Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2024, 15:36 UTC

General

  • Target

    dGMCIcKTcIsMgWV.exe

  • Size

    865KB

  • MD5

    a5044479b5b01e3f1e673ac9f46f1260

  • SHA1

    712b4374d8f14f6bffc1f57ec59e9755c8926ff7

  • SHA256

    2b9b9f253f0c34fc745803cdeef66e7930be3dd10e37c4e1ee76e5ed311cd9f1

  • SHA512

    ef85958594ce5b59db1670aa8f1753dd913f417dd2dc1954e85f1d8fec1a928a724039b0897df4c69f9f8bafa6f6ee8028d5dfd1921d6e65d5857e9a9c5ca67e

  • SSDEEP

    12288:GtxoRVY7Oen9f9upsZEFKV7tY4axOtzDftua4V5iQd:oYVYqmPLZVuTIH8a4V5N

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

t39h

Decoy

a101im2.com

nowherehome.city

shanglinrunair.com

yingyandiaocha88.com

ke77fu.top

vnitrni-bezpecnost.pro

feednigerianow.tech

788851.xyz

tristarnetwork.com

slsbuildingproducts.co.uk

stop-dog-diarrhea.site

place-dessert.store

tppstore.xyz

inapr.com

girlsmaza.com

mjbplumbers.co.uk

usmanagementcorp.com

any-markets.pro

vaynhanh.tech

4aged.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Users\Admin\AppData\Local\Temp\dGMCIcKTcIsMgWV.exe
      "C:\Users\Admin\AppData\Local\Temp\dGMCIcKTcIsMgWV.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3672
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vLYOstps.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2408
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vLYOstps" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4820.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4828
      • C:\Users\Admin\AppData\Local\Temp\dGMCIcKTcIsMgWV.exe
        "C:\Users\Admin\AppData\Local\Temp\dGMCIcKTcIsMgWV.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2796
    • C:\Windows\SysWOW64\WWAHost.exe
      "C:\Windows\SysWOW64\WWAHost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3484
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\dGMCIcKTcIsMgWV.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4760

Network

  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    71.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    107.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    107.12.20.2.in-addr.arpa
    IN PTR
    Response
    107.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-107deploystaticakamaitechnologiescom
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.girlsmaza.com
    Remote address:
    8.8.8.8:53
    Request
    www.girlsmaza.com
    IN A
    Response
  • flag-us
    DNS
    www.segredos.tech
    Remote address:
    8.8.8.8:53
    Request
    www.segredos.tech
    IN A
    Response
  • flag-us
    DNS
    www.tristarnetwork.com
    Remote address:
    8.8.8.8:53
    Request
    www.tristarnetwork.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    71.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    71.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    107.12.20.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    107.12.20.2.in-addr.arpa

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    13.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    www.girlsmaza.com
    dns
    63 B
    136 B
    1
    1

    DNS Request

    www.girlsmaza.com

  • 8.8.8.8:53
    www.segredos.tech
    dns
    63 B
    128 B
    1
    1

    DNS Request

    www.segredos.tech

  • 8.8.8.8:53
    www.tristarnetwork.com
    dns
    68 B
    141 B
    1
    1

    DNS Request

    www.tristarnetwork.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2plt335s.urq.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp4820.tmp

    Filesize

    1KB

    MD5

    718d91335c224ec35c822120bf2ddacc

    SHA1

    22d474b2c7ee5def07b9d4cb6eca414ed8bcfb13

    SHA256

    bc2dbbe2e439c3de108f1f108ec4aa9946d83779e3bf75f2bcf21bf0edf477f2

    SHA512

    a685bd97a75c5b980b827f494a32e83b2b9b75b28e89a4e498ef27e162167dd2e077e8009d3dd15a4e69da7b5423abfcecab71c9411a694952b60ec2b2530ea4

