Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/01/2025, 12:21

General

  • Target

    JaffaCakes118_9f10e1bdb5ede753b4bca22a23387fec.exe

  • Size

    373KB

  • MD5

    9f10e1bdb5ede753b4bca22a23387fec

  • SHA1

    7bc2a0eb5f9c35c67ddab36c157bf010acff639a

  • SHA256

    fbf2f8d8779766534f7217c48d9e66207aa5434d6d89c617420a172fc5c7a144

  • SHA512

    8da683ec28ba55b35700f1067af07ece28c91cc92ef7ea7609f903a83db294a2739c0e222626ac175298e23c5109f8cd37dfce0e083a55f9d70c75e12c2297f6

  • SSDEEP

    6144:RyTMZytLYi08L8YnFfBXsOBrFtHrnObhcTm1PjyXnKI6/va6XWgA5Dyh10FN:iMtBtGBc0rFtHrO6Tm1Ly56/vaXxyK

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kzk9

Decoy

tianconghuo.club

1996-page.com

ourtownmax.net

conservativetreehose.com

synth.repair

donnachicacreperia.com

tentfull.com

weapp.download

surfersink.com

gattlebusinessservices.com

sebastian249.com

anhphuc.company

betternatureproducts.net

defroplate.com

seattlesquidsquad.com

polarjob.com

lendingadvantage.com

angelsondope.com

goportjitney.com

tiendagrupojagr.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f10e1bdb5ede753b4bca22a23387fec.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f10e1bdb5ede753b4bca22a23387fec.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f10e1bdb5ede753b4bca22a23387fec.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f10e1bdb5ede753b4bca22a23387fec.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1748-0-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

    Filesize

    4KB

  • memory/1748-1-0x0000000000D90000-0x0000000000DF4000-memory.dmp

    Filesize

    400KB

  • memory/1748-2-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/1748-3-0x0000000000450000-0x000000000045E000-memory.dmp

    Filesize

    56KB

  • memory/1748-4-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/1748-5-0x00000000046D0000-0x0000000004726000-memory.dmp

    Filesize

    344KB

  • memory/1748-11-0x0000000074C40000-0x000000007532E000-memory.dmp

    Filesize

    6.9MB

  • memory/2836-10-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2836-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2836-7-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2836-6-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2836-12-0x00000000008F0000-0x0000000000BF3000-memory.dmp

    Filesize

    3.0MB