Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2025, 04:36
Static task
static1
Behavioral task
behavioral1
Sample
MtpEVOhIlX08ZbN.exe
Resource
win7-20240729-en
General
-
Target
MtpEVOhIlX08ZbN.exe
-
Size
835KB
-
MD5
ff5640b9478170f504c7a344f2cfd2f0
-
SHA1
3ada7fc9fd12140209115cda646b3ecb1a8c8ec4
-
SHA256
10b78bea9f7acc71be5868fb39e4941c06ec08c4b0ea25b0957ec6b63fe37e20
-
SHA512
db9e03be02bb52112cef4622bfe2d134b87f9e66227501d50326138aab17fcaf7aef91950e4131b3fdaa7d1b960fafc5284a181ef53351ae7d377502ffc7f6b8
-
SSDEEP
12288:fEUM8HCoR6k/LbPWJxKXuNMe7IiSR61+7iRTKJq5:MUMRCNLbOSX67IiU61+7In
Malware Config
Extracted
formbook
4.1
b02a
nnovate.host
yrvo.shop
obify.party
55665.one
vlisazouasiul.store
arjohbs.shop
mjsccc5716.shop
nfluencer-marketing-86606.bond
atellite-internet-74549.bond
arehouse-inventory-82506.bond
kanzaturf.net
airbypatrickmcguire.net
90880a15.buzz
ancake888.info
hopcroma.store
usinessloanscanada524285.icu
mdjr.world
9kct.xyz
ombrd.finance
luratu.xyz
commerce-97292.bond
ovies4u-hd.online
zmi.info
ealth-insurance-63745.bond
rypto-god.online
ustdesk.email
talezoom.asia
haf.international
heaterscm.net
rejo.info
nitedstatesofart.net
ental-implants-29843.bond
uzzleworld.xyz
fg0m9c0lk.cyou
emospin30.info
ocejo.africa
aqiwang.net
vgtdvchvmdsvmdhbvgv.pro
ymtech.digital
ok-vi.sbs
u5kt.net
heoneglobal.store
78158.legal
argloscaremedia.info
ailylife.pro
nfotj.live
obistores.online
irofprague.net
mpteamtoto88.today
rmap.xyz
zliving.xyz
ubesafari.video
aylee.blue
ery.rocks
udioevideo.store
oneymachine.show
885522a0.shop
oodchoices.xyz
ilano.shop
vikadi.info
ecoramay.store
kit.run
ookinguptolightup.net
ndata.net
ubbs.xyz
Signatures
-
Formbook family
-
Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/1748-36-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4968-92-0x0000000001240000-0x000000000126F000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3256 powershell.exe 3744 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation MtpEVOhIlX08ZbN.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 5068 set thread context of 1748 5068 MtpEVOhIlX08ZbN.exe 93 PID 1748 set thread context of 3484 1748 RegSvcs.exe 56 PID 4968 set thread context of 3484 4968 cmstp.exe 56 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmstp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MtpEVOhIlX08ZbN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2348 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 5068 MtpEVOhIlX08ZbN.exe 3744 powershell.exe 3256 powershell.exe 5068 MtpEVOhIlX08ZbN.exe 1748 RegSvcs.exe 1748 RegSvcs.exe 3744 powershell.exe 3256 powershell.exe 1748 RegSvcs.exe 1748 RegSvcs.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe 4968 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1748 RegSvcs.exe 1748 RegSvcs.exe 1748 RegSvcs.exe 4968 cmstp.exe 4968 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 5068 MtpEVOhIlX08ZbN.exe Token: SeDebugPrivilege 3744 powershell.exe Token: SeDebugPrivilege 3256 powershell.exe Token: SeDebugPrivilege 1748 RegSvcs.exe Token: SeShