Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
PO_AM-0004R_ADH92887762678.exe
Resource
win7-20240903-en
General
-
Target
PO_AM-0004R_ADH92887762678.exe
-
Size
875KB
-
MD5
dc8de56aa173d952bc2c69d40543e119
-
SHA1
0a666bec9a6d737bd419c7922350c4939d7a9f94
-
SHA256
1aeeef34e64b6b0fa042ae3e9744a227281e9512036461831867fcf531e27a73
-
SHA512
302af0dab3330d4c59942be62c564a9d9d63d093d5c060db5dd135f2b56467a09d5d23fd65985de287ba07ff4bb4b7e1ddc185bcb43c1a1b9680488df08bbb32
-
SSDEEP
12288:Kk0IaOq+AlnC9Rsy9Ii+iNqsdYy/OBe/Vg95njib9aofSc8L:KuaeYy9Ii+fsay/O8k5u8
Malware Config
Extracted
formbook
4.1
py25
ezani.fun
rsteknik.online
200mzeus.digital
5497.one
ragonflyers.biz
rome.photos
2142.vip
ise-en-mots.net
tickmangifts.store
thostransporteselogistica.shop
utomation-tools-36376.bond
okyo-tax-expert-459376580.today
azettellm.school
aafarzaneh-emer6.rest
aakoub-mc.xyz
linko-es-playmarket.store
ohr.xyz
ejic.online
iwagarden.net
ealip.net
ixsgah.info
arehouse-services-45615.bond
f6zh79i92.icu
kjhtr.xyz
7bet.rest
lazinglayer.net
eeef.asia
emsys.xyz
andscaping-jobs-41537.bond
uykishore.tech
7192024.xyz
alentmatters.xyz
oftware-download-34135.bond
evimli.biz
vfyvjt.buzz
utomation-tools-19980.bond
spnews.online
enang123play.xyz
laygroundequipment1.online
rginine-09.store
ata-protection-86943.bond
oews.xyz
martlink-snap.pro
26a689p.xyz
etfi.xyz
luckyourmeal.store
zz3.lat
upigula.store
81861a2.shop
aintpro.homes
at-removal-near-me-105.website
osmeticpacka12gingjob07.bond
lprodtern.biz
ox-bitcoin.vip
ykatytrailstation.online
200mhits.rest
zsj.bid
uakke-stage.tech
cjra.info
ccursed.world
nline-advertising-77388.bond
etsestimate.net
amilrockers.bio
utomation-tools-52229.bond
nline-advertising-26922.bond
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
resource yara_rule behavioral1/memory/2352-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2884-23-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2652 powershell.exe -
Deletes itself 1 IoCs
pid Process 2632 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 268 set thread context of 2352 268 PO_AM-0004R_ADH92887762678.exe 35 PID 2352 set thread context of 1220 2352 PO_AM-0004R_ADH92887762678.exe 21 PID 2884 set thread context of 1220 2884 ipconfig.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PO_AM-0004R_ADH92887762678.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2884 ipconfig.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2760 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 268 PO_AM-0004R_ADH92887762678.exe 268 PO_AM-0004R_ADH92887762678.exe 268 PO_AM-0004R_ADH92887762678.exe 2352 PO_AM-0004R_ADH92887762678.exe 2352 PO_AM-0004R_ADH92887762678.exe 2652 powershell.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe 2884 ipconfig.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2352 PO_AM-0004R_ADH92887762678.exe 2352 PO_AM-0004R_ADH92887762678.exe 2352 PO_AM-0004R_ADH92887762678.exe 2884 ipconfig.exe 2884 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 268 PO_AM-0004R_ADH92887762678.exe Token: SeDebugPrivilege 2352 PO_AM-0004R_ADH92887762678.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeDebugPrivilege 2884 ipconfig.exe Token: SeShutdownPrivilege 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 268 wrote to memory of 2652 268 PO_AM-0004R_ADH92887762678.exe 31 PID 268 wrote to memory of 2652 268 PO_AM-0004R_ADH92887762678.exe 31 PID 268 wrote to memory of 2652 268 PO_AM-0004R_ADH92887762678.exe 31 PID 268 wrote to memory of 2652 268 PO_AM-0004R_ADH92887762678.exe 31 PID 268 wrote to memory of 2760 268 PO_AM-0004R_ADH92887762678.exe 33 PID 268 wrote to memory of 2760 268 PO_AM-0004R_ADH92887762678.exe 33 PID 268 wrote to memory of 2760 268 PO_AM-0004R_ADH92887762678.exe 33 PID 268 wrote to memory of 2760 268 PO_AM-0004R_ADH92887762678.exe 33 PID 268 wrote to memory of 2352 268 PO_AM-0004R_ADH92887762678.exe 35 PID 268 wrote to memory of 2352 268 PO_AM-0004R_ADH92887762678.exe 35 PID 268 wrote to memory of 2352 268 PO_AM-0004R_ADH92887762678.exe 35 PID 268 wrote to memory of 2352 268 PO_AM-0004R_ADH92887762678.exe 35 PID 268 wrote to memory of 2352 268 PO_AM-0004R_ADH92887762678.exe 35 PID 268 wrote to memory of 2352 268 PO_AM-0004R_ADH92887762678.exe 35 PID 268 wrote to memory of 2352 268 PO_AM-0004R_ADH92887762678.exe 35 PID 1220 wrote to memory of 2884 1220 Explorer.EXE 37 PID 1220 wrote to memory of 2884 1220 Explorer.EXE 37 PID 1220 wrote to memory of 2884 1220 Explorer.EXE 37 PID 1220 wrote to memory of 2884 1220 Explorer.EXE 37 PID 2884 wrote to memory of 2632 2884 ipconfig.exe 38 PID 2884 wrote to memory of 2632 2884 ipconfig.exe 38 PID 2884 wrote to memory of 2632 2884 ipconfig.exe 38 PID 2884 wrote to memory of 2632 2884 ipconfig.exe 38
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\PO_AM-0004R_ADH92887762678.exe"C:\Users\Admin\AppData\Local\Temp\PO_AM-0004R_ADH92887762678.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UHfxnDcr.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UHfxnDcr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3987.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2760
-
-
C:\Users\Admin\AppData\Local\Temp\PO_AM-0004R_ADH92887762678.exe"C:\Users\Admin\AppData\Local\Temp\PO_AM-0004R_ADH92887762678.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1632
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO_AM-0004R_ADH92887762678.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2632
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cbe708c1d0511a3497aa105df3fd98a7
SHA1243050599d00eee02db9ed1c1649ea5817587b21
SHA25605da9f6ad94b51f0350edf223334720aacd4734e75e6b38a5a677d71c5bc6e37
SHA512abb9384f62ee895b68778c1e765568d4cc7d9b13eb6a198808253195f632b6e020c47d17c435b52be1762140cbe0195152fe008f492a4b45b11fe85f7dc50e70