Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2024, 08:38

General

  • Target

    doc06520720220131121555,pdf.exe

  • Size

    1.1MB

  • MD5

    b274a8db1f2759a5633feda3ebb76e99

  • SHA1

    bb145758eee0923a3b5fef02c300fe631855bbb6

  • SHA256

    cbf712334783e060e67ba77d675a7402efa44b879aeed5b56fdbe9f2b01ee99c

  • SHA512

    8b070b4686d60f7cb26e77451975bc1cade564def98b92077db90b6202a2439857e9df95fadf39064e717acad6fb64dc0065b1f0e4ea9d126f223fb7ac0b3471

  • SSDEEP

    24576:eYhos91WO8ZCh9/9D/bLWLcygotSl2G6PrOTg0cm+pS8Yx:7hos91N7h9/9bbLWrdSl2G6PrOTg0cmh

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ch24

Decoy

tmicp.com

lauriceiker.quest

neighbor-works.com

santiemprenderich.wiki

thecraftytxdogmom.com

abramolfactory.com

prettylittlesoles.com

thistimeandilove.space

imperialshaving.com

aflorideallgarden.com

thbfjs.com

marketmove.info

echocoins.com

ztkzw.com

sandyhookfishandribhouse.com

gamesxfr.com

frontline500.com

cbburrnet.com

boliviaoferta.com

jdzmklc.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 4 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Users\Admin\AppData\Local\Temp\doc06520720220131121555,pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\doc06520720220131121555,pdf.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Maps connected drives based on registry
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\SysWOW64\iexpress.exe
        "C:\Windows\SysWOW64\iexpress.exe"
        3⤵
          PID:4280
        • C:\Windows\SysWOW64\TpmTool.exe
          "C:\Windows\SysWOW64\TpmTool.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:4888
      • C:\Windows\SysWOW64\msdt.exe
        "C:\Windows\SysWOW64\msdt.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4384
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\SysWOW64\TpmTool.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2916-15-0x0000000072A35000-0x0000000072A36000-memory.dmp

      Filesize

      4KB

    • memory/2916-1-0x0000000000B20000-0x0000000000C3C000-memory.dmp

      Filesize

      1.1MB

    • memory/2916-2-0x00000000056C0000-0x000000000575C000-memory.dmp

      Filesize

      624KB

    • memory/2916-3-0x00000000752C0000-0x0000000075A70000-memory.dmp

      Filesize

      7.7MB

    • memory/2916-4-0x00000000055A0000-0x0000000005660000-memory.dmp

      Filesize

      768KB

    • memory/2916-5-0x0000000005880000-0x00000000058A8000-memory.dmp

      Filesize

      160KB

    • memory/2916-6-0x00000000070B0000-0x0000000007654000-memory.dmp

      Filesize

      5.6MB

    • memory/2916-7-0x0000000006BF0000-0x0000000006C56000-memory.dmp

      Filesize

      408KB

    • memory/2916-0-0x00000000752CE000-0x00000000752CF000-memory.dmp

      Filesize

      4KB

    • memory/2916-16-0x00000000752C0000-0x0000000075A70000-memory.dmp

      Filesize

      7.7MB

    • memory/3452-21-0x0000000002B60000-0x0000000002C8A000-memory.dmp

      Filesize

      1.2MB

    • memory/3452-20-0x0000000008C60000-0x0000000008DD8000-memory.dmp

      Filesize

      1.5MB

    • memory/3452-31-0x0000000003050000-0x00000000030F2000-memory.dmp

      Filesize

      648KB

    • memory/3452-13-0x0000000002B60000-0x0000000002C8A000-memory.dmp

      Filesize

      1.2MB

    • memory/3452-30-0x0000000003050000-0x00000000030F2000-memory.dmp

      Filesize

      648KB

    • memory/3452-28-0x0000000003050000-0x00000000030F2000-memory.dmp

      Filesize

      648KB

    • memory/3452-24-0x0000000008C60000-0x0000000008DD8000-memory.dmp

      Filesize

      1.5MB

    • memory/4384-23-0x00000000007B0000-0x0000000000807000-memory.dmp

      Filesize

      348KB

    • memory/4384-22-0x00000000007B0000-0x0000000000807000-memory.dmp

      Filesize

      348KB

    • memory/4384-25-0x0000000000D90000-0x0000000000DBF000-memory.dmp

      Filesize

      188KB

    • memory/4888-8-0x0000000000400000-0x0000000000459000-memory.dmp

      Filesize

      356KB

    • memory/4888-12-0x0000000000EA0000-0x0000000000EB4000-memory.dmp

      Filesize

      80KB

    • memory/4888-19-0x0000000000F30000-0x0000000000F44000-memory.dmp

      Filesize

      80KB

    • memory/4888-18-0x0000000000400000-0x0000000000459000-memory.dmp

      Filesize

      356KB

    • memory/4888-9-0x0000000000FB0000-0x00000000012FA000-memory.dmp

      Filesize

      3.3MB

    • memory/4888-11-0x0000000000400000-0x0000000000459000-memory.dmp

      Filesize

      356KB