Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2025, 02:33

General

  • Target

    20fdf7fbe573d9233084f2f338379815159e9c057a5b1189f8007d3ccf0e4204.exe

  • Size

    749KB

  • MD5

    5bc818a30e4d9d8a6bb828767ca1bf2a

  • SHA1

    b0ce6d58037a4f05cb31eeca7db4ad2c347bc358

  • SHA256

    20fdf7fbe573d9233084f2f338379815159e9c057a5b1189f8007d3ccf0e4204

  • SHA512

    d4d674c4cc0484160b4458cfbf6c670b066536241b9888c9b022ca2ee5bdf83e35153508ba5a5cd6127bab53704d8af49e89dcd2c92de9fd110f1164d34db3d2

  • SSDEEP

    12288:6EUHsWksNFwTFMKh5EOU30lLG6wVxm0f8dIqCSzy+MbM+jikHUUkLItauQmE:YsWfY+sy30lLG5xm+87CSzEE+PtaoE

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m25s

Decoy

araghospitality.net

cleans.xyz

olnacasinotcs14.top

pringhillinfos.net

erkakasrumah.online

orean-course-289113002.zone

yeloma-treatment-82106.bond

76iw543gw.autos

nline-shopping-56055.bond

enetik.xyz

ax-th-6011838.fyi

itygatehousing.app

23zy998jk.bond

pslag-hal-2.online

uykoii.shop

9supjub3p.buzz

tmgl.bond

actus-catering-creations.net

ntercashspace24.homes

ierra777.vip

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20fdf7fbe573d9233084f2f338379815159e9c057a5b1189f8007d3ccf0e4204.exe
    "C:\Users\Admin\AppData\Local\Temp\20fdf7fbe573d9233084f2f338379815159e9c057a5b1189f8007d3ccf0e4204.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\20fdf7fbe573d9233084f2f338379815159e9c057a5b1189f8007d3ccf0e4204.exe
      "C:\Users\Admin\AppData\Local\Temp\20fdf7fbe573d9233084f2f338379815159e9c057a5b1189f8007d3ccf0e4204.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2080-6-0x00000000048D0000-0x0000000004946000-memory.dmp

    Filesize

    472KB

  • memory/2080-1-0x0000000000F30000-0x0000000000FF2000-memory.dmp

    Filesize

    776KB

  • memory/2080-2-0x0000000074120000-0x000000007480E000-memory.dmp

    Filesize

    6.9MB

  • memory/2080-3-0x00000000004F0000-0x0000000000508000-memory.dmp

    Filesize

    96KB

  • memory/2080-4-0x000000007412E000-0x000000007412F000-memory.dmp

    Filesize

    4KB

  • memory/2080-5-0x0000000074120000-0x000000007480E000-memory.dmp

    Filesize

    6.9MB

  • memory/2080-0-0x000000007412E000-0x000000007412F000-memory.dmp

    Filesize

    4KB

  • memory/2080-14-0x0000000074120000-0x000000007480E000-memory.dmp

    Filesize

    6.9MB

  • memory/2592-7-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2592-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2592-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2592-9-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2592-15-0x0000000000860000-0x0000000000B63000-memory.dmp

    Filesize

    3.0MB