Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/01/2025, 02:40

General

  • Target

    4af879a5ba55d1f85555bef2423b273f87df5db31d540934572ab4439e062545.exe

  • Size

    1.4MB

  • MD5

    47b4b12ff498d2620dd824b86ba20e98

  • SHA1

    c563ff933dd402ed4734c5f2030bf0bc8afd46c6

  • SHA256

    4af879a5ba55d1f85555bef2423b273f87df5db31d540934572ab4439e062545

  • SHA512

    e19bf614de75c3b858726422817344a1ebc920b6daa9a8daec9fbef43e47a1ea218999473ab0ff53beead5a093e29a277d04a8cf2f811d38ad9b966d77212dce

  • SSDEEP

    24576:eqDEvCTbMWu7rQYlBQcBiT6rprG8a74mPIiJZ+6/x7me8bQVe:eTvC/MTQYxsWR7a72mM6J7mp8

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

hwu6

Decoy

lf758.vip

locerin-hair.shop

vytech.net

pet-insurance-intl-7990489.live

thepolithat.buzz

d66dr114gl.bond

suv-deals-49508.bond

job-offer-53922.bond

drstone1.click

lebahsemesta57.click

olmanihousel.shop

piedmontcsb.info

trisula888x.top

66sodovna.net

dental-implants-83810.bond

imxtld.club

frozenpines.net

ffgzgbl.xyz

tlc7z.rest

alexismuller.design

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Users\Admin\AppData\Local\Temp\4af879a5ba55d1f85555bef2423b273f87df5db31d540934572ab4439e062545.exe
      "C:\Users\Admin\AppData\Local\Temp\4af879a5ba55d1f85555bef2423b273f87df5db31d540934572ab4439e062545.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\4af879a5ba55d1f85555bef2423b273f87df5db31d540934572ab4439e062545.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2496
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2140
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\svchost.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1144-13-0x0000000005210000-0x00000000053B1000-memory.dmp

    Filesize

    1.6MB

  • memory/1144-28-0x0000000004E60000-0x0000000004F15000-memory.dmp

    Filesize

    724KB

  • memory/1144-27-0x0000000004E60000-0x0000000004F15000-memory.dmp

    Filesize

    724KB

  • memory/1144-6-0x0000000003250000-0x0000000003350000-memory.dmp

    Filesize

    1024KB

  • memory/1144-9-0x0000000005000000-0x0000000005157000-memory.dmp

    Filesize

    1.3MB

  • memory/1144-25-0x0000000004E60000-0x0000000004F15000-memory.dmp

    Filesize

    724KB

  • memory/1144-20-0x0000000005210000-0x00000000053B1000-memory.dmp

    Filesize

    1.6MB

  • memory/1144-14-0x0000000005000000-0x0000000005157000-memory.dmp

    Filesize

    1.3MB

  • memory/2140-18-0x0000000000050000-0x000000000005E000-memory.dmp

    Filesize

    56KB

  • memory/2140-15-0x0000000000050000-0x000000000005E000-memory.dmp

    Filesize

    56KB

  • memory/2140-16-0x0000000000050000-0x000000000005E000-memory.dmp

    Filesize

    56KB

  • memory/2140-19-0x0000000000100000-0x000000000012F000-memory.dmp

    Filesize

    188KB

  • memory/2496-11-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2496-12-0x00000000002A0000-0x00000000002B4000-memory.dmp

    Filesize

    80KB

  • memory/2496-7-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2496-8-0x0000000000160000-0x0000000000174000-memory.dmp

    Filesize

    80KB

  • memory/2496-4-0x0000000000740000-0x0000000000A43000-memory.dmp

    Filesize

    3.0MB

  • memory/2496-3-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2988-2-0x0000000000B00000-0x0000000000F00000-memory.dmp

    Filesize

    4.0MB