Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/01/2025, 02:58

General

  • Target

    205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe

  • Size

    802KB

  • MD5

    9a7cb2884499e277aef3285bb7ac621a

  • SHA1

    61a63562d75ccb13478aee39dc80395329357d7a

  • SHA256

    205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075

  • SHA512

    15e6e63a8fd1764dca53a34fbd6fa9ac99849ca43d34327741f87c9f80a931cfdd71c7c993e6764e16c34f9a60ec5edabe745fd646339601eebbf783a7fd967b

  • SSDEEP

    12288:WzSggsiqyjHBCYiOKE5uz0nL4EJhyJvgOE4qYCvI7:Wz1KuT8L4QIJvJE9YCvI

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

a03d

Decoy

nfluencer-marketing-13524.bond

cebepu.info

lphatechblog.xyz

haoyun.website

itiz.xyz

orld-visa-center.online

si.art

alata.xyz

mmarketing.xyz

elnqdjc.shop

ensentoto.cloud

voyagu.info

onvert.today

1fuli9902.shop

otelhafnia.info

rumpchiefofstaff.store

urvivalflashlights.shop

0090.pizza

ings-hu-13.today

oliticalpatriot.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Users\Admin\AppData\Local\Temp\205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe
      "C:\Users\Admin\AppData\Local\Temp\205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1856
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1652
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QzRGBFLaJH.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2760
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QzRGBFLaJH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp20D9.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2636
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2720
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2556
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp20D9.tmp

    Filesize

    1KB

    MD5

    1ae1148e586d69c0d97f4101504cc020

    SHA1

    dcca0c0a2175125bb8ad21fe0fd322f35bfc5efe

    SHA256

    d32123f86246d9f6bbc3cee74de3b9763156830294d96602203799764d1cce89

    SHA512

    98918358a0d2c5f83604a79b1f758efd3a13eb16a1a2e617682273ffa73d8ec3e8be518941c635b9346b1bce2153687dfdefd2b13e199a578a1e26181111133c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    b47c9d74f49b8286286c65062e5f5245

    SHA1

    9fd2662a95f1f71196c6bc3b1e9b664dbbcfdc48

    SHA256

    6e3bb9e90ca3c88b4d48884724a0e6d1d4d146c3573e8b6e194c58252d1b6a7e

    SHA512

    ac0ab0db7431a9c72e0bc2e09f9f6dabff2dcd5cf4c7ead57b0780d403fe643d166efe72f0266668ee9053c6f84827592ff50146bf34ff543c5c5663510d9232

  • memory/1152-29-0x0000000000320000-0x0000000000420000-memory.dmp

    Filesize

    1024KB

  • memory/1856-4-0x000000007408E000-0x000000007408F000-memory.dmp

    Filesize

    4KB

  • memory/1856-25-0x0000000074080000-0x000000007476E000-memory.dmp

    Filesize

    6.9MB

  • memory/1856-5-0x0000000074080000-0x000000007476E000-memory.dmp

    Filesize

    6.9MB

  • memory/1856-6-0x0000000000300000-0x000000000037A000-memory.dmp

    Filesize

    488KB

  • memory/1856-3-0x0000000000A20000-0x0000000000A3E000-memory.dmp

    Filesize

    120KB

  • memory/1856-2-0x0000000074080000-0x000000007476E000-memory.dmp

    Filesize

    6.9MB

  • memory/1856-1-0x0000000000A40000-0x0000000000B0E000-memory.dmp

    Filesize

    824KB

  • memory/1856-0-0x000000007408E000-0x000000007408F000-memory.dmp

    Filesize

    4KB

  • memory/2556-27-0x00000000000D0000-0x00000000000DD000-memory.dmp

    Filesize

    52KB

  • memory/2556-28-0x00000000000E0000-0x000000000010F000-memory.dmp

    Filesize

    188KB

  • memory/2720-19-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2720-24-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2720-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2720-21-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB