Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2024, 08:26

General

  • Target

    Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe

  • Size

    841KB

  • MD5

    42d33f1103e99970b5a2bd66cc7abacf

  • SHA1

    18b40de46605a148bd005f07f1396ea4be30f962

  • SHA256

    898019809aff31148304abc19ab0514838d5ed4ae75318fe8865b4e5b139d52f

  • SHA512

    471ef7e285ae5bb0db67e6722dde3877180d980f1cef271bf81e8c1f8c3fbd26ffa435eb04b0ef14ae6898ac26ed8b235eb9b203947aa4020955e5989e22fbbc

  • SSDEEP

    12288:Duup9hCcfZ/2Yp45XWCPrpLlafo3arpcYVx1Izq+lG/hS2zG9+aw9cNq0p2W:qrk/2Yp4JWKmhpcewu+lghjZqN

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

wk31

Decoy

soroban.xyz

irfirstaid.com

irsaycollection.com

thebardownstairsasheville.com

facebookmeta.business

paypalsupportclient.com

metaversusfacebook.com

litakparuikamazon.com

rivianmotorcompany.com

metaversepro.us

ikramfamilypractice.com

bitcoinfuturesetfs.online

5donline.com

rosemount.us

nicole-steinfort.com

performanceautorepairsj.com

scrabblecheats.us

kjg67amazon.com

formerlyknownasfacebook.com

youtubeandgooglepay.online

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3532
    • C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe
      "C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1520
      • C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe
        "C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"
        3⤵
          PID:1056
        • C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe
          "C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:4392
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\SysWOW64\wscript.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1944
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\Estimates (Korea Zinc Co., Ltd. Onsan Refinery) 275-016.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1520-14-0x0000000074A70000-0x0000000075220000-memory.dmp

      Filesize

      7.7MB

    • memory/1520-1-0x00000000000C0000-0x0000000000198000-memory.dmp

      Filesize

      864KB

    • memory/1520-2-0x00000000050A0000-0x0000000005644000-memory.dmp

      Filesize

      5.6MB

    • memory/1520-3-0x0000000004BD0000-0x0000000004C62000-memory.dmp

      Filesize

      584KB

    • memory/1520-4-0x0000000004BA0000-0x0000000004BAA000-memory.dmp

      Filesize

      40KB

    • memory/1520-5-0x0000000074A70000-0x0000000075220000-memory.dmp

      Filesize

      7.7MB

    • memory/1520-6-0x0000000005060000-0x000000000506C000-memory.dmp

      Filesize

      48KB

    • memory/1520-7-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

      Filesize

      4KB

    • memory/1520-8-0x0000000074A70000-0x0000000075220000-memory.dmp

      Filesize

      7.7MB

    • memory/1520-9-0x00000000068C0000-0x000000000695C000-memory.dmp

      Filesize

      624KB

    • memory/1520-10-0x0000000006A10000-0x0000000006A6C000-memory.dmp

      Filesize

      368KB

    • memory/1520-11-0x0000000006A70000-0x0000000006AA6000-memory.dmp

      Filesize

      216KB

    • memory/1520-0-0x0000000074A7E000-0x0000000074A7F000-memory.dmp

      Filesize

      4KB

    • memory/1944-24-0x0000000000C60000-0x0000000000C87000-memory.dmp

      Filesize

      156KB

    • memory/1944-25-0x0000000000C60000-0x0000000000C87000-memory.dmp

      Filesize

      156KB

    • memory/1944-26-0x0000000000FC0000-0x0000000000FEF000-memory.dmp

      Filesize

      188KB

    • memory/3532-19-0x0000000008630000-0x000000000879A000-memory.dmp

      Filesize

      1.4MB

    • memory/3532-23-0x0000000002870000-0x0000000002928000-memory.dmp

      Filesize

      736KB

    • memory/3532-27-0x0000000002870000-0x0000000002928000-memory.dmp

      Filesize

      736KB

    • memory/3532-30-0x00000000087A0000-0x0000000008911000-memory.dmp

      Filesize

      1.4MB

    • memory/3532-32-0x00000000087A0000-0x0000000008911000-memory.dmp

      Filesize

      1.4MB

    • memory/3532-33-0x00000000087A0000-0x0000000008911000-memory.dmp

      Filesize

      1.4MB

    • memory/4392-15-0x0000000001330000-0x000000000167A000-memory.dmp

      Filesize

      3.3MB

    • memory/4392-22-0x0000000001230000-0x0000000001245000-memory.dmp

      Filesize

      84KB

    • memory/4392-21-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/4392-12-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/4392-17-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/4392-18-0x0000000000EB0000-0x0000000000EC5000-memory.dmp

      Filesize

      84KB