Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 09:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PO112233412.exe
Resource
win7-20241023-en
10 signatures
150 seconds
General
-
Target
PO112233412.exe
-
Size
751KB
-
MD5
815a25002b66d17e307df75375b417b0
-
SHA1
8804e3818bd5a3653290e6cb9210968acfdfe5b8
-
SHA256
8aade6fb268d4593e9ebafc70c4d316b28278fb365a31b20be871741bc458aa1
-
SHA512
a63a1a437e6af3e33b3c0e179969e555a0428b6adf379f35316c98a5455397ba76a0d6c529c79df3689f2f5d7d49d18af8c702d7a190ed866fdac1fbed4b38f0
-
SSDEEP
12288:AxOcXL6oM5j7DUVNNCDdq1fA2zTGyQnch3p9qUy+VFcQRoqnNPg9DogsHxL45sCs:0L6ZvRBqZR6cn
Malware Config
Signatures
-
Formbook family
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/2820-13-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2820-18-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/2820-22-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/5024-28-0x0000000000D50000-0x0000000000D7E000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1608 set thread context of 2820 1608 PO112233412.exe 100 PID 2820 set thread context of 3432 2820 PO112233412.exe 56 PID 2820 set thread context of 3432 2820 PO112233412.exe 56 PID 5024 set thread context of 3432 5024 cmstp.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PO112233412.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmstp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 2820 PO112233412.exe 2820 PO112233412.exe 2820 PO112233412.exe 2820 PO112233412.exe 2820 PO112233412.exe 2820 PO112233412.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe 5024 cmstp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2820 PO112233412.exe 2820 PO112233412.exe 2820 PO112233412.exe 2820 PO112233412.exe 5024 cmstp.exe 5024 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2820 PO112233412.exe Token: SeDebugPrivilege 5024 cmstp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1608 wrote to memory of 2820 1608 PO112233412.exe 100 PID 1608 wrote to memory of 2820 1608 PO112233412.exe 100 PID 1608 wrote to memory of 2820 1608 PO112233412.exe 100 PID 1608 wrote to memory of 2820 1608 PO112233412.exe 100 PID 1608 wrote to memory of 2820 1608 PO112233412.exe 100 PID 1608 wrote to memory of 2820 1608 PO112233412.exe 100 PID 3432 wrote to memory of 5024 3432 Explorer.EXE 102 PID 3432 wrote to memory of 5024 3432 Explorer.EXE 102 PID 3432 wrote to memory of 5024 3432 Explorer.EXE 102 PID 5024 wrote to memory of 2332 5024 cmstp.exe 103 PID 5024 wrote to memory of 2332 5024 cmstp.exe 103 PID 5024 wrote to memory of 2332 5024 cmstp.exe 103
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\PO112233412.exe"C:\Users\Admin\AppData\Local\Temp\PO112233412.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\PO112233412.exe"C:\Users\Admin\AppData\Local\Temp\PO112233412.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO112233412.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2332
-
-