Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
5.exe
Resource
win7-20241023-en
General
-
Target
5.exe
-
Size
648KB
-
MD5
744cbe71736e73db7e940443ba884c23
-
SHA1
e8375f6a7cd38e5675804d3a31f8673be2072e02
-
SHA256
db2bba5bfe8b914d1177c437c38d230ab0291f47c2142a6d2174f5a1cabd3641
-
SHA512
c46965b0697734dc4fdf02a74ee77f4bdc7b6d7a326e37ad233dff25d942e5786616b79ed2f42ce2c4497654f4bb122040c8410853db3760f256268c7f8f35f6
-
SSDEEP
12288:m5Wa+Fb6TnaG4UDlSAnbWg5SIFlunEq8WPuWVj65OLgCck09e+:BFknDRnbroO35xb
Malware Config
Extracted
formbook
4.1
bc01
epatitis-treatment-26155.bond
52cy67sk.bond
nline-degree-6987776.world
ingxingdiandeng-2033.top
mberbreeze.cyou
48xc300mw.autos
obs-for-seniors-39582.bond
tpetersburg-3-tonn.online
egafon-parser.online
172jh.shop
ltraman.pro
bqfhnys.shop
ntercash24-cad.homes
uhtwister.cloud
alk-in-tubs-27353.bond
ucas-saaad.buzz
oko.events
8080713.xyz
refabricated-homes-74404.bond
inaa.boo
nnevateknoloji.xyz
ar-accident-lawyer-389.today
ianju-fvqh092.vip
ealthandwellnessly.digital
qzxx.top
q8189.top
ecurity-service-22477.bond
ractors-42621.bond
astamadre.shop
tonomushotel.xyz
cowatt.fun
olocaustaffirmer.net
delphi.ltd
mmwinni.buzz
8009.top
nline-gaming-ox-fr.xyz
irtyeffingrancher.info
omotech-dz.net
akemoneyonline.bond
ustbookin.online
eals.lat
irmag.online
eddogbrands.website
oifulcares.net
aming-chair-83359.bond
ewferg.top
areless.net
torygame168.online
y-language-menu.net
iring-cleaners-2507.xyz
inancialenlightment.info
ar-accident-lawyer-389.today
sicologosportugueses.online
ajabandot.website
oidakings.net
2ar1.shop
comedia.lol
kjbrosmm.shop
ffpage.shop
nfluencer-marketing-17923.bond
ebshieldsrenew.live
lkjuy.xyz
lussalesapp.website
hildrens-clothing.today
avada-casino-tlj.buzz
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2760-13-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2760-17-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2692-24-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2836 powershell.exe -
Deletes itself 1 IoCs
pid Process 2340 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 308 set thread context of 2760 308 5.exe 32 PID 2760 set thread context of 1196 2760 5.exe 21 PID 2692 set thread context of 1196 2692 wlanext.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wlanext.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2760 5.exe 2760 5.exe 2836 powershell.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe 2692 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2760 5.exe 2760 5.exe 2760 5.exe 2692 wlanext.exe 2692 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2760 5.exe Token: SeDebugPrivilege 2836 powershell.exe Token: SeDebugPrivilege 2692 wlanext.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 308 wrote to memory of 2836 308 5.exe 30 PID 308 wrote to memory of 2836 308 5.exe 30 PID 308 wrote to memory of 2836 308 5.exe 30 PID 308 wrote to memory of 2836 308 5.exe 30 PID 308 wrote to memory of 2760 308 5.exe 32 PID 308 wrote to memory of 2760 308 5.exe 32 PID 308 wrote to memory of 2760 308 5.exe 32 PID 308 wrote to memory of 2760 308 5.exe 32 PID 308 wrote to memory of 2760 308 5.exe 32 PID 308 wrote to memory of 2760 308 5.exe 32 PID 308 wrote to memory of 2760 308 5.exe 32 PID 1196 wrote to memory of 2692 1196 Explorer.EXE 33 PID 1196 wrote to memory of 2692 1196 Explorer.EXE 33 PID 1196 wrote to memory of 2692 1196 Explorer.EXE 33 PID 1196 wrote to memory of 2692 1196 Explorer.EXE 33 PID 2692 wrote to memory of 2340 2692 wlanext.exe 34 PID 2692 wrote to memory of 2340 2692 wlanext.exe 34 PID 2692 wrote to memory of 2340 2692 wlanext.exe 34 PID 2692 wrote to memory of 2340 2692 wlanext.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\5.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2340
-
-