  • memory/2408-37-0x0000000006040000-0x0000000006062000-memory.dmp

    Filesize

    136KB

  • memory/2408-51-0x0000000071C60000-0x0000000071CAC000-memory.dmp

    Filesize

    304KB

  • memory/2408-76-0x0000000074D60000-0x0000000075510000-memory.dmp

    Filesize

    7.7MB

  • memory/2408-73-0x0000000074D60000-0x0000000075510000-memory.dmp

    Filesize

    7.7MB

  • memory/2408-72-0x0000000007E40000-0x0000000007E48000-memory.dmp

    Filesize

    32KB

  • memory/2408-71-0x0000000007E60000-0x0000000007E7A000-memory.dmp

    Filesize

    104KB

  • memory/2408-69-0x0000000007D50000-0x0000000007D5E000-memory.dmp

    Filesize

    56KB

  • memory/2408-68-0x0000000007D20000-0x0000000007D31000-memory.dmp

    Filesize

    68KB

  • memory/2408-67-0x0000000007DA0000-0x0000000007E36000-memory.dmp

    Filesize

    600KB

  • memory/2408-66-0x0000000007BA0000-0x0000000007BAA000-memory.dmp

    Filesize

    40KB

  • memory/2408-65-0x0000000007B20000-0x0000000007B3A000-memory.dmp

    Filesize

    104KB

  • memory/2408-17-0x00000000051B0000-0x00000000051E6000-memory.dmp

    Filesize

    216KB

  • memory/2408-64-0x0000000008170000-0x00000000087EA000-memory.dmp

    Filesize

    6.5MB

  • memory/2408-20-0x0000000005940000-0x0000000005F68000-memory.dmp

    Filesize

    6.2MB

  • memory/2408-19-0x0000000074D60000-0x0000000075510000-memory.dmp

    Filesize

    7.7MB

  • memory/2408-22-0x0000000074D60000-0x0000000075510000-memory.dmp

    Filesize

    7.7MB

  • memory/2408-21-0x0000000074D60000-0x0000000075510000-memory.dmp

    Filesize

    7.7MB

  • memory/2408-49-0x00000000077A0000-0x00000000077D2000-memory.dmp

    Filesize

    200KB

  • memory/2408-43-0x00000000063E0000-0x0000000006734000-memory.dmp

    Filesize

    3.3MB

  • memory/2408-63-0x0000000074D60000-0x0000000075510000-memory.dmp

    Filesize

    7.7MB

  • memory/2408-61-0x0000000006DB0000-0x0000000006DCE000-memory.dmp

    Filesize

    120KB

  • memory/2408-62-0x00000000079E0000-0x0000000007A83000-memory.dmp

    Filesize

    652KB

  • memory/2408-46-0x000000007F880000-0x000000007F890000-memory.dmp

    Filesize

    64KB

  • memory/2408-42-0x0000000006290000-0x00000000062F6000-memory.dmp

    Filesize

    408KB

  • memory/2408-45-0x00000000069B0000-0x00000000069FC000-memory.dmp

    Filesize

    304KB

  • memory/2408-70-0x0000000007D60000-0x0000000007D74000-memory.dmp

    Filesize

    80KB

  • memory/2408-44-0x0000000006800000-0x000000000681E000-memory.dmp

    Filesize

    120KB

  • memory/2796-28-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2796-29-0x0000000001500000-0x0000000001514000-memory.dmp

    Filesize

    80KB

  • memory/2796-27-0x0000000001640000-0x000000000198A000-memory.dmp

    Filesize

    3.3MB

  • memory/2796-24-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3464-36-0x0000000008980000-0x0000000008AC5000-memory.dmp

    Filesize

    1.3MB

  • memory/3464-82-0x0000000008AD0000-0x0000000008BEE000-memory.dmp

    Filesize

    1.1MB

  • memory/3484-50-0x0000000000FB0000-0x000000000108C000-memory.dmp

    Filesize

    880KB

  • memory/3484-77-0x0000000000920000-0x000000000094F000-memory.dmp

    Filesize

    188KB

  • memory/3484-47-0x0000000000FB0000-0x000000000108C000-memory.dmp

    Filesize

    880KB

  • memory/3672-5-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

    Filesize

    40KB

  • memory/3672-8-0x0000000074D60000-0x0000000075510000-memory.dmp

    Filesize

    7.7MB

  • memory/3672-0-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

    Filesize

    4KB

  • memory/3672-11-0x0000000007D70000-0x0000000007E0C000-memory.dmp

    Filesize

    624KB

  • memory/3672-2-0x00000000054A0000-0x0000000005A44000-memory.dmp

    Filesize

    5.6MB

  • memory/3672-10-0x0000000007C30000-0x0000000007CBE000-memory.dmp

    Filesize

    568KB

  • memory/3672-9-0x00000000066E0000-0x00000000066EC000-memory.dmp

    Filesize

    48KB

  • memory/3672-23-0x0000000007E10000-0x0000000007E44000-memory.dmp

    Filesize

    208KB

  • memory/3672-30-0x0000000074D60000-0x0000000075510000-memory.dmp

    Filesize

    7.7MB

  • memory/3672-7-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

    Filesize

    4KB

  • memory/3672-6-0x0000000005480000-0x000000000549A000-memory.dmp

    Filesize

    104KB

  • memory/3672-15-0x00000000080B0000-0x0000000008116000-memory.dmp

    Filesize

    408KB

  • memory/3672-4-0x0000000074D60000-0x0000000075510000-memory.dmp

    Filesize

    7.7MB

  • memory/3672-1-0x0000000000350000-0x000000000042E000-memory.dmp

    Filesize

    888KB

  • memory/3672-3-0x0000000004E00000-0x0000000004E92000-memory.dmp

    Filesize

    584KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.