Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23/12/2024, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
faktura,pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
faktura,pdf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
lejdjsong.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
lejdjsong.exe
Resource
win10v2004-20241007-en
General
-
Target
lejdjsong.exe
-
Size
73KB
-
MD5
86a148c54d7a5ee49386393a7bd64e75
-
SHA1
3bcd7adf68d28514c0d362964bf4ac1e067bda6f
-
SHA256
7cc777f463f00d5389c55fe6cc7904b427efd52ab0b2e932ddd1210d6c0eedb6
-
SHA512
214f5530b2adc519243cd0c10af2987275988b45e1050f147391ece49c3ab2ae3ec4dff4f79598a6f9061ae4d70fbc78334d4a1ae2e863ab92628e0b4beb00fb
-
SSDEEP
1536:tBsMIL1gs031sHpiCq9lnLo4LR6ruhb8muP/CAzaJG5dJXBsWScd+u5Ngih:YMA2s031sH81R6ruhbfa/XJH+aNgih
Malware Config
Extracted
formbook
nob2
en+O8QOx9zDZZo6B
4OtleJKQETLZZo6B
xGU74u2nB/TAvy6QCqHWGzhs5rjgJKkH8Q==
Hq3a8RPSF4BJjsCnvBuPXSngiQ==
Ca1w6R7ZEzrZZo6B
V3N7ImFtXIccbqg=
jkdEFrI4Bjj/
rGXE4vP2e7leaO0+Mw==
mFACnMuCTkL+R3Fh+5rYDQ==
k1R/bHxIDwfQHVtMUnukJu3OiA==
Goa71OKQKE9ALQ==
TUVlDTovqKZqfHiwJHaK
VBnCLD8NiCkMIw==
fIbQ7Joi+SgIi/y6E7P5RoPjihFL
UTcvz+rs7OfK+DARp/kwBpv6Jq7TVgs=
rF084AkQIlQmdZwZOg==
6eJWgNCEuf3EAbCxkXiM
JcyQCi86x+3MC8IYjvN0uyjYjg==
S+8thMWBzyTZZo6B
5dDUXJSODfnS/DkyX8Nobh0=
QzE0kgvEkfjJxTGhvsXC0bmBAq7TVgs=
SvGiFDzvQ5VcXWllI3jDCWea
Ex2x0uXbeLCABYvxJw==
Z30INXN68/fPuxyGBX+kJu3OiA==
o1GLrObS0wbIwj+lyCekaxc=
1pNxF0wC1EAR/HTfFGRkZ1U7Qc83ZA==
//F7o9uV5kMsRUARgI14C3rjihFL
x4g54i3bGj7ZZo6B
eXbh/UD+P3ZRZlcnk52DCXXjihFL
45k/3hQOj4FvigaF6b7gGQ==
B/zuidaOS4lSYOddlOTaJu3OiA==
sGRG/0oK20MjGosLNVxz8s27gg==
3J0AWM8U1Fw7U9Y4Mg==
k25qBXEtP3hioh+/qkY=
msuCZooQAPzx
I9T86w+xAgj0ThGCqdTYJu3OiA==
5bfgjq9pJHxNnUTBdR7DCWea
MA3LZqWYM4xkzk4b1XDbKpbYnw==
0JHq2t7kg+W2tZ56HDs+8s27gg==
YzjWe7xxO6RxmI91LHvDCWea
Ed2wYY99DB79PW3nIw==
hy0n2/bx+h77Om9jhtfaJu3OiA==
RyqxprS9TYJnwDvI3FE=
Eie65SLOEWInIAP3puEH0cQCal8=
5cM5KllSUVU+mB+/qkY=
fx3jWq809wrm
DBYgi6qNLZZrvAYUTGuA
MT8E6CM0JQ3c5OHHvyekaxc=
QPzglcfRzcempTeB8YCxJu3OiA==
iiNpWoRq/F8KV4eD
zc43KEkBzsZwtLSYO9oGTofTgh9S
eIgMM3Ql+Ni429L4W5KX
qdsdfCm2rEwrMA==
1J37JFM5QoJZduZBxtPrGQA=
Guf/odWc6fLOHtMePmNZZ2JAQc83ZA==
fDfjTG4UWKZyoF2j6b7gGQ==
CQR0odvibYFQeHuwJHaK
iW2CKi70M4lohoF1fsXU08QCal8=
4cMCASYeFz0WPrYUiCPDCWea
EQLzneCWSY0dhdSW
di2DnryxNqpIdXRxfsXU08QCal8=
ybIwVoc5fb6MmaKpUHx/CXXjihFL
VBFoZXYqad3Mz66yzCekaxc=
Arnp2/y0d8iXguxwqsWpu8CHAq7TVgs=
futurelightiq.com
Signatures
-
Formbook family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation lejdjsong.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2744 set thread context of 2760 2744 lejdjsong.exe 30 PID 2760 set thread context of 1188 2760 lejdjsong.exe 21 PID 2760 set thread context of 1188 2760 lejdjsong.exe 21 PID 2940 set thread context of 1188 2940 wlanext.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lejdjsong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 2760 lejdjsong.exe 2760 lejdjsong.exe 2760 lejdjsong.exe 2760 lejdjsong.exe 2760 lejdjsong.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe 2940 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2760 lejdjsong.exe 2760 lejdjsong.exe 2760 lejdjsong.exe 2760 lejdjsong.exe 2940 wlanext.exe 2940 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2760 lejdjsong.exe Token: SeDebugPrivilege 2940 wlanext.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2760 2744 lejdjsong.exe 30 PID 2744 wrote to memory of 2760 2744 lejdjsong.exe 30 PID 2744 wrote to memory of 2760 2744 lejdjsong.exe 30 PID 2744 wrote to memory of 2760 2744 lejdjsong.exe 30 PID 2744 wrote to memory of 2760 2744 lejdjsong.exe 30 PID 1188 wrote to memory of 2940 1188 Explorer.EXE 31 PID 1188 wrote to memory of 2940 1188 Explorer.EXE 31 PID 1188 wrote to memory of 2940 1188 Explorer.EXE 31 PID 1188 wrote to memory of 2940 1188 Explorer.EXE 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\lejdjsong.exe"C:\Users\Admin\AppData\Local\Temp\lejdjsong.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\lejdjsong.exe"C:\Users\Admin\AppData\Local\Temp\lejdjsong.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2940
-