Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/01/2025, 02:58
Static task
static1
Behavioral task
behavioral1
Sample
205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe
Resource
win7-20240903-en
General
-
Target
205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe
-
Size
802KB
-
MD5
9a7cb2884499e277aef3285bb7ac621a
-
SHA1
61a63562d75ccb13478aee39dc80395329357d7a
-
SHA256
205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075
-
SHA512
15e6e63a8fd1764dca53a34fbd6fa9ac99849ca43d34327741f87c9f80a931cfdd71c7c993e6764e16c34f9a60ec5edabe745fd646339601eebbf783a7fd967b
-
SSDEEP
12288:WzSggsiqyjHBCYiOKE5uz0nL4EJhyJvgOE4qYCvI7:Wz1KuT8L4QIJvJE9YCvI
Malware Config
Extracted
formbook
4.1
a03d
nfluencer-marketing-13524.bond
cebepu.info
lphatechblog.xyz
haoyun.website
itiz.xyz
orld-visa-center.online
si.art
alata.xyz
mmarketing.xyz
elnqdjc.shop
ensentoto.cloud
voyagu.info
onvert.today
1fuli9902.shop
otelhafnia.info
rumpchiefofstaff.store
urvivalflashlights.shop
0090.pizza
ings-hu-13.today
oliticalpatriot.net
5970.pizza
arimatch-in.legal
eepvid.xyz
bfootball.net
otorcycle-loans-19502.bond
nline-advertising-34790.bond
behm.info
aportsystems.store
agiararoma.net
agfov4u.xyz
9769.mobi
ome-renovation-86342.bond
kkkk.shop
duxrib.xyz
xurobo.info
leurdivin.online
ive-neurozoom.store
ndogaming.online
dj1.lat
yselection.xyz
52628.xyz
lsaadmart.store
oftware-download-92806.bond
avid-hildebrand.info
orashrine.store
erpangina-treatment-views.sbs
ategorie-polecane-831.buzz
oonlightshadow.shop
istromarmitaria.online
gmgslzdc.sbs
asglobalaz.shop
locarry.store
eleefmestreech.online
inggraphic.pro
atidiri.fun
olourclubbet.shop
eatbox.store
romatografia.online
encortex.beauty
8oosnny.xyz
72266.vip
aja168e.live
fath.shop
argloscaremedia.info
enelog.xyz
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
resource yara_rule behavioral1/memory/2720-24-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2556-28-0x00000000000E0000-0x000000000010F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1652 powershell.exe 2760 powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1856 set thread context of 2720 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 37 PID 2720 set thread context of 1152 2720 RegSvcs.exe 20 PID 2556 set thread context of 1152 2556 cmmon32.exe 20 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmmon32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2636 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 1652 powershell.exe 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 2760 powershell.exe 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 2720 RegSvcs.exe 2720 RegSvcs.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe 2556 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2720 RegSvcs.exe 2720 RegSvcs.exe 2720 RegSvcs.exe 2556 cmmon32.exe 2556 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe Token: SeDebugPrivilege 1652 powershell.exe Token: SeDebugPrivilege 2760 powershell.exe Token: SeDebugPrivilege 2720 RegSvcs.exe Token: SeDebugPrivilege 2556 cmmon32.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1856 wrote to memory of 1652 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 31 PID 1856 wrote to memory of 1652 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 31 PID 1856 wrote to memory of 1652 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 31 PID 1856 wrote to memory of 1652 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 31 PID 1856 wrote to memory of 2760 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 33 PID 1856 wrote to memory of 2760 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 33 PID 1856 wrote to memory of 2760 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 33 PID 1856 wrote to memory of 2760 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 33 PID 1856 wrote to memory of 2636 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 35 PID 1856 wrote to memory of 2636 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 35 PID 1856 wrote to memory of 2636 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 35 PID 1856 wrote to memory of 2636 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 35 PID 1856 wrote to memory of 2720 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 37 PID 1856 wrote to memory of 2720 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 37 PID 1856 wrote to memory of 2720 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 37 PID 1856 wrote to memory of 2720 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 37 PID 1856 wrote to memory of 2720 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 37 PID 1856 wrote to memory of 2720 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 37 PID 1856 wrote to memory of 2720 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 37 PID 1856 wrote to memory of 2720 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 37 PID 1856 wrote to memory of 2720 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 37 PID 1856 wrote to memory of 2720 1856 205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe 37 PID 1152 wrote to memory of 2556 1152 Explorer.EXE 38 PID 1152 wrote to memory of 2556 1152 Explorer.EXE 38 PID 1152 wrote to memory of 2556 1152 Explorer.EXE 38 PID 1152 wrote to memory of 2556 1152 Explorer.EXE 38 PID 2556 wrote to memory of 2876 2556 cmmon32.exe 39 PID 2556 wrote to memory of 2876 2556 cmmon32.exe 39 PID 2556 wrote to memory of 2876 2556 cmmon32.exe 39 PID 2556 wrote to memory of 2876 2556 cmmon32.exe 39
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe"C:\Users\Admin\AppData\Local\Temp\205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QzRGBFLaJH.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QzRGBFLaJH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp20D9.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51ae1148e586d69c0d97f4101504cc020
SHA1dcca0c0a2175125bb8ad21fe0fd322f35bfc5efe
SHA256d32123f86246d9f6bbc3cee74de3b9763156830294d96602203799764d1cce89
SHA51298918358a0d2c5f83604a79b1f758efd3a13eb16a1a2e617682273ffa73d8ec3e8be518941c635b9346b1bce2153687dfdefd2b13e199a578a1e26181111133c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5b47c9d74f49b8286286c65062e5f5245
SHA19fd2662a95f1f71196c6bc3b1e9b664dbbcfdc48
SHA2566e3bb9e90ca3c88b4d48884724a0e6d1d4d146c3573e8b6e194c58252d1b6a7e
SHA512ac0ab0db7431a9c72e0bc2e09f9f6dabff2dcd5cf4c7ead57b0780d403fe643d166efe72f0266668ee9053c6f84827592ff50146bf34ff543c5c5663510d9232