Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/01/2025, 11:19

General

  • Target

    JaffaCakes118_c6d40c961c2a1940c29ff433fc9217ee.exe

  • Size

    427KB

  • MD5

    c6d40c961c2a1940c29ff433fc9217ee

  • SHA1

    a55d2f584620864fe9eb49e7647bb86fc2c20050

  • SHA256

    cf0d36f933310c07f1554db7e6e8a2e79c01ee933717e13f96ae841302306512

  • SHA512

    97c9df9f0492303c86a94e0fb25edac5cbd23e30cc4bcddc00ef47f7b70a7642da57f144bfa505a3ef0cad2de7f8d4fe464e58df931aeb54861e57c84f65fff7

  • SSDEEP

    6144:tBlL/ZgH+UQj3bLOj95PIDTOmuOsViEr6Bwh75FSPsGkdcR2K1tXuOE3u5y:biS3/sb2ONO8iErndSPhVtSd

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

dn7r

Decoy

eventphotographerdfw.com

thehalalcoinstaking.com

philipfaziofineart.com

intercoh.com

gaiaseyephotography.com

chatbotforrealestate.com

lovelancemg.com

marlieskasberger.com

elcongoenespanol.info

lepirecredit.com

distribution-concept.com

e99game.com

exit11festival.com

twodollartoothbrushclub.com

cocktailsandlawn.com

performimprove.network

24horas-telefono-11840.com

cosmossify.com

kellenleote.com

perovskite.energy

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c6d40c961c2a1940c29ff433fc9217ee.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c6d40c961c2a1940c29ff433fc9217ee.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c6d40c961c2a1940c29ff433fc9217ee.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c6d40c961c2a1940c29ff433fc9217ee.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsy94D1.tmp\brfrqelhtqi.dll

    Filesize

    20KB

    MD5

    08f8c05553706af957306d9cce346ebb

    SHA1

    bc1ccb5f00c582752d4a5103b122fe5299dad8d4

    SHA256

    628e6ecd0231ccdefd6d684a8d0f07ff16f0213ae04e29adb7ff94853cce2cc3

    SHA512

    3dd9ea6672f45734931e194b066fe042a4d79e6cdd8a8999b874b7a4eaacf09d123e77d996be795b0d6e131fd9555e17fd4af445c1ad8c9a9cd3cb5f0ec1e0a1

  • memory/1168-9-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1936-7-0x0000000010005000-0x0000000010007000-memory.dmp

    Filesize

    8KB