Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2025, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe
Resource
win7-20240903-en
General
-
Target
28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe
-
Size
1.6MB
-
MD5
df85a6fea907176063e6dc8ad2888bfb
-
SHA1
450837ad62e143afee717c52264e21d253bd2a74
-
SHA256
28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8
-
SHA512
c25297581c5e420ac0f092b481c8a54454addc461b97171a69c81a0dfbeec632323e9f8b7d73ee4097078c3bef3ce766f9dcb2df6c898e44b64b064850300c58
-
SSDEEP
24576:3tb20pkaCqT5TBWgNQ7aeqyfpzUZS5jx7NXL14W1v+GsIZ6A:0Vg5tQ7aahzUZS571xvD5
Malware Config
Extracted
formbook
4.1
hwu6
lf758.vip
locerin-hair.shop
vytech.net
pet-insurance-intl-7990489.live
thepolithat.buzz
d66dr114gl.bond
suv-deals-49508.bond
job-offer-53922.bond
drstone1.click
lebahsemesta57.click
olmanihousel.shop
piedmontcsb.info
trisula888x.top
66sodovna.net
dental-implants-83810.bond
imxtld.club
frozenpines.net
ffgzgbl.xyz
tlc7z.rest
alexismuller.design
6vay.boats
moocatinght.top
hafwje.bond
edmaker.online
simo1simo001.click
vbsdconsultant.click
ux-design-courses-53497.bond
victory88-pay.xyz
suarahati7.xyz
otzen.info
hair-transplantation-65829.bond
gequiltdesins.shop
inefity.cloud
jeeinsight.online
86339.xyz
stairr-lift-find.today
wdgb20.top
91uvq.pro
energyecosystem.app
8e5lr5i9zu.buzz
migraine-treatment-36101.bond
eternityzon.shop
43mjqdyetv.sbs
healthcare-software-74448.bond
bethlark.top
dangdut4dselalu.pro
04506.club
rider.vision
health-insurance-cake.world
apoppynote.com
11817e.com
hiefmotelkeokuk.top
sugatoken.xyz
aragamand.business
alifewithoutlimits.info
vibrantsoul.xyz
olarpanels-outlet.info
ozzd86fih4.online
skbdicat.xyz
cloggedpipes.net
ilsgroup.net
ptcnl.info
backstretch.store
maheshg.xyz
7b5846.online
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/3048-3-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3048-6-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3644-11-0x0000000000CA0000-0x0000000000CCF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3088 set thread context of 3048 3088 28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe 82 PID 3048 set thread context of 3416 3048 svchost.exe 56 PID 3644 set thread context of 3416 3644 NETSTAT.EXE 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3644 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3048 svchost.exe 3048 svchost.exe 3048 svchost.exe 3048 svchost.exe 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE 3644 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3088 28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe 3048 svchost.exe 3048 svchost.exe 3048 svchost.exe 3644 NETSTAT.EXE 3644 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3048 svchost.exe Token: SeDebugPrivilege 3644 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3088 28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe 3088 28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3088 28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe 3088 28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3088 wrote to memory of 3048 3088 28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe 82 PID 3088 wrote to memory of 3048 3088 28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe 82 PID 3088 wrote to memory of 3048 3088 28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe 82 PID 3088 wrote to memory of 3048 3088 28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe 82 PID 3416 wrote to memory of 3644 3416 Explorer.EXE 83 PID 3416 wrote to memory of 3644 3416 Explorer.EXE 83 PID 3416 wrote to memory of 3644 3416 Explorer.EXE 83 PID 3644 wrote to memory of 4148 3644 NETSTAT.EXE 86 PID 3644 wrote to memory of 4148 3644 NETSTAT.EXE 86 PID 3644 wrote to memory of 4148 3644 NETSTAT.EXE 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe"C:\Users\Admin\AppData\Local\Temp\28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\28818006253d45c3dd643095a63892bf730611b9347b8f3b930be3efffa908d8.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4148
-
-