Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/01/2025, 09:04
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCS.exe
Resource
win7-20240903-en
General
-
Target
SHIPPING DOCS.exe
-
Size
722KB
-
MD5
8a53a0551259a54c9503f4cf29a67821
-
SHA1
edcb94850e63d424604029edf6c720b9d1d6e8df
-
SHA256
8bd60c5add862eb634b15fad4020a9afcf8ed6f523485665c80044f90bc8b305
-
SHA512
3518a786a8947051a55914d12b564c5fdaebe3167b4b34b72ae7dc855cba781fe72743e505367c1e0e566d0dc26822b020bec9b8fa4d4426749da9b059d2ff1f
-
SSDEEP
12288:/b1PloJNhQ/cWS7stv2EJ7yYqMSKlaU7/IYV51GMER0eTRpqbMLWuRsQsAAHO/:ZiJN+UVsDhyYWKlh0So0IpqwLWueQspu
Malware Config
Extracted
formbook
4.1
a03d
nfluencer-marketing-13524.bond
cebepu.info
lphatechblog.xyz
haoyun.website
itiz.xyz
orld-visa-center.online
si.art
alata.xyz
mmarketing.xyz
elnqdjc.shop
ensentoto.cloud
voyagu.info
onvert.today
1fuli9902.shop
otelhafnia.info
rumpchiefofstaff.store
urvivalflashlights.shop
0090.pizza
ings-hu-13.today
oliticalpatriot.net
5970.pizza
arimatch-in.legal
eepvid.xyz
bfootball.net
otorcycle-loans-19502.bond
nline-advertising-34790.bond
behm.info
aportsystems.store
agiararoma.net
agfov4u.xyz
9769.mobi
ome-renovation-86342.bond
kkkk.shop
duxrib.xyz
xurobo.info
leurdivin.online
ive-neurozoom.store
ndogaming.online
dj1.lat
yselection.xyz
52628.xyz
lsaadmart.store
oftware-download-92806.bond
avid-hildebrand.info
orashrine.store
erpangina-treatment-views.sbs
ategorie-polecane-831.buzz
oonlightshadow.shop
istromarmitaria.online
gmgslzdc.sbs
asglobalaz.shop
locarry.store
eleefmestreech.online
inggraphic.pro
atidiri.fun
olourclubbet.shop
eatbox.store
romatografia.online
encortex.beauty
8oosnny.xyz
72266.vip
aja168e.live
fath.shop
argloscaremedia.info
enelog.xyz
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/2500-26-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2856-86-0x0000000000C00000-0x0000000000C2F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1612 powershell.exe 2744 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation SHIPPING DOCS.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2828 set thread context of 2500 2828 SHIPPING DOCS.exe 88 PID 2500 set thread context of 3424 2500 RegSvcs.exe 56 PID 2856 set thread context of 3424 2856 rundll32.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SHIPPING DOCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2828 SHIPPING DOCS.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1004 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2828 SHIPPING DOCS.exe 1612 powershell.exe 2744 powershell.exe 2828 SHIPPING DOCS.exe 2500 RegSvcs.exe 2500 RegSvcs.exe 2500 RegSvcs.exe 2500 RegSvcs.exe 2744 powershell.exe 1612 powershell.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe 2856 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2500 RegSvcs.exe 2500 RegSvcs.exe 2500 RegSvcs.exe 2856 rundll32.exe 2856 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 2828 SHIPPING DOCS.exe Token: SeDebugPrivilege 1612 powershell.exe Token: SeDebugPrivilege 2744 powershell.exe Token: SeDebugPrivilege 2500 RegSvcs.exe Token: SeDebugPrivilege 2856 rundll32.exe Token: SeShutdownPrivilege 3424 Explorer.EXE Token: SeCreatePagefilePrivilege 3424 Explorer.EXE Token: SeShutdownPrivilege 3424 Explorer.EXE Token: SeCreatePagefilePrivilege 3424 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2828 wrote to memory of 1612 2828 SHIPPING DOCS.exe 82 PID 2828 wrote to memory of 1612 2828 SHIPPING DOCS.exe 82 PID 2828 wrote to memory of 1612 2828 SHIPPING DOCS.exe 82 PID 2828 wrote to memory of 2744 2828 SHIPPING DOCS.exe 84 PID 2828 wrote to memory of 2744 2828 SHIPPING DOCS.exe 84 PID 2828 wrote to memory of 2744 2828 SHIPPING DOCS.exe 84 PID 2828 wrote to memory of 1004 2828 SHIPPING DOCS.exe 86 PID 2828 wrote to memory of 1004 2828 SHIPPING DOCS.exe 86 PID 2828 wrote to memory of 1004 2828 SHIPPING DOCS.exe 86 PID 2828 wrote to memory of 2500 2828 SHIPPING DOCS.exe 88 PID 2828 wrote to memory of 2500 2828 SHIPPING DOCS.exe 88 PID 2828 wrote to memory of 2500 2828 SHIPPING DOCS.exe 88 PID 2828 wrote to memory of 2500 2828 SHIPPING DOCS.exe 88 PID 2828 wrote to memory of 2500 2828 SHIPPING DOCS.exe 88 PID 2828 wrote to memory of 2500 2828 SHIPPING DOCS.exe 88 PID 3424 wrote to memory of 2856 3424 Explorer.EXE 90 PID 3424 wrote to memory of 2856 3424 Explorer.EXE 90 PID 3424 wrote to memory of 2856 3424 Explorer.EXE 90 PID 2856 wrote to memory of 2428 2856 rundll32.exe 91 PID 2856 wrote to memory of 2428 2856 rundll32.exe 91 PID 2856 wrote to memory of 2428 2856 rundll32.exe 91
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCS.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCS.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCS.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HcXqyZTglEDQeU.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HcXqyZTglEDQeU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBF1A.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1004
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵PID:4256
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2428
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5a177fbc2d6217247cc4af4c242110e65
SHA13e908da3c4e9caac48d03810864e469fc5115cdb
SHA256be82fa4808433577a590b0df573ea68ab568e46e9ac790b72c85db2981dddb62
SHA512c117c82ae5b406e3be8d05bf33ea12aacb3dd54acb8c6f084bd5fbc8d82876f98dd7cd721d52ac74dd7d5316cdba1f26d6c9031e24916736822b51518c08ff57