Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03/01/2025, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe
Resource
win7-20241010-en
General
-
Target
DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe
-
Size
1.1MB
-
MD5
36bf1a6c87d19d23cf7054e102296a31
-
SHA1
de79b432180085cae501db3cdf3863b1802245cf
-
SHA256
dc3bc30caf7551eb4a3215284e8ea7218d4270a82907642b4dddba6decbfe9bc
-
SHA512
ad5bb4f8dab7ea959c2635a0aeeedc1a8e2e9d3f7fdb839df7152324cd42e5d98fc1807758c42dcd9a1ff2504f2a5291ed72aefddb5499cf33ea8579adf64b8f
-
SSDEEP
24576:fAHnh+eWsN3skA4RV1Hom2KXMmHaPcaGOUetKgbkW58xk1e5:Ch+ZkldoPK8YaPc17kd8SW
Malware Config
Extracted
formbook
4.1
pt46
twinportslocal.com
rovor.store
98169.club
mdywl.com
jrd3s.rest
aston1717.top
floridawoodworkingmachinery.com
17tk555t.com
ankitsho.shop
seclameh.com
realrecordlabel.com
trenchonbirmingham.com
af28.top
rtp1kenzototo.com
theselflovesite.com
promotegetpaid.info
strategiclogisticsagency.com
learneracademy.net
per-watch.com
betbox2341.com
22958.xyz
birthdaywishestexts.com
nihilculturamail.com
vasymaman.com
evriukpostaes.sbs
winkingbots.com
cb214.pro
osakanacreation.com
kingchuxing.com
dr-cotton.net
iiixc759q.xyz
eraplay88rtpgacor.lat
wguujb.com
dental-implants-89083.bond
liposuction-89237.bond
harbalmaizik.com
seoservicesdelhi.net
fakefox.xyz
wimetimephotos.com
healthsaveplus.com
wvufcw948o.top
dieselrockpartners.com
istchannelnet.com
123moviesonl.com
arlatwestern.shop
cloudproduction.cloud
gv3l1.vip
casino-x-zerkalo27pm.xyz
serverdayz.com
dvdripguides.com
vitalfitness.site
c21candacedevillier.com
gory12.online
0452frl.com
escpethemtrix.top
koumimi.tech
me29hs38g1.com
dreziuy.xyz
uddyen.shop
asia76s.xyz
melliccine.com
olxelang.com
paincareathome.com
sliveringaf.christmas
wheresthechocolateat.com
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2076-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2076-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2076-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3056 set thread context of 2076 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 30 PID 2076 set thread context of 1200 2076 svchost.exe 21 PID 2076 set thread context of 1200 2076 svchost.exe 21 -
Program crash 1 IoCs
pid pid_target Process procid_target 2648 2124 WerFault.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe 2076 svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2076 svchost.exe Token: SeShutdownPrivilege 1200 Explorer.EXE Token: SeShutdownPrivilege 1200 Explorer.EXE Token: SeShutdownPrivilege 1200 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2076 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 30 PID 3056 wrote to memory of 2076 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 30 PID 3056 wrote to memory of 2076 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 30 PID 3056 wrote to memory of 2076 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 30 PID 3056 wrote to memory of 2076 3056 DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe 30 PID 2076 wrote to memory of 2124 2076 svchost.exe 32 PID 2076 wrote to memory of 2124 2076 svchost.exe 32 PID 2076 wrote to memory of 2124 2076 svchost.exe 32 PID 2076 wrote to memory of 2124 2076 svchost.exe 32 PID 2076 wrote to memory of 2124 2076 svchost.exe 32 PID 2076 wrote to memory of 2124 2076 svchost.exe 32 PID 2076 wrote to memory of 2124 2076 svchost.exe 32 PID 2124 wrote to memory of 2648 2124 msiexec.exe 33 PID 2124 wrote to memory of 2648 2124 msiexec.exe 33 PID 2124 wrote to memory of 2648 2124 msiexec.exe 33 PID 2124 wrote to memory of 2648 2124 msiexec.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe"C:\Users\Admin\AppData\Local\Temp\DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\DC3BC30CAF7551EB4A3215284E8EA7218D4270A82907642B4DDDBA6DECBFE9BC.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 2725⤵
- Program crash
PID:2648
-
-
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:2768
-