Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2025, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER_QUOTATION.exe
Resource
win7-20240903-en
General
-
Target
PURCHASE ORDER_QUOTATION.exe
-
Size
1.0MB
-
MD5
2dd7e760d5fe60a8733f365653848f8e
-
SHA1
8c8b8b2b15c5062bf71a9e7f7ca5dbe157c546fd
-
SHA256
c46750639d660e92cfb0e41eb1fc67c554589196345e03fe8af00faa1926fbc5
-
SHA512
ba96737bb5fec71cd9d53d772680b5af063f4c03a464bc8556df67cffa2993de60a81f1f0c3fb07a2f294934702325947fec203f0be3e54b04102f5ab9099f35
-
SSDEEP
24576:/AHnh+eWsN3skA4RV1Hom2KXFmIaoqD+ezzkrY4LuE5:ih+ZkldoPK1XaoqDJv4V
Malware Config
Extracted
formbook
4.1
a38m
rtfosters.net
ental-implants-97548.bond
raphic-design-degree-15820.bond
ompraninjas.shop
indmyusedcar.today
rumptraumasupport.net
uozwear.xyz
etron.xyz
dultlivebroadcast09.today
ypegen.net
arehouse-inventory-54057.bond
27961.pizza
ortable-ai.xyz
pioxc.xyz
nline-advertising-76059.bond
rendyshack.store
pa-services88.life
aftarpragmatic218gacor.online
yb1054.shop
8x189.xyz
ckvinaaz.shop
rilx-go.pro
355.pink
ravelinsurance061.shop
rokencod.pro
2n0.pro
ustababy.xyz
lpubdomkal.live
fath.shop
useumguide.xyz
albiking.shop
liff-bikes.store
rangeexpat.net
tecservices.net
ntuk.shop
tecarhle.forum
ola888.net
9125.club
g-phone-plans-95047.bond
ivsmart.xyz
aycare-jobs-labs.today
alhall.xyz
reshoffthepress.club
ental-implants-fixer.world
ilitary-jobs-74416.bond
etrex.xyz
ci.info
lackfridaycourse.shop
partment-rent-in-dhaka.online
ota.fun
5285.vip
egawv.club
a0e1nyk.xyz
li.digital
ncome3.tokyo
iendaoasis.store
elaxation.now
aafereshteh-inter5.rest
essicastory.xyz
nterioridade.online
ppo.tech
ififlow.store
nline-advertising-60200.bond
ourfree.life
tartrek.museum
Signatures
-
Formbook family
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/2080-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2080-15-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2080-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2456-25-0x0000000000600000-0x000000000062F000-memory.dmp formbook -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3560 set thread context of 2080 3560 PURCHASE ORDER_QUOTATION.exe 82 PID 2080 set thread context of 3460 2080 svchost.exe 56 PID 2080 set thread context of 3460 2080 svchost.exe 56 PID 2456 set thread context of 3460 2456 control.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PURCHASE ORDER_QUOTATION.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language control.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe 2456 control.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3560 PURCHASE ORDER_QUOTATION.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2080 svchost.exe 2456 control.exe 2456 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2080 svchost.exe Token: SeDebugPrivilege 2456 control.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3560 PURCHASE ORDER_QUOTATION.exe 3560 PURCHASE ORDER_QUOTATION.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3560 PURCHASE ORDER_QUOTATION.exe 3560 PURCHASE ORDER_QUOTATION.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3560 wrote to memory of 2080 3560 PURCHASE ORDER_QUOTATION.exe 82 PID 3560 wrote to memory of 2080 3560 PURCHASE ORDER_QUOTATION.exe 82 PID 3560 wrote to memory of 2080 3560 PURCHASE ORDER_QUOTATION.exe 82 PID 3560 wrote to memory of 2080 3560 PURCHASE ORDER_QUOTATION.exe 82 PID 3460 wrote to memory of 2456 3460 Explorer.EXE 83 PID 3460 wrote to memory of 2456 3460 Explorer.EXE 83 PID 3460 wrote to memory of 2456 3460 Explorer.EXE 83 PID 2456 wrote to memory of 1780 2456 control.exe 84 PID 2456 wrote to memory of 1780 2456 control.exe 84 PID 2456 wrote to memory of 1780 2456 control.exe 84
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER_QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER_QUOTATION.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER_QUOTATION.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2080
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1780
-
-