Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/01/2025, 07:52
Static task
static1
Behavioral task
behavioral1
Sample
CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe
Resource
win7-20240903-en
General
-
Target
CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe
-
Size
1.1MB
-
MD5
ce485df14c7c69d923b375cdd00a4d72
-
SHA1
ec606ce770065755c4f9d5499a9fde04d563809a
-
SHA256
cf1e31edb7bedf25369da849fd542383415787a0fc70a7d083e711735962df4b
-
SHA512
673d18bafd2887c586b0cddbbba64d996d188564fe931b00b7f01faa9e441807194068c3b7d07a035caf0dd03718d41c2c479d06057317505c02659b2ef264ff
-
SSDEEP
24576:pAHnh+eWsN3skA4RV1Hom2KXMmHagViEf1eI/qfLDkQXo5:wh+ZkldoPK8YagXoJLDE
Malware Config
Extracted
formbook
4.1
ph01
23888.sbs
zvcj.sbs
raitpourtrait.net
ibraryfarmclub.online
omputercourses123.live
j88.doctor
atsue-color.click
epitalrentgrup.online
rvvpn.lol
i-signals.tech
cr-phoenix.best
frican-safari.online
c-games.zone
oardetest.online
f4md.shop
uke-saaac.buzz
arze.dev
nvestment-services-49610.bond
izatrip.sbs
ameron-paaaa.buzz
esourceshark.info
ovamedrx.net
yzena.tech
ichardsjewelers.shop
olar-panel-jobs-67676.bond
oreanewspapers.top
olcon.live
evzuatakademi.online
ackdoortwinks.net
s23301.top
ool-works.net
inhhuan5g.sbs
redit-cards-se-9.bond
9509.club
athroomremodeling-pa-us2.click
obbypetrino.shop
uliet707.vip
bvcaz.xyz
ppcashvip.online
d-animation-degree-99775.bond
p39.xyz
hatsapz8.top
eamidiots.shop
mujo57abmb6c9me.app
edinvest.tech
hiskerwonderspro.yachts
glczs.shop
andscaping-services-69969.bond
93wh245ds.autos
arubear.shop
yqwzijbfrh9.asia
hiramon.cloud
5cbrx.shop
ahjong168.vip
echanictrainingsearch.today
lientserver.cfd
eeklybyte.net
oanweb.live
astbaytreecareservice.info
47000.xyz
r-software-14916.bond
8376.club
ublimax.online
uckchina.net
ootdetoxes.shop
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/3032-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3032-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2952-20-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2372 set thread context of 3032 2372 CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe 31 PID 3032 set thread context of 1200 3032 svchost.exe 21 PID 2952 set thread context of 1200 2952 mstsc.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mstsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 3032 svchost.exe 3032 svchost.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe 2952 mstsc.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2372 CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe 3032 svchost.exe 3032 svchost.exe 3032 svchost.exe 2952 mstsc.exe 2952 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3032 svchost.exe Token: SeDebugPrivilege 2952 mstsc.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2372 CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe 2372 CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2372 CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe 2372 CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2372 wrote to memory of 3032 2372 CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe 31 PID 2372 wrote to memory of 3032 2372 CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe 31 PID 2372 wrote to memory of 3032 2372 CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe 31 PID 2372 wrote to memory of 3032 2372 CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe 31 PID 2372 wrote to memory of 3032 2372 CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe 31 PID 1200 wrote to memory of 2952 1200 Explorer.EXE 32 PID 1200 wrote to memory of 2952 1200 Explorer.EXE 32 PID 1200 wrote to memory of 2952 1200 Explorer.EXE 32 PID 1200 wrote to memory of 2952 1200 Explorer.EXE 32 PID 2952 wrote to memory of 2716 2952 mstsc.exe 33 PID 2952 wrote to memory of 2716 2952 mstsc.exe 33 PID 2952 wrote to memory of 2716 2952 mstsc.exe 33 PID 2952 wrote to memory of 2716 2952 mstsc.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe"C:\Users\Admin\AppData\Local\Temp\CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\CF1E31EDB7BEDF25369DA849FD542383415787A0FC70A7D083E711735962DF4B.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2716
-
-