Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2024, 13:00

General

  • Target

    JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe

  • Size

    431KB

  • MD5

    1d024b5fb222f690e2437776dba5cecd

  • SHA1

    3bc42dd5835072842a7dbe4bc75db9480d4781e9

  • SHA256

    dfa72cfd2cf8b1c3beac907a91042e344a301923e8e40b88541e850161eae6eb

  • SHA512

    e1812ba005ed0d873cc43233d156f35b126d47228ec204900137f3676685a501ab1440b45d50b66b72da9114421d292f60ff1bbe817ea7200ef8c0a54cce2b51

  • SSDEEP

    12288:NVKqL95GKVh5QIXIxUOCY+5JHgc/73EW6kSb836D4X4pznu:NV9NB6+5Wc/7UWobAiOMnu

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

h0gd

Decoy

hispansud.com

sanslisin156.com

izmediajo.com

fukugyo-kuchicomi.net

zjzmkj.net

powerupinnovations.com

unigradecuracao.net

inspirasimagz.com

isaacnqwilliams.store

john316graphics.net

wcparadise.net

trejoblanco.com

100x100cultura.com

beedivinehomedecor.com

polant.xyz

ascrete.com

www23855.com

emmagx.com

rekotalent.biz

fersamultiservicios.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1d024b5fb222f690e2437776dba5cecd.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4868
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3388
    • C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\SysWOW64\chkdsk.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3744
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3388-20-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3388-16-0x00000000013E0000-0x00000000013F4000-memory.dmp

    Filesize

    80KB

  • memory/3388-11-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3388-17-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/3388-15-0x0000000001500000-0x000000000184A000-memory.dmp

    Filesize

    3.3MB

  • memory/3388-21-0x00000000014A0000-0x00000000014B4000-memory.dmp

    Filesize

    80KB

  • memory/3528-30-0x00000000073F0000-0x00000000074DE000-memory.dmp

    Filesize

    952KB

  • memory/3528-22-0x0000000008980000-0x0000000008B29000-memory.dmp

    Filesize

    1.7MB

  • memory/3528-23-0x0000000002CF0000-0x0000000002DCD000-memory.dmp

    Filesize

    884KB

  • memory/3528-18-0x0000000002CF0000-0x0000000002DCD000-memory.dmp

    Filesize

    884KB

  • memory/3528-27-0x0000000008980000-0x0000000008B29000-memory.dmp

    Filesize

    1.7MB

  • memory/3528-32-0x00000000073F0000-0x00000000074DE000-memory.dmp

    Filesize

    952KB

  • memory/3528-33-0x00000000073F0000-0x00000000074DE000-memory.dmp

    Filesize

    952KB

  • memory/3744-24-0x00000000009E0000-0x00000000009EA000-memory.dmp

    Filesize

    40KB

  • memory/3744-25-0x00000000009E0000-0x00000000009EA000-memory.dmp

    Filesize

    40KB

  • memory/3744-26-0x0000000001250000-0x000000000127F000-memory.dmp

    Filesize

    188KB

  • memory/4868-8-0x000000007492E000-0x000000007492F000-memory.dmp

    Filesize

    4KB

  • memory/4868-13-0x0000000074920000-0x00000000750D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4868-7-0x00000000051E0000-0x00000000051EE000-memory.dmp

    Filesize

    56KB

  • memory/4868-6-0x0000000006020000-0x00000000060BC000-memory.dmp

    Filesize

    624KB

  • memory/4868-4-0x0000000004D30000-0x0000000004D3A000-memory.dmp

    Filesize

    40KB

  • memory/4868-0-0x000000007492E000-0x000000007492F000-memory.dmp

    Filesize

    4KB

  • memory/4868-9-0x0000000074920000-0x00000000750D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4868-10-0x0000000009D40000-0x0000000009D98000-memory.dmp

    Filesize

    352KB

  • memory/4868-5-0x0000000074920000-0x00000000750D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4868-3-0x0000000004B90000-0x0000000004C22000-memory.dmp

    Filesize

    584KB

  • memory/4868-2-0x00000000051F0000-0x0000000005794000-memory.dmp

    Filesize

    5.6MB

  • memory/4868-1-0x0000000000150000-0x00000000001C2000-memory.dmp

    Filesize

    456KB