Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 12:00
Static task
static1
Behavioral task
behavioral1
Sample
0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe
Resource
win7-20240903-en
General
-
Target
0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe
-
Size
838KB
-
MD5
103834076a9658b0ba07bf9c9232adf1
-
SHA1
15f34d001fb89348ec3f81b7e8586c6145f019e9
-
SHA256
0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1
-
SHA512
ba7452f4937c72f4ef4758d987905c9e45f092ce454857c55b9946768571505c8e42668c7d115169f75d5b82fadc15b08921efbffa1c3566039081760714b306
-
SSDEEP
12288:qdoKggb2iNdvpc++AWUsci/n0K947D/G91k0MuXAzHBaUe0DkgYrRM2TgN/0s:6oKgK1XpSRUUjK/u7Mua27gi
Malware Config
Extracted
formbook
4.1
p94a
wishgrove.com
parqueveiculos.com
spiderwebs.online
chulkanadham.com
cdtuan.net
zxazm.com
payment6528832.xyz
fengtaiol.com
bffsmovie.com
aliceseagerfitness.com
garisluruskonsulindo.website
analytical-gutter.net
ahcq8.com
fenyoga.com
ecleptic.cat
conjurecrafts.com
aquaway.date
apenpokkenschoonmaakbedrijf.com
zgramr.top
boweknives.site
wf825.com
tonysdiary.com
alttxt.space
digz.us
mailim.xyz
chromebarbangkok.com
toyookahana.com
jornalaquadra.net
cloudpackages.online
xfew.top
atherenergy.uk
allentownfilmcrew.com
gym323.com
ballbyball.online
youyiw.com
mehdifarzi.com
dinobro.com
bonanzapratamaabadi.com
trailer.vegas
retro241.space
ecole-universite.com
magentodesigndublin.com
ilovechutney.info
451338.com
vintagewriting.site
008420.com
sussexfoodie.co.uk
matrix-101.com
carolina3dproperties.com
clairecorrie.co.uk
asafosa.xyz
yashpestcontrol.com
keilewn.online
nirmalmirchandani.com
familyibis.sbs
anthropologybythewire.com
invidgekets.xyz
1stconstiution.com
byxre.com
andresraiter.com
1stpartynft.com
25thdayoffer.xyz
nicehaus.space
mhjys.com
muuritutkimus.info
Signatures
-
Formbook family
-
Formbook payload 1 IoCs
resource yara_rule behavioral1/memory/2872-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2380 set thread context of 2872 2380 0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2872 0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2872 2380 0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe 31 PID 2380 wrote to memory of 2872 2380 0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe 31 PID 2380 wrote to memory of 2872 2380 0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe 31 PID 2380 wrote to memory of 2872 2380 0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe 31 PID 2380 wrote to memory of 2872 2380 0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe 31 PID 2380 wrote to memory of 2872 2380 0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe 31 PID 2380 wrote to memory of 2872 2380 0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe"C:\Users\Admin\AppData\Local\Temp\0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe"C:\Users\Admin\AppData\Local\Temp\0cbaefa900f08c2844a65456c26385770ba32ecfdfe4ad1e774aa63538b5d2b1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2872
-