50a98944b4bd69fb734c31931b025bfc

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    b225a05abd814bbe2c0c039ce0999aa3

    SHA1

    194103146528475f2676d76fb09b2e2fb05cc093

    SHA256

    4e519c779e5c3ffd64d550b70f49526689fefa9a4256b6bbd7f105473336fc04

    SHA512

    c247669ed09304ad564e71ea9aa7ea7c6d9d77cfea787b469fa2e894c13e3118ef62f33cfa9e1afaad536add91f68961cf22bb5ca20b1bd3df8b0dd531c8db35

  • memory/616-24-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/616-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/616-21-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/616-19-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2848-3-0x0000000000540000-0x0000000000556000-memory.dmp

    Filesize

    88KB

  • memory/2848-4-0x0000000074D50000-0x000000007543E000-memory.dmp

    Filesize

    6.9MB

  • memory/2848-5-0x0000000007EF0000-0x0000000007F68000-memory.dmp

    Filesize

    480KB

  • memory/2848-2-0x0000000074D50000-0x000000007543E000-memory.dmp

    Filesize

    6.9MB

  • memory/2848-1-0x0000000000090000-0x0000000000158000-memory.dmp

    Filesize

    800KB

  • memory/2848-18-0x0000000004E00000-0x0000000004E34000-memory.dmp

    Filesize

    208KB

  • memory/2848-0-0x0000000074D5E000-0x0000000074D5F000-memory.dmp

    Filesize

    4KB

  • memory/2848-25-0x0000000074D50000-0x000000007543E000-memory.dmp

    Filesize

    6.9MB