Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/01/2025, 08:23
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_57e95002c65e37c937636d6a802ed998.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_57e95002c65e37c937636d6a802ed998.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/xjujmofosc.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/xjujmofosc.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/xjujmofosc.dll
-
Size
19KB
-
MD5
ac0ac6a7d57e4fd3137b57ea17e15178
-
SHA1
36f461a0cbc6a4561b08668c43e461b30dc462b8
-
SHA256
b1d82a6fc8574306088346d467e59094a3ed933de4de3e4f7703664c34a84f82
-
SHA512
31e39ca8118a3161f83c545241be617685992f09353daafbefaa16117b047b2eeb6ef0eb904957d02e93dfbbd46783d7c0d408dad62349f29cff53704e56b280
-
SSDEEP
384:itICC1G8JstE8o/lkKU+VThlVTtAHTmicG:8ICC1LJTL97QTQ
Malware Config
Extracted
formbook
4.1
dn7r
eventphotographerdfw.com
thehalalcoinstaking.com
philipfaziofineart.com
intercoh.com
gaiaseyephotography.com
chatbotforrealestate.com
lovelancemg.com
marlieskasberger.com
elcongoenespanol.info
lepirecredit.com
distribution-concept.com
e99game.com
exit11festival.com
twodollartoothbrushclub.com
cocktailsandlawn.com
performimprove.network
24horas-telefono-11840.com
cosmossify.com
kellenleote.com
perovskite.energy
crosschain.services
xiwanghe.com
mollycayton.com
bonipay.com
uuwyxc.com
viberiokno-online.com
mobceo.com
menzelna.com
tiffaniefoster.com
premiumautowesthartford.com
ownhome.house
bestmartinshop.com
splashstoreofficial.com
guidemining.com
ecshopdemo.com
bestprinting1.com
s-circle2020.com
ncagency.info
easydigitalzone.com
reikiforthecollective.com
theknottteam.com
evolvedpixel.com
japxo.online
ryansqualityrenovations.com
dentimagenquito.net
pantherprints.co.uk
apoporangi.com
thietkemietvuon.net
ifernshop.com
casaruralesgranada.com
camp-3saumons.com
eddsucks.com
blwcd.com
deldlab.com
susanperb.com
autosanitizingsolutions.com
femhouse.com
ironcageclash.com
thekinghealer.com
shaghayeghbovand.com
advertfaces.com
lonriley.com
mased-world.online
mythicspacex.com
yourherogarden.net
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral3/memory/1220-1-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral3/memory/1220-4-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral3/memory/1496-11-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1736 set thread context of 1220 1736 rundll32.exe 31 PID 1220 set thread context of 1204 1220 rundll32.exe 21 PID 1496 set thread context of 1204 1496 rundll32.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 1220 rundll32.exe 1220 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1220 rundll32.exe 1220 rundll32.exe 1220 rundll32.exe 1496 rundll32.exe 1496 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1220 rundll32.exe Token: SeDebugPrivilege 1496 rundll32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1736 1732 rundll32.exe 30 PID 1732 wrote to memory of 1736 1732 rundll32.exe 30 PID 1732 wrote to memory of 1736 1732 rundll32.exe 30 PID 1732 wrote to memory of 1736 1732 rundll32.exe 30 PID 1732 wrote to memory of 1736 1732 rundll32.exe 30 PID 1732 wrote to memory of 1736 1732 rundll32.exe 30 PID 1732 wrote to memory of 1736 1732 rundll32.exe 30 PID 1736 wrote to memory of 1220 1736 rundll32.exe 31 PID 1736 wrote to memory of 1220 1736 rundll32.exe 31 PID 1736 wrote to memory of 1220 1736 rundll32.exe 31 PID 1736 wrote to memory of 1220 1736 rundll32.exe 31 PID 1736 wrote to memory of 1220 1736 rundll32.exe 31 PID 1736 wrote to memory of 1220 1736 rundll32.exe 31 PID 1736 wrote to memory of 1220 1736 rundll32.exe 31 PID 1736 wrote to memory of 1220 1736 rundll32.exe 31 PID 1736 wrote to memory of 1220 1736 rundll32.exe 31 PID 1736 wrote to memory of 1220 1736 rundll32.exe 31 PID 1204 wrote to memory of 1496 1204 Explorer.EXE 32 PID 1204 wrote to memory of 1496 1204 Explorer.EXE 32 PID 1204 wrote to memory of 1496 1204 Explorer.EXE 32 PID 1204 wrote to memory of 1496 1204 Explorer.EXE 32 PID 1204 wrote to memory of 1496 1204 Explorer.EXE 32 PID 1204 wrote to memory of 1496 1204 Explorer.EXE 32 PID 1204 wrote to memory of 1496 1204 Explorer.EXE 32 PID 1496 wrote to memory of 2296 1496 rundll32.exe 33 PID 1496 wrote to memory of 2296 1496 rundll32.exe 33 PID 1496 wrote to memory of 2296 1496 rundll32.exe 33 PID 1496 wrote to memory of 2296 1496 rundll32.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xjujmofosc.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xjujmofosc.dll,#13⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xjujmofosc.dll,#14⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\rundll32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2296
-
-