Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2025, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe
Resource
win7-20240903-en
General
-
Target
F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe
-
Size
1.1MB
-
MD5
c9cece47f081ecb047ea64aea3b3c5c5
-
SHA1
03406e0d1340cd41734b20b158a9feac7dd14848
-
SHA256
f60f8e29acfcc87577de704d3fd0405f91244f6aedec9fdb7be785c7b5d29751
-
SHA512
e7a9deadcd2437285c51c791eabf2d2d683470acfa50d167c12306486b2a997e99d718bf39c2163c983256e2874030fe83afae48c284e9c7891c7861d0375630
-
SSDEEP
24576:8AHnh+eWsN3skA4RV1Hom2KXMmHafFxZyvgVaL5:bh+ZkldoPK8YafF7yD
Malware Config
Extracted
formbook
4.1
nu28
papage.com
dohezar.com
fegongroupserver.site
cloudhare.biz
rlxiom.xyz
emmaandrobertswedding.com
fengchenfangfu.com
jimsbestk.com
5004926.com
87558qq.ren
verify-coinbase-wallet.com
mambaka.com
foxyfinds4u.com
wearepawparents.com
pocho.shop
yoursgxmarketing.com
copywritemoney.com
armortechconsulting.com
irnt0ken-al.com
umyowallstreet.site
setamang.com
yushengbang.com
bcbg.info
betmay.top
villaacresgreen.com
qiaozi33g.com
primetrendzzz.com
98swa3.com
swingforchildrenvenezuela.com
onedkwebhosting.net
triplertestpumps.com
jojokramer.com
amtcmagnets.com
kcitfide.com
jebollo.com
regulationbingo.com
akharmarket.com
ecommerce-24570.bond
shopcreativeness.com
pistadev.com
giodidomenico09.com
shangguanjiye.online
visitlansele.com
cafoodiopa.com
gliamicidellatora.com
marunekosol.com
jatimhardwareapp.com
slickwilliesskates.com
s-url.net
quitnowprogram.com
betmigam.com
j-ii-j.com
3824640.com
xcxocen.shop
3minloan.com
modalprotocol.com
500kasv.com
wolfmeds.com
blaqboxllc.com
servicetopper.gmbh
bcis.tech
mongcherie.com
9xlgr.club
666301com-dfs.buzz
healthizes.com
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/840-11-0x0000000000480000-0x00000000004AF000-memory.dmp formbook behavioral2/memory/840-15-0x0000000000480000-0x00000000004AF000-memory.dmp formbook behavioral2/memory/4700-20-0x0000000000D90000-0x0000000000DBF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1680 set thread context of 840 1680 F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe 83 PID 840 set thread context of 3516 840 svchost.exe 56 PID 4700 set thread context of 3516 4700 cscript.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 840 svchost.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe 4700 cscript.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1680 F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe 1680 F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe 840 svchost.exe 840 svchost.exe 840 svchost.exe 4700 cscript.exe 4700 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 840 svchost.exe Token: SeDebugPrivilege 4700 cscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1680 F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe 1680 F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1680 F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe 1680 F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1680 wrote to memory of 840 1680 F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe 83 PID 1680 wrote to memory of 840 1680 F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe 83 PID 1680 wrote to memory of 840 1680 F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe 83 PID 1680 wrote to memory of 840 1680 F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe 83 PID 3516 wrote to memory of 4700 3516 Explorer.EXE 84 PID 3516 wrote to memory of 4700 3516 Explorer.EXE 84 PID 3516 wrote to memory of 4700 3516 Explorer.EXE 84 PID 4700 wrote to memory of 3448 4700 cscript.exe 86 PID 4700 wrote to memory of 3448 4700 cscript.exe 86 PID 4700 wrote to memory of 3448 4700 cscript.exe 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe"C:\Users\Admin\AppData\Local\Temp\F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\F60F8E29ACFCC87577DE704D3FD0405F91244F6AEDEC9FDB7BE785C7B5D29751.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:840
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3448
-
-