Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/01/2025, 08:44
Static task
static1
Behavioral task
behavioral1
Sample
order list.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
order list.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/bpibxkjlns.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/bpibxkjlns.dll
Resource
win10v2004-20241007-en
General
-
Target
order list.exe
-
Size
252KB
-
MD5
8e07e5bfcdfb06fe00332798af731c1b
-
SHA1
f937ba7129daff91a011aaa5ce767db5763c359c
-
SHA256
1f7edeff96ea1955ea6642e4d739f6a98cb1315d9f78fe23ae3419fb24878103
-
SHA512
c2ec48656985a8190f10305fc8d11162453457322fceb11c95cd87e0a18099697e3d815db42e0f82166edcf02170c2bf85b4c034d1daeeb285a8466ddaef9318
-
SSDEEP
6144:wBlL/cdXKcGiepdi1NxLY4kMa/ETi3d09+cy5x7Yq:CedzkEr0x/ETYsjyX8q
Malware Config
Extracted
formbook
4.1
dn7r
eventphotographerdfw.com
thehalalcoinstaking.com
philipfaziofineart.com
intercoh.com
gaiaseyephotography.com
chatbotforrealestate.com
lovelancemg.com
marlieskasberger.com
elcongoenespanol.info
lepirecredit.com
distribution-concept.com
e99game.com
exit11festival.com
twodollartoothbrushclub.com
cocktailsandlawn.com
performimprove.network
24horas-telefono-11840.com
cosmossify.com
kellenleote.com
perovskite.energy
crosschain.services
xiwanghe.com
mollycayton.com
bonipay.com
uuwyxc.com
viberiokno-online.com
mobceo.com
menzelna.com
tiffaniefoster.com
premiumautowesthartford.com
ownhome.house
bestmartinshop.com
splashstoreofficial.com
guidemining.com
ecshopdemo.com
bestprinting1.com
s-circle2020.com
ncagency.info
easydigitalzone.com
reikiforthecollective.com
theknottteam.com
evolvedpixel.com
japxo.online
ryansqualityrenovations.com
dentimagenquito.net
pantherprints.co.uk
apoporangi.com
thietkemietvuon.net
ifernshop.com
casaruralesgranada.com
camp-3saumons.com
eddsucks.com
blwcd.com
deldlab.com
susanperb.com
autosanitizingsolutions.com
femhouse.com
ironcageclash.com
thekinghealer.com
shaghayeghbovand.com
advertfaces.com
lonriley.com
mased-world.online
mythicspacex.com
yourherogarden.net
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2744-8-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2744-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3068-16-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2620 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2896 order list.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2896 set thread context of 2744 2896 order list.exe 30 PID 2744 set thread context of 1212 2744 order list.exe 21 PID 3068 set thread context of 1212 3068 cmmon32.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language order list.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmmon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2744 order list.exe 2744 order list.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe 3068 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2744 order list.exe 2744 order list.exe 2744 order list.exe 3068 cmmon32.exe 3068 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2744 order list.exe Token: SeDebugPrivilege 3068 cmmon32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2744 2896 order list.exe 30 PID 2896 wrote to memory of 2744 2896 order list.exe 30 PID 2896 wrote to memory of 2744 2896 order list.exe 30 PID 2896 wrote to memory of 2744 2896 order list.exe 30 PID 2896 wrote to memory of 2744 2896 order list.exe 30 PID 2896 wrote to memory of 2744 2896 order list.exe 30 PID 2896 wrote to memory of 2744 2896 order list.exe 30 PID 1212 wrote to memory of 3068 1212 Explorer.EXE 31 PID 1212 wrote to memory of 3068 1212 Explorer.EXE 31 PID 1212 wrote to memory of 3068 1212 Explorer.EXE 31 PID 1212 wrote to memory of 3068 1212 Explorer.EXE 31 PID 3068 wrote to memory of 2620 3068 cmmon32.exe 32 PID 3068 wrote to memory of 2620 3068 cmmon32.exe 32 PID 3068 wrote to memory of 2620 3068 cmmon32.exe 32 PID 3068 wrote to memory of 2620 3068 cmmon32.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\order list.exe"C:\Users\Admin\AppData\Local\Temp\order list.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\order list.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2620
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5baf456a0f50b4a00dd3a624bb46b5950
SHA11d896ed35f724cd6e5168ebc7e5e670f85eb36f9
SHA256de5e7a9b204e8cdeaf9c002a81732d8487c4547c0c98d353cab896f92b8c851d
SHA512e883bfaed10a560ac83b8466e524032148873b3c70411da25124db486863413749cec9e5b80cf593a2f81bca23b139172d8c8e49eb0a2b744b497c5f3a3b13ae