Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2025, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe
Resource
win7-20240903-en
General
-
Target
19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe
-
Size
675KB
-
MD5
d3a2936e355fc5b62c309d80aa65e9b4
-
SHA1
d7bafe72a3a8a9e06901155cdbf020d98f2535d7
-
SHA256
19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368
-
SHA512
01946f702c5af9696444a4c5d1db50390a53b2c0d849acb15c6079db32c3d7834492b357554d0daaab233c7e5024e452ecf6262bd23015558c0fc55abd81f116
-
SSDEEP
12288:BXcTTpuOZhzNA50jBIiIe/S+wi+2n7nw17jIBd5a:BcEsdmGI7eK+5+2nmjI4
Malware Config
Extracted
formbook
4.1
a01d
eniorshousing05.shop
rywisevas.biz
4726.pizza
itchen-design-42093.bond
3456.tech
4825.plus
nlinecraps.xyz
itamins-52836.bond
nfluencer-marketing-40442.bond
nline-advertising-58573.bond
rautogroups.net
limbtrip.net
oftware-download-14501.bond
nline-advertising-66733.bond
erity.xyz
xknrksi.icu
x-ist.club
yber-security-26409.bond
oincatch.xyz
onitoring-devices-34077.bond
hbvc.xyz
xecadminadvo.vip
ookers.homes
irlypods.shop
nalyzator.fun
rinciple.press
ejigghq.company
nity-officiels.shop
chtm.info
ggrupdanismanlik.online
alterjaviersemolic.online
6zc.lat
ukce.fun
ikretgunay.online
d8ns7gu.skin
06ks7.club
icovideo.voyage
nlinetutoringcanada776681.icu
etzero.icu
228080a0.buzz
agoslotoke.art
ruaim.online
nline-mba-87219.bond
oldsaver.biz
agonel.online
ommbank.video
indlab.shop
hesweettray.store
bilebe.info
uxemasculine.store
arkbarron.xyz
ektor.fun
8255.pizza
ike-loans-53803.bond
ong-ya.info
costcomembers-wholesale.online
75396.vip
leaning-services-53131.bond
uickcabinet.net
alifstorch.online
ahtel.net
usinessoverpleasure.shop
duway.pro
usiness-software-47704.bond
ustonehuman.info
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral2/memory/4000-46-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4000-91-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2600-94-0x0000000000A00000-0x0000000000A2F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4316 powershell.exe 1520 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\Control Panel\International\Geo\Nation 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 5060 set thread context of 4000 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 92 PID 4000 set thread context of 3500 4000 RegSvcs.exe 56 PID 4000 set thread context of 3500 4000 RegSvcs.exe 56 PID 2600 set thread context of 3500 2600 rundll32.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3232 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 4316 powershell.exe 1520 powershell.exe 1520 powershell.exe 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 4000 RegSvcs.exe 4000 RegSvcs.exe 4000 RegSvcs.exe 4000 RegSvcs.exe 4316 powershell.exe 4000 RegSvcs.exe 4000 RegSvcs.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4000 RegSvcs.exe 4000 RegSvcs.exe 4000 RegSvcs.exe 4000 RegSvcs.exe 2600 rundll32.exe 2600 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe Token: SeDebugPrivilege 4316 powershell.exe Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 4000 RegSvcs.exe Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeShutdownPrivilege 3500 Explorer.EXE Token: SeCreatePagefilePrivilege 3500 Explorer.EXE Token: SeDebugPrivilege 2600 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3500 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5060 wrote to memory of 1520 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 86 PID 5060 wrote to memory of 1520 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 86 PID 5060 wrote to memory of 1520 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 86 PID 5060 wrote to memory of 4316 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 88 PID 5060 wrote to memory of 4316 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 88 PID 5060 wrote to memory of 4316 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 88 PID 5060 wrote to memory of 3232 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 90 PID 5060 wrote to memory of 3232 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 90 PID 5060 wrote to memory of 3232 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 90 PID 5060 wrote to memory of 4000 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 92 PID 5060 wrote to memory of 4000 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 92 PID 5060 wrote to memory of 4000 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 92 PID 5060 wrote to memory of 4000 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 92 PID 5060 wrote to memory of 4000 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 92 PID 5060 wrote to memory of 4000 5060 19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe 92 PID 3500 wrote to memory of 2600 3500 Explorer.EXE 93 PID 3500 wrote to memory of 2600 3500 Explorer.EXE 93 PID 3500 wrote to memory of 2600 3500 Explorer.EXE 93 PID 2600 wrote to memory of 1356 2600 rundll32.exe 94 PID 2600 wrote to memory of 1356 2600 rundll32.exe 94 PID 2600 wrote to memory of 1356 2600 rundll32.exe 94
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe"C:\Users\Admin\AppData\Local\Temp\19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rBchflGYc.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBchflGYc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFC52.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3232
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1356
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD539eccf0f1158d2da6710803ad9d5edc0
SHA154df4c021f4f307f8db0b681b64caaa1fd5a93c7
SHA2566dd0b82cc1097028c96166bc186b9792baa3476e0de2af43bf8ea92c6cb9e910
SHA5123fa3ccbc741022671db8b61faa7943863fdd081aa88492a78c7fe68ee78bd38314939f9bb275fb29bf0bb1e4535e77572c1217a2d348fe448d0a88020e79965a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD51922615cf9715386e9b93feb2059f4da
SHA17305ef7424e5f94ad735afd19d05206715831518
SHA25634f9b012384510cea8e046fcf21f425519e6f1124ad31b914cc2882a872e4b3b
SHA512725419e8aeacfb7f2689e9f616933caa4a4b724138c814dacc7d4bbd4bcaefa8df70dafb1b5eeadb86c211baa26690a0197f48530127934aa1766673684c9805