Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/01/2025, 07:54
Static task
static1
Behavioral task
behavioral1
Sample
8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe
Resource
win7-20240903-en
General
-
Target
8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe
-
Size
1.1MB
-
MD5
47707710ceef8190cd4cd7e4fd28591b
-
SHA1
a3e81115d9e6f3927de11aefe377fc5d1ee85854
-
SHA256
8c41a444478b203f5df1d1f74609057c499e885fe6050a8bd1cf5f0743ab6cee
-
SHA512
3b2a2a7401219a9fb817a41ee3077d6caa01a4d9de2cbb0af1cd49059d974c4a4f6f5c93f4142b1c035fc31eeb60f8470664679c5f66770d6a314315596e16c6
-
SSDEEP
24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8aHTZAwh3bYn:7TvC/MTQYxsWR7aHtAg
Malware Config
Extracted
formbook
4.1
ba94
dxtra.shop
upfromhere-eventsdecor.com
blacksevenkoeln.shop
pcboards2024.xyz
posteo.lol
naservus.com
pivotance.com
90ans.com
ebenezer-remodeling.com
reddragondao.com
gspotshop.com
thesiamesebetta.biz
rrdhq.com
greenislandservices.info
prismotrov.com
elaqbh.shop
sosenfantscovidlong.com
elmsolarsavings.com
sol-casino-2023.club
sharecroipper.top
yqwija.info
eat-smile.com
idj257.com
popenza.com
bingpueng.website
odty744.net
ooqowerh.com
primetechinnovationllc.com
themvpcatalyst.us
spesandosupermercato.com
arwile.com
pachecoarquitectos.com
csrhzs.com
citylinechimneythorntonpa.us
apocalypticsigil.us
shareebrooksphotography.com
hjgd.xyz
vertexoffice.com
xn--vf4b25j89a162a.com
fijula.com
odvip666.bet
sekutvk5ks.top
creditscorewizards.com
happyjon.com
18plusmovies.com
xn--vr-jc9iv7k9yrlb465i.net
saga-launchs.app
liyinghao.cc
binpc6.club
schatzaviation.com
employeefeedback.link
whatpixels.com
humidityflash.site
seraph.live
6lsamr.vip
hmi29.top
galaxyprofituk.com
educationman.me
heelfixkit.com
jacobmcfarland.dev
kso032.com
fdue.store
yourreicapital.com
ac6a2qa.cc
steam.help
Signatures
-
Formbook family
-
Formbook payload 4 IoCs
resource yara_rule behavioral1/memory/2556-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2556-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2556-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2752-25-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2688 set thread context of 2556 2688 8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe 30 PID 2556 set thread context of 1192 2556 svchost.exe 21 PID 2556 set thread context of 1192 2556 svchost.exe 21 PID 2752 set thread context of 1192 2752 svchost.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2688 8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2752 svchost.exe 2752 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2556 svchost.exe Token: SeDebugPrivilege 2752 svchost.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2556 2688 8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe 30 PID 2688 wrote to memory of 2556 2688 8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe 30 PID 2688 wrote to memory of 2556 2688 8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe 30 PID 2688 wrote to memory of 2556 2688 8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe 30 PID 2688 wrote to memory of 2556 2688 8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe 30 PID 1192 wrote to memory of 2752 1192 Explorer.EXE 32 PID 1192 wrote to memory of 2752 1192 Explorer.EXE 32 PID 1192 wrote to memory of 2752 1192 Explorer.EXE 32 PID 1192 wrote to memory of 2752 1192 Explorer.EXE 32 PID 2752 wrote to memory of 2876 2752 svchost.exe 33 PID 2752 wrote to memory of 2876 2752 svchost.exe 33 PID 2752 wrote to memory of 2876 2752 svchost.exe 33 PID 2752 wrote to memory of 2876 2752 svchost.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe"C:\Users\Admin\AppData\Local\Temp\8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\8C41A444478B203F5DF1D1F74609057C499E885FE6050A8BD1CF5F0743AB6CEE.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-