Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 06:43
Static task
static1
Behavioral task
behavioral1
Sample
SURRENDED HBL DMLU6312845110.exe
Resource
win7-20240903-en
General
-
Target
SURRENDED HBL DMLU6312845110.exe
-
Size
538KB
-
MD5
f37c6c64a2c0f8ae8146b8503fc75e46
-
SHA1
ffa637bc20372867f0b333a47ee016958cbf4f1e
-
SHA256
1b0349902810cd568b25e28ae6b2706b241d1d7b7cd2bcde1d181a45dccda6cb
-
SHA512
17f5257dee9930caeea5eb998b5fdddf12b0bc1ede3c43012519455ef9505efa38044a62e92dc9d2c42199562f44d6445de9cdcddc7e27f40475375c6525aa0c
-
SSDEEP
12288:dE2SpmDj4kKcdcEebjRMiQCQjZwC6zfHyqwm14:dww4VIebjReCsZwfTHj14
Malware Config
Extracted
formbook
4.1
pjd6
048307.com
hollygoldclub.net
0z4clolmb.com
jou-fa.com
yt2mp3converter.net
acheemagroup.com
metaeasy.money
casinolevant268.com
adelasidney.xyz
metawhatsapp.lgbt
designsbyn.store
pensacolajeeps.com
6wanfu.com
volcanosearch.com
authenticuprising.com
slaygangboutique.com
yesilyurtforklift.com
hiramossiel.com
totonoeshouten.com
0668mmw.com
industry-specific.com
artysangallery.com
flowersnwood.com
nolaaccents.com
sengoku-village.com
thebizbuilderblog.com
butthetruth.com
oxoglobal.com
zooki.movie
twittersmarts.com
spinfantastic.net
2slimnow.com
elanhomedesign.com
ccunub.com
lopocacasino.com
wpk651.com
reliablehub.info
cmsofohio.com
paulbiss.net
storiesverse.com
kanazawajuki.com
beautybyailin.com
everythingscripture.com
yourtownmetro.com
excellentexcrement.com
villasanil.com
amss.xyz
autosantander.com
endgrainedphx.net
trendingkidsco.com
villa-brunel.com
zenithresourcesltd.com
woodfiredpizzabox.com
metawhatsapp.cymru
jennybenjamina.com
razvivalochka.site
rgtnuoia.xyz
affordablehousingmadrid.com
satt.expert
manikheir.shoes
hdsminingpartseirl.com
jogon.xyz
campy.link
nwpltc.net
recwaterbio.com
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2816-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2816-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2556-20-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2932 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2956 set thread context of 2816 2956 SURRENDED HBL DMLU6312845110.exe 31 PID 2816 set thread context of 1212 2816 SURRENDED HBL DMLU6312845110.exe 21 PID 2556 set thread context of 1212 2556 mstsc.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SURRENDED HBL DMLU6312845110.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstsc.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 2816 SURRENDED HBL DMLU6312845110.exe 2816 SURRENDED HBL DMLU6312845110.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe 2556 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2816 SURRENDED HBL DMLU6312845110.exe 2816 SURRENDED HBL DMLU6312845110.exe 2816 SURRENDED HBL DMLU6312845110.exe 2556 mstsc.exe 2556 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2816 SURRENDED HBL DMLU6312845110.exe Token: SeDebugPrivilege 2556 mstsc.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2816 2956 SURRENDED HBL DMLU6312845110.exe 31 PID 2956 wrote to memory of 2816 2956 SURRENDED HBL DMLU6312845110.exe 31 PID 2956 wrote to memory of 2816 2956 SURRENDED HBL DMLU6312845110.exe 31 PID 2956 wrote to memory of 2816 2956 SURRENDED HBL DMLU6312845110.exe 31 PID 2956 wrote to memory of 2816 2956 SURRENDED HBL DMLU6312845110.exe 31 PID 2956 wrote to memory of 2816 2956 SURRENDED HBL DMLU6312845110.exe 31 PID 2956 wrote to memory of 2816 2956 SURRENDED HBL DMLU6312845110.exe 31 PID 1212 wrote to memory of 2556 1212 Explorer.EXE 32 PID 1212 wrote to memory of 2556 1212 Explorer.EXE 32 PID 1212 wrote to memory of 2556 1212 Explorer.EXE 32 PID 1212 wrote to memory of 2556 1212 Explorer.EXE 32 PID 2556 wrote to memory of 2932 2556 mstsc.exe 33 PID 2556 wrote to memory of 2932 2556 mstsc.exe 33 PID 2556 wrote to memory of 2932 2556 mstsc.exe 33 PID 2556 wrote to memory of 2932 2556 mstsc.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\SURRENDED HBL DMLU6312845110.exe"C:\Users\Admin\AppData\Local\Temp\SURRENDED HBL DMLU6312845110.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\SURRENDED HBL DMLU6312845110.exe"C:\Users\Admin\AppData\Local\Temp\SURRENDED HBL DMLU6312845110.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SURRENDED HBL DMLU6312845110.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2932
-
-