Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 11:09
Static task
static1
Behavioral task
behavioral1
Sample
c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe
Resource
win7-20241010-en
General
-
Target
c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe
-
Size
1.0MB
-
MD5
43e40486285956beaffed65745f28b0a
-
SHA1
98f08012fd95967761b71b64ce3c91332c4bdc37
-
SHA256
c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b
-
SHA512
f7ff5cd2ab47153d7f699e55583afa6dc1d34d3e60abf9f43d13011136512d3e48474cd2e13cd9454f53a6260669fe54c50220e870fe3c486a5cb7bc7f6f454b
-
SSDEEP
24576:aRA4228CFtXo2A/Nzf1pccEOw2ia84Pj2hQ2PQrY:ah2JCFtXo2Yd+2ia84PShQ2IrY
Malware Config
Extracted
formbook
4.1
sn31
matsuomatsuo.com
104wn.com
bolacorner.com
dawonderer.com
yourpamlano.xyz
mtzmx.icu
lepakzaparket.com
barmagli.com
danta.ltd
marumaru240.com
people-centeredhr.com
test-brew-inc.com
clairvoyantbusinesscoach.com
aforeignexchangeblog.com
erentekbilisim.com
gangqinqu123.net
defiguaranteebonds.com
thegioigaubong97.site
vaoiwin.info
vcwholeness.com
03c3twpfee5estjovfu2655.com
mutantapeyachtclubtoken.store
pixelkev.xyz
corporacioncymaz.com
iampro-found.com
azureconsults.com
bam-bong.com
advanceresubeopene.biz
tzjisheng.com
krdz28.online
ycw2009.com
minioe.com
dronelink.xyz
autu.cfd
sdwmkj.com
uixray.xyz
informacion-numero-24-h.site
123dianyingyuan.com
tj-assets.com
usaservicedogregistratuon.com
metagwnics.com
pepeksquad2.host
kc7.club
yundtremark.com
finance-employers.com
euroglobalnews.info
estudioenzetti.com
rodosmail.xyz
bm65.xyz
bchmtn.net
server4uuss.net
maisonretraiteprivee.com
atelierelzaaidar.com
thegurlyboutique.com
primobellaquartz.com
jetskirentaldublin.com
akmeetech.com
withoutyoutube.com
blackcreekwatershed.com
89qp52.com
e3488.com
vote4menk.com
tyma.club
theceditpalooza.com
boxberry-my.com
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/3896-1545-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3896-1549-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1656 set thread context of 3896 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 82 PID 3896 set thread context of 3436 3896 InstallUtil.exe 54 PID 1652 set thread context of 3436 1652 netsh.exe 54 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 3896 InstallUtil.exe 3896 InstallUtil.exe 3896 InstallUtil.exe 3896 InstallUtil.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe 1652 netsh.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3896 InstallUtil.exe 3896 InstallUtil.exe 3896 InstallUtil.exe 1652 netsh.exe 1652 netsh.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe Token: SeDebugPrivilege 3896 InstallUtil.exe Token: SeDebugPrivilege 1652 netsh.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1552 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 81 PID 1656 wrote to memory of 1552 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 81 PID 1656 wrote to memory of 1552 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 81 PID 1656 wrote to memory of 3896 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 82 PID 1656 wrote to memory of 3896 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 82 PID 1656 wrote to memory of 3896 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 82 PID 1656 wrote to memory of 3896 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 82 PID 1656 wrote to memory of 3896 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 82 PID 1656 wrote to memory of 3896 1656 c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe 82 PID 3436 wrote to memory of 1652 3436 Explorer.EXE 83 PID 3436 wrote to memory of 1652 3436 Explorer.EXE 83 PID 3436 wrote to memory of 1652 3436 Explorer.EXE 83 PID 1652 wrote to memory of 2296 1652 netsh.exe 86 PID 1652 wrote to memory of 2296 1652 netsh.exe 86 PID 1652 wrote to memory of 2296 1652 netsh.exe 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe"C:\Users\Admin\AppData\Local\Temp\c7757a3c21c62d9f56a30bfe1660727de4932993c0d4e3c650f001914599905b.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵PID:1552
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2296
-
-