Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/01/2025, 07:49
Static task
static1
Behavioral task
behavioral1
Sample
4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe
Resource
win7-20240903-en
General
-
Target
4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe
-
Size
1.0MB
-
MD5
7219e991b1a4822c91639c242baed0fe
-
SHA1
b30d7f1a38efe698d5a94fa9c70b6e3f21f8439c
-
SHA256
4c29ecf0655519c8700f3392a1c2c962b523e9de0d34190b7d85e6c35d731bf2
-
SHA512
330a786b1a7ecaf849761ff9f1b9959e0b572bf7efc7328dc048b9b5cb8b7342f0f1d7fad2a97fe4f25204cb21a218271f7128202f44189bae18865d32f02e87
-
SSDEEP
24576:YAHnh+eWsN3skA4RV1Hom2KXMmHaMid+s8N5:fh+ZkldoPK8YaM3H
Malware Config
Extracted
formbook
4.1
as02
qwin777.com
robinhoods.live
h3jh-dal.pics
braindeadcopywriting.com
kktcbet1000.com
mpo0463.cfd
raboteshoes.com
ab1718.com
lowcrusiers.com
gregcopelandmusic.com
dkfndch.store
firstclassuni.com
00ewu1ub.com
shunweichemical.com
sugarits.com
marqify.com
mistmajik.com
trezip.online
tinytables.xyz
suestergocoaching.com
dominoad.com
specials.website
thatpilatesgirl.com
vrexpressok.com
sdegtho.com
svhomesinspections.com
rumbol88.com
dzplricfpf.com
fastcoolify.com
bloominginwholeness.com
12ser3.com
curtsreno.com
defx.ventures
dev-patel.xyz
ltyidc.com
wheiunudweowuqiwuebfyewui3.com
039c5m2ciwt99.top
pmpm.xyz
akabuka.net
parkerslandscapingllc.com
hamcast.com
jiangcapable.site
sassysensoryclips.com
arsalan.shop
thecryptocaviar.com
ofbsconsulting.com
j8j3e.cfd
cinexgltd.com
justcallnadia.com
qcyiran.com
uniseekglobal.com
milieunightclub.com
sisasimoslot.com
svizzblem.net
20644.asia
shroomberparty.com
contractcrafters.net
selectstylehome.shop
blackhillspr.com
topsolutionquality.online
diywithbje.com
simplywellcoach.com
popothebear.site
entendiendomedicare.com
sopaindam.com
Signatures
-
Formbook family
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2176-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2176-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2176-18-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2724-24-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2020 set thread context of 2176 2020 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe 30 PID 2176 set thread context of 1236 2176 svchost.exe 21 PID 2176 set thread context of 1236 2176 svchost.exe 21 PID 2724 set thread context of 1236 2724 colorcpl.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2176 svchost.exe 2176 svchost.exe 2176 svchost.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe 2724 colorcpl.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2020 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe 2176 svchost.exe 2176 svchost.exe 2176 svchost.exe 2176 svchost.exe 2724 colorcpl.exe 2724 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2176 svchost.exe Token: SeDebugPrivilege 2724 colorcpl.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2020 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe 2020 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2020 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe 2020 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2176 2020 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe 30 PID 2020 wrote to memory of 2176 2020 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe 30 PID 2020 wrote to memory of 2176 2020 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe 30 PID 2020 wrote to memory of 2176 2020 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe 30 PID 2020 wrote to memory of 2176 2020 4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe 30 PID 2176 wrote to memory of 2724 2176 svchost.exe 32 PID 2176 wrote to memory of 2724 2176 svchost.exe 32 PID 2176 wrote to memory of 2724 2176 svchost.exe 32 PID 2176 wrote to memory of 2724 2176 svchost.exe 32 PID 2724 wrote to memory of 2796 2724 colorcpl.exe 33 PID 2724 wrote to memory of 2796 2724 colorcpl.exe 33 PID 2724 wrote to memory of 2796 2724 colorcpl.exe 33 PID 2724 wrote to memory of 2796 2724 colorcpl.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe"C:\Users\Admin\AppData\Local\Temp\4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\4C29ECF0655519C8700F3392A1C2C962B523E9DE0D34190B7D85E6C35D731BF2.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"5⤵
- System Location Discovery: System Language Discovery
PID:2796
-
-
-
-