Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 11:09
Static task
static1
Behavioral task
behavioral1
Sample
c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe
Resource
win7-20241010-en
General
-
Target
c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe
-
Size
1.0MB
-
MD5
43e40486285956beaffed65745f28b0a
-
SHA1
98f08012fd95967761b71b64ce3c91332c4bdc37
-
SHA256
c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b
-
SHA512
f7ff5cd2ab47153d7f699e55583afa6dc1d34d3e60abf9f43d13011136512d3e48474cd2e13cd9454f53a6260669fe54c50220e870fe3c486a5cb7bc7f6f454b
-
SSDEEP
24576:aRA4228CFtXo2A/Nzf1pccEOw2ia84Pj2hQ2PQrY:ah2JCFtXo2Yd+2ia84PShQ2IrY
Malware Config
Extracted
formbook
4.1
sn31
matsuomatsuo.com
104wn.com
bolacorner.com
dawonderer.com
yourpamlano.xyz
mtzmx.icu
lepakzaparket.com
barmagli.com
danta.ltd
marumaru240.com
people-centeredhr.com
test-brew-inc.com
clairvoyantbusinesscoach.com
aforeignexchangeblog.com
erentekbilisim.com
gangqinqu123.net
defiguaranteebonds.com
thegioigaubong97.site
vaoiwin.info
vcwholeness.com
03c3twpfee5estjovfu2655.com
mutantapeyachtclubtoken.store
pixelkev.xyz
corporacioncymaz.com
iampro-found.com
azureconsults.com
bam-bong.com
advanceresubeopene.biz
tzjisheng.com
krdz28.online
ycw2009.com
minioe.com
dronelink.xyz
autu.cfd
sdwmkj.com
uixray.xyz
informacion-numero-24-h.site
123dianyingyuan.com
tj-assets.com
usaservicedogregistratuon.com
metagwnics.com
pepeksquad2.host
kc7.club
yundtremark.com
finance-employers.com
euroglobalnews.info
estudioenzetti.com
rodosmail.xyz
bm65.xyz
bchmtn.net
server4uuss.net
maisonretraiteprivee.com
atelierelzaaidar.com
thegurlyboutique.com
primobellaquartz.com
jetskirentaldublin.com
akmeetech.com
withoutyoutube.com
blackcreekwatershed.com
89qp52.com
e3488.com
vote4menk.com
tyma.club
theceditpalooza.com
boxberry-my.com
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/7492-1550-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/7492-1553-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/7492-1558-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1268 set thread context of 7492 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 31 PID 7492 set thread context of 1192 7492 InstallUtil.exe 20 PID 7492 set thread context of 1192 7492 InstallUtil.exe 20 PID 7660 set thread context of 1192 7660 wininit.exe 20 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 7492 InstallUtil.exe 7492 InstallUtil.exe 7492 InstallUtil.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe 7660 wininit.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 7492 InstallUtil.exe 7492 InstallUtil.exe 7492 InstallUtil.exe 7492 InstallUtil.exe 7660 wininit.exe 7660 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe Token: SeDebugPrivilege 7492 InstallUtil.exe Token: SeDebugPrivilege 7660 wininit.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1268 wrote to memory of 7476 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 29 PID 1268 wrote to memory of 7476 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 29 PID 1268 wrote to memory of 7476 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 29 PID 1268 wrote to memory of 7476 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 29 PID 1268 wrote to memory of 7476 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 29 PID 1268 wrote to memory of 7476 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 29 PID 1268 wrote to memory of 7476 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 29 PID 1268 wrote to memory of 7484 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 30 PID 1268 wrote to memory of 7484 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 30 PID 1268 wrote to memory of 7484 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 30 PID 1268 wrote to memory of 7484 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 30 PID 1268 wrote to memory of 7484 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 30 PID 1268 wrote to memory of 7484 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 30 PID 1268 wrote to memory of 7484 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 30 PID 1268 wrote to memory of 7492 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 31 PID 1268 wrote to memory of 7492 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 31 PID 1268 wrote to memory of 7492 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 31 PID 1268 wrote to memory of 7492 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 31 PID 1268 wrote to memory of 7492 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 31 PID 1268 wrote to memory of 7492 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 31 PID 1268 wrote to memory of 7492 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 31 PID 1268 wrote to memory of 7492 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 31 PID 1268 wrote to memory of 7492 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 31 PID 1268 wrote to memory of 7492 1268 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 31 PID 1192 wrote to memory of 7660 1192 Explorer.EXE 35 PID 1192 wrote to memory of 7660 1192 Explorer.EXE 35 PID 1192 wrote to memory of 7660 1192 Explorer.EXE 35 PID 1192 wrote to memory of 7660 1192 Explorer.EXE 35 PID 7660 wrote to memory of 7700 7660 wininit.exe 36 PID 7660 wrote to memory of 7700 7660 wininit.exe 36 PID 7660 wrote to memory of 7700 7660 wininit.exe 36 PID 7660 wrote to memory of 7700 7660 wininit.exe 36
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe"C:\Users\Admin\AppData\Local\Temp\c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵PID:7476
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵PID:7484
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:7492
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:7588
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:7596
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:7608
-
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:7660 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- System Location Discovery: System Language Discovery
PID:7700
-
-