Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 04:04

General

  • Target

    Project 88399287990.exe

  • Size

    622KB

  • MD5

    3837485b707ee00ae594d8b339c56ece

  • SHA1

    df8dab1ca8581cdf2c8de899d0d4a8df8ca8d24c

  • SHA256

    71ef3a1c1b5deecad87d419dff14667503ffbfb7f5a16f5b53eda57ae33bde7b

  • SHA512

    6a243b10b4e556d4cf6c95f5f7d534f0ec8bd32f6cb5c153abfbdf2dcaa04c6adcb122a42cccb882cee90c98b6d50fc04bb9355f0de7a82a27e615ae10c39ba6

  • SSDEEP

    6144:UJ4uZ9l5FllawMqFj/02XzSlGDQNo/vSx2oJrZKhCuKEB96MFZN+4RSOKQm0umL:UJ4up5UwMqFjjU3QMVtuKEn6qq4I

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ksb

Decoy

rbscotl.net

mimascota10.com

ncylis.com

mariemdonacosmetics.com

elitecleaningnow.com

stockvisioner.com

whatsmodish.com

paghaze.com

weargoodsport.com

alesspace.com

rajputboarding.com

ctezna.site

athetheist.com

neurologistaandreialamberti.com

pindaz.com

ericsklavos.com

icare4me.com

xn--pypl-qoac.com

52swith.com

chetansenterprises.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Users\Admin\AppData\Local\Temp\Project 88399287990.exe
      "C:\Users\Admin\AppData\Local\Temp\Project 88399287990.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3836
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Project 88399287990.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3676
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gIujDCSIo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1301.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3348
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gIujDCSIo.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3232
      • C:\Users\Admin\AppData\Local\Temp\Project 88399287990.exe
        "C:\Users\Admin\AppData\Local\Temp\Project 88399287990.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:372
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:3872
      • C:\Windows\SysWOW64\wlanext.exe
        "C:\Windows\SysWOW64\wlanext.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3692
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\Project 88399287990.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1988

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      ecc9be98ce67f9854333bfc9b1122a98

      SHA1

      3c24d0d8b54f3872ef0f3e4be9433c3313d87431

      SHA256

      6111dd7efd438620f646fe0b58f95007daed05dbefe811d2bc504cc19123cd56

      SHA512

      4a886e7a094f17d49bf4e416625aee3c272feebde5656711b50af1755299d03dae74d16154408f71fb6dbb7befe0845e9503a27ade284dc66fcfc46aaf94fb3f

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1kv4zwyt.5ew.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmp1301.tmp

      Filesize

      1KB

      MD5

      b572672d695ff383df8a270a449b6ff4

      SHA1

      59bd49755765a96dcc66d0dd67f1fd69debfb1bf

      SHA256

      8501ca411e1da73451e4773ed664701bda554ce85b53c853b16161932040f06a

      SHA512

      50e1bd11070adc0bf2662618489313f1a80213b34867e0f941b6c0cc50ac8979dc5b0f7623077cb4d7713215f5b2cf869677ce3e7b0c226f6773b86faee68c5c

    • memory/372-42-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/372-93-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/372-31-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/372-40-0x0000000001940000-0x0000000001C8A000-memory.dmp

