Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/01/2025, 08:39
Static task
static1
Behavioral task
behavioral1
Sample
sssddhhing.exe
Resource
win7-20240903-en
General
-
Target
sssddhhing.exe
-
Size
1.3MB
-
MD5
17374c7c08d5a0bc971e2988f2364c8c
-
SHA1
dc9fd0ec4c80aadd53b77c3d920e0dc2c6b192ce
-
SHA256
397015a1428f2ee24e69d670f97b98f744039041eaea4e9836a27b01ce96b793
-
SHA512
54ffdd249cf89082816038e26cb2dce60397965a7e9ce4222488b93f3b1762d2aee9cfbf3b952aaaa5871ddf34ed4a2067b03d1a0e0fd966f2dd7f4a7318af00
-
SSDEEP
24576:AqDEvCTbMWu7rQYlBQcBiT6rprG8adaxlGbI5d5tRp2FpiLYtul:ATvC/MTQYxsWR7adaXt2jwx
Malware Config
Extracted
formbook
4.1
a02d
coplus.market
oofing-jobs-74429.bond
healchemists.xyz
oofcarpenternearme-jp.xyz
enewebsolutions.online
harepoint.legal
88977.club
omptables.xyz
eat-pumps-31610.bond
endown.graphics
amsexgirls.website
ovevibes.xyz
u-thiensu.online
yblinds.xyz
rumpchiefofstaff.store
erzog.fun
rrm.lat
agiclime.pro
agaviet59.shop
lbdoanhnhan.net
irvasenitpalvelut.online
strange.store
bsidiansurvival.shop
lown.bond
irrorbd.online
idzev.shop
tyleyourvibe.shop
qweemaildwqfewew.live
sychology-degree-92767.bond
orklift-jobs-76114.bond
nytymeoccassions.store
nfluencer-marketing-41832.bond
rh799295w.vip
066661a23.buzz
m235a.net
omestur.online
nalyzator.fun
itchen-remodeling-41686.bond
ontenbully.shop
oratrading.best
tiwebu.info
lueticks.shop
ocubox.xyz
q33.lat
earch-solar-installer-top.today
ceqne.vip
8betpragmatic.store
oftware-download-37623.bond
oofing-jobs-29700.bond
vorachem.xyz
ruck-driver-jobs-58337.bond
om-exchange-nft370213.sbs
jfghnxnvdfgh.icu
inhngoc.webcam
ruck-driver-jobs-86708.bond
oftware-engineering-27699.bond
nfoyl.xyz
estionprojetsccpm.online
reativesos.studio
ammamiaitalia.net
4cw.lat
oofighters.xyz
ukusindo4dpools.net
yhbvc.xyz
8435.pizza
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/1956-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1956-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2772-11-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2380 set thread context of 1956 2380 sssddhhing.exe 30 PID 1956 set thread context of 1256 1956 svchost.exe 21 PID 2772 set thread context of 1256 2772 cmstp.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sssddhhing.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmstp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 1956 svchost.exe 1956 svchost.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe 2772 cmstp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2380 sssddhhing.exe 1956 svchost.exe 1956 svchost.exe 1956 svchost.exe 2772 cmstp.exe 2772 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1956 svchost.exe Token: SeDebugPrivilege 2772 cmstp.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2380 sssddhhing.exe 2380 sssddhhing.exe 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2380 sssddhhing.exe 2380 sssddhhing.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1956 2380 sssddhhing.exe 30 PID 2380 wrote to memory of 1956 2380 sssddhhing.exe 30 PID 2380 wrote to memory of 1956 2380 sssddhhing.exe 30 PID 2380 wrote to memory of 1956 2380 sssddhhing.exe 30 PID 2380 wrote to memory of 1956 2380 sssddhhing.exe 30 PID 1256 wrote to memory of 2772 1256 Explorer.EXE 54 PID 1256 wrote to memory of 2772 1256 Explorer.EXE 54 PID 1256 wrote to memory of 2772 1256 Explorer.EXE 54 PID 1256 wrote to memory of 2772 1256 Explorer.EXE 54 PID 1256 wrote to memory of 2772 1256 Explorer.EXE 54 PID 1256 wrote to memory of 2772 1256 Explorer.EXE 54 PID 1256 wrote to memory of 2772 1256 Explorer.EXE 54 PID 2772 wrote to memory of 2840 2772 cmstp.exe 56 PID 2772 wrote to memory of 2840 2772 cmstp.exe 56 PID 2772 wrote to memory of 2840 2772 cmstp.exe 56 PID 2772 wrote to memory of 2840 2772 cmstp.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\sssddhhing.exe"C:\Users\Admin\AppData\Local\Temp\sssddhhing.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\sssddhhing.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2016
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2932
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2996
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3000
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3012
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:3068
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2276
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2548
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1788
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2196
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2148
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2864
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1656
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2128
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2144
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:1156
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:824
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2700
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2768
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2784
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2788
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2800
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2836
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2840
-
-