Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
RFQ PC25-1301 Product Specifications_PDF.7z
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RFQ PC25-1301 Product Specifications_PDF.7z
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
RFQ PC25-1301 Product Specifications_PDF.exe
Resource
win7-20240903-en
General
-
Target
RFQ PC25-1301 Product Specifications_PDF.exe
-
Size
1.7MB
-
MD5
da15d5729ee365d537292b7b3bcebfbc
-
SHA1
5ab6062a1f2baf4b9785b08975ccdf4c52ee730d
-
SHA256
c7a1dff9b1cc12833d92df185e2e52fb3d5da32078bb8cf4ea65ae9fb53a00c3
-
SHA512
d3c0bfba6150e878dab25a29c4d88569b82757e6bb85e06c98d436e1ba1a6f76ba4c4aa2837aed03c66414af22d36963a29173a5b852c5082d6183df151c154f
-
SSDEEP
24576:ctb20pkaCqT5TBWgNQ7aPVOpJ2rLAjghtte6RLgbc7HfG6A:FVg5tQ7atOpDkhHe6gbQ+5
Malware Config
Extracted
formbook
4.1
hwu6
lf758.vip
locerin-hair.shop
vytech.net
pet-insurance-intl-7990489.live
thepolithat.buzz
d66dr114gl.bond
suv-deals-49508.bond
job-offer-53922.bond
drstone1.click
lebahsemesta57.click
olmanihousel.shop
piedmontcsb.info
trisula888x.top
66sodovna.net
dental-implants-83810.bond
imxtld.club
frozenpines.net
ffgzgbl.xyz
tlc7z.rest
alexismuller.design
6vay.boats
moocatinght.top
hafwje.bond
edmaker.online
simo1simo001.click
vbsdconsultant.click
ux-design-courses-53497.bond
victory88-pay.xyz
suarahati7.xyz
otzen.info
hair-transplantation-65829.bond
gequiltdesins.shop
inefity.cloud
jeeinsight.online
86339.xyz
stairr-lift-find.today
wdgb20.top
91uvq.pro
energyecosystem.app
8e5lr5i9zu.buzz
migraine-treatment-36101.bond
eternityzon.shop
43mjqdyetv.sbs
healthcare-software-74448.bond
bethlark.top
dangdut4dselalu.pro
04506.club
rider.vision
health-insurance-cake.world
apoppynote.com
11817e.com
hiefmotelkeokuk.top
sugatoken.xyz
aragamand.business
alifewithoutlimits.info
vibrantsoul.xyz
olarpanels-outlet.info
ozzd86fih4.online
skbdicat.xyz
cloggedpipes.net
ilsgroup.net
ptcnl.info
backstretch.store
maheshg.xyz
7b5846.online
Signatures
-
Formbook family
-
Formbook payload 4 IoCs
resource yara_rule behavioral4/memory/1376-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral4/memory/1376-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral4/memory/1376-10-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral4/memory/992-15-0x0000000000150000-0x000000000017F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4856 set thread context of 1376 4856 RFQ PC25-1301 Product Specifications_PDF.exe 82 PID 1376 set thread context of 3428 1376 svchost.exe 56 PID 1376 set thread context of 3428 1376 svchost.exe 56 PID 992 set thread context of 3428 992 wscript.exe 56 -
Program crash 1 IoCs
pid pid_target Process procid_target 1004 4856 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ PC25-1301 Product Specifications_PDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1376 svchost.exe 1376 svchost.exe 1376 svchost.exe 1376 svchost.exe 1376 svchost.exe 1376 svchost.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe 992 wscript.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4856 RFQ PC25-1301 Product Specifications_PDF.exe 1376 svchost.exe 1376 svchost.exe 1376 svchost.exe 1376 svchost.exe 992 wscript.exe 992 wscript.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1376 svchost.exe Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeShutdownPrivilege 3428 Explorer.EXE Token: SeCreatePagefilePrivilege 3428 Explorer.EXE Token: SeDebugPrivilege 992 wscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4856 RFQ PC25-1301 Product Specifications_PDF.exe 4856 RFQ PC25-1301 Product Specifications_PDF.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4856 RFQ PC25-1301 Product Specifications_PDF.exe 4856 RFQ PC25-1301 Product Specifications_PDF.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4856 wrote to memory of 1376 4856 RFQ PC25-1301 Product Specifications_PDF.exe 82 PID 4856 wrote to memory of 1376 4856 RFQ PC25-1301 Product Specifications_PDF.exe 82 PID 4856 wrote to memory of 1376 4856 RFQ PC25-1301 Product Specifications_PDF.exe 82 PID 4856 wrote to memory of 1376 4856 RFQ PC25-1301 Product Specifications_PDF.exe 82 PID 3428 wrote to memory of 992 3428 Explorer.EXE 86 PID 3428 wrote to memory of 992 3428 Explorer.EXE 86 PID 3428 wrote to memory of 992 3428 Explorer.EXE 86 PID 992 wrote to memory of 4916 992 wscript.exe 87 PID 992 wrote to memory of 4916 992 wscript.exe 87 PID 992 wrote to memory of 4916 992 wscript.exe 87
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\RFQ PC25-1301 Product Specifications_PDF.exe"C:\Users\Admin\AppData\Local\Temp\RFQ PC25-1301 Product Specifications_PDF.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\RFQ PC25-1301 Product Specifications_PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 7203⤵
- Program crash
PID:1004
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4916
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4856 -ip 48561⤵PID:1716