      Filesize

      3.3MB

    • memory/372-43-0x0000000001DB0000-0x0000000001DC4000-memory.dmp

      Filesize

      80KB

    • memory/3232-68-0x0000000075950000-0x000000007599C000-memory.dmp

      Filesize

      304KB

    • memory/3232-79-0x0000000006FF0000-0x0000000006FFA000-memory.dmp

      Filesize

      40KB

    • memory/3232-85-0x00000000072A0000-0x00000000072A8000-memory.dmp

      Filesize

      32KB

    • memory/3232-80-0x0000000007200000-0x0000000007296000-memory.dmp

      Filesize

      600KB

    • memory/3232-81-0x0000000007180000-0x0000000007191000-memory.dmp

      Filesize

      68KB

    • memory/3232-83-0x00000000071C0000-0x00000000071D4000-memory.dmp

      Filesize

      80KB

    • memory/3232-84-0x00000000072C0000-0x00000000072DA000-memory.dmp

      Filesize

      104KB

    • memory/3436-44-0x0000000007320000-0x0000000007404000-memory.dmp

      Filesize

      912KB

    • memory/3436-96-0x0000000007320000-0x0000000007404000-memory.dmp

      Filesize

      912KB

    • memory/3676-17-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/3676-67-0x0000000007B90000-0x000000000820A000-memory.dmp

      Filesize

      6.5MB

    • memory/3676-23-0x00000000051F0000-0x0000000005256000-memory.dmp

      Filesize

      408KB

    • memory/3676-21-0x0000000005150000-0x0000000005172000-memory.dmp

      Filesize

      136KB

    • memory/3676-30-0x0000000005B80000-0x0000000005ED4000-memory.dmp

      Filesize

      3.3MB

    • memory/3676-20-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/3676-91-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/3676-38-0x0000000006200000-0x000000000621E000-memory.dmp

      Filesize

      120KB

    • memory/3676-39-0x0000000006290000-0x00000000062DC000-memory.dmp

      Filesize

      304KB

    • memory/3676-18-0x0000000005550000-0x0000000005B78000-memory.dmp

      Filesize

      6.2MB

    • memory/3676-19-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/3676-82-0x0000000007770000-0x000000000777E000-memory.dmp

      Filesize

      56KB

    • memory/3676-16-0x0000000002900000-0x0000000002936000-memory.dmp

      Filesize

      216KB

    • memory/3676-55-0x0000000075950000-0x000000007599C000-memory.dmp

      Filesize

      304KB

    • memory/3676-66-0x0000000007220000-0x00000000072C3000-memory.dmp

      Filesize

      652KB

    • memory/3676-65-0x00000000067C0000-0x00000000067DE000-memory.dmp

      Filesize

      120KB

    • memory/3676-54-0x00000000071E0000-0x0000000007212000-memory.dmp

      Filesize

      200KB

    • memory/3676-24-0x0000000005260000-0x00000000052C6000-memory.dmp

      Filesize

      408KB

    • memory/3676-78-0x0000000007540000-0x000000000755A000-memory.dmp

      Filesize

      104KB

    • memory/3692-94-0x00000000000F0000-0x0000000000107000-memory.dmp

      Filesize

      92KB

    • memory/3692-95-0x00000000000F0000-0x0000000000107000-memory.dmp

      Filesize

      92KB

    • memory/3836-6-0x00000000053A0000-0x00000000053AA000-memory.dmp

      Filesize

      40KB

    • memory/3836-8-0x0000000005540000-0x000000000554E000-memory.dmp

      Filesize

      56KB

    • memory/3836-0-0x00000000750CE000-0x00000000750CF000-memory.dmp

      Filesize

      4KB

    • memory/3836-7-0x0000000005560000-0x00000000055B6000-memory.dmp

      Filesize

      344KB

    • memory/3836-11-0x0000000005980000-0x00000000059E2000-memory.dmp

      Filesize

      392KB

    • memory/3836-5-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/3836-37-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/3836-4-0x0000000005460000-0x00000000054F2000-memory.dmp

      Filesize

      584KB

    • memory/3836-3-0x0000000005A10000-0x0000000005FB4000-memory.dmp

      Filesize

      5.6MB

    • memory/3836-2-0x00000000053C0000-0x000000000545C000-memory.dmp

      Filesize

      624KB

    • memory/3836-9-0x00000000750CE000-0x00000000750CF000-memory.dmp

      Filesize

      4KB

    • memory/3836-10-0x00000000750C0000-0x0000000075870000-memory.dmp

      Filesize

      7.7MB

    • memory/3836-1-0x0000000000930000-0x00000000009D2000-memory.dmp

      Filesize

      648KB