Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/01/2025, 02:25
Static task
static1
Behavioral task
behavioral1
Sample
31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe
Resource
win7-20240903-en
General
-
Target
31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe
-
Size
664KB
-
MD5
ad5806ffe238ea11606d3ee49b28c655
-
SHA1
953393b81ec159e23c16459681820317f2f63d18
-
SHA256
31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989
-
SHA512
8c2829ad04e922b5d2f67f3e2eef2bae4dd315ea18af11a5ce80074bedeaa4c5046db5d568fa81179ed00ca80c5130a4e9230b3236803dc8c61a12429d6d079f
-
SSDEEP
12288:Gf6YRxA4Y5lyA/BxSPCR7v7w4+UdUQCqZqGvwpfWySsV7cz7Ha8cAB2RZ+B7c:QRobk4+QDCqZqwwpOCVi5cb07c
Malware Config
Extracted
formbook
4.1
a03d
nfluencer-marketing-13524.bond
cebepu.info
lphatechblog.xyz
haoyun.website
itiz.xyz
orld-visa-center.online
si.art
alata.xyz
mmarketing.xyz
elnqdjc.shop
ensentoto.cloud
voyagu.info
onvert.today
1fuli9902.shop
otelhafnia.info
rumpchiefofstaff.store
urvivalflashlights.shop
0090.pizza
ings-hu-13.today
oliticalpatriot.net
5970.pizza
arimatch-in.legal
eepvid.xyz
bfootball.net
otorcycle-loans-19502.bond
nline-advertising-34790.bond
behm.info
aportsystems.store
agiararoma.net
agfov4u.xyz
9769.mobi
ome-renovation-86342.bond
kkkk.shop
duxrib.xyz
xurobo.info
leurdivin.online
ive-neurozoom.store
ndogaming.online
dj1.lat
yselection.xyz
52628.xyz
lsaadmart.store
oftware-download-92806.bond
avid-hildebrand.info
orashrine.store
erpangina-treatment-views.sbs
ategorie-polecane-831.buzz
oonlightshadow.shop
istromarmitaria.online
gmgslzdc.sbs
asglobalaz.shop
locarry.store
eleefmestreech.online
inggraphic.pro
atidiri.fun
olourclubbet.shop
eatbox.store
romatografia.online
encortex.beauty
8oosnny.xyz
72266.vip
aja168e.live
fath.shop
argloscaremedia.info
enelog.xyz
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
resource yara_rule behavioral1/memory/2872-24-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2648-29-0x00000000000B0000-0x00000000000DF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2896 powershell.exe 1936 powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3032 set thread context of 2872 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 37 PID 2872 set thread context of 1200 2872 MSBuild.exe 21 PID 2648 set thread context of 1200 2648 cscript.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2848 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 2896 powershell.exe 1936 powershell.exe 2872 MSBuild.exe 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 2872 MSBuild.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe 2648 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2872 MSBuild.exe 2872 MSBuild.exe 2872 MSBuild.exe 2648 cscript.exe 2648 cscript.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe Token: SeDebugPrivilege 2896 powershell.exe Token: SeDebugPrivilege 1936 powershell.exe Token: SeDebugPrivilege 2872 MSBuild.exe Token: SeDebugPrivilege 2648 cscript.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3032 wrote to memory of 1936 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 31 PID 3032 wrote to memory of 1936 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 31 PID 3032 wrote to memory of 1936 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 31 PID 3032 wrote to memory of 1936 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 31 PID 3032 wrote to memory of 2896 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 33 PID 3032 wrote to memory of 2896 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 33 PID 3032 wrote to memory of 2896 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 33 PID 3032 wrote to memory of 2896 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 33 PID 3032 wrote to memory of 2848 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 34 PID 3032 wrote to memory of 2848 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 34 PID 3032 wrote to memory of 2848 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 34 PID 3032 wrote to memory of 2848 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 34 PID 3032 wrote to memory of 2872 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 37 PID 3032 wrote to memory of 2872 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 37 PID 3032 wrote to memory of 2872 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 37 PID 3032 wrote to memory of 2872 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 37 PID 3032 wrote to memory of 2872 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 37 PID 3032 wrote to memory of 2872 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 37 PID 3032 wrote to memory of 2872 3032 31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe 37 PID 1200 wrote to memory of 2648 1200 Explorer.EXE 38 PID 1200 wrote to memory of 2648 1200 Explorer.EXE 38 PID 1200 wrote to memory of 2648 1200 Explorer.EXE 38 PID 1200 wrote to memory of 2648 1200 Explorer.EXE 38 PID 2648 wrote to memory of 1700 2648 cscript.exe 39 PID 2648 wrote to memory of 1700 2648 cscript.exe 39 PID 2648 wrote to memory of 1700 2648 cscript.exe 39 PID 2648 wrote to memory of 1700 2648 cscript.exe 39
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe"C:\Users\Admin\AppData\Local\Temp\31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\31e7559f21054aca8a1cd2287e322f22e03ac6cbc84e1265c8ac1a3367403989.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GcrdXwPgmZ.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GcrdXwPgmZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDD54.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2848
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1700
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b5326fb528c7bafc3197eb0da58ce587
SHA156b706b6fe0ef265d5be5b74ad3193fb5aceb589
SHA25659ff7564caacc97deeaba3068dc765a9492954acc88097a9c7803f03b01f4eb6
SHA5123ca99ba7e182cf77d114e8708e91dd2f25579cc9fcf5fec9486415a8f24ba4fe88fa11dfb71c0a43c7a0ec8db0a59a9fefc60cb0fd58103e573e86785b22d07c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G37UCAWTOLJXNYIVEILF.temp
Filesize7KB
MD55c94f28c97ab1bdd94e3dcaad48b5436
SHA16a24bf934e53d0523425b221a79f5cb3bec74d37
SHA2560f17b86013fe1d787f77a5bd8f34eceb61e6e8a2743f959aab904468cf028bbb
SHA512fac59bd3d1e12c6b10fa0b6a046b89d636f7432327040ec7aed630133b77b203746031b4a8eb1033d98b0debcb5afbd60b0e5ceb3a5713f87606f9efd04f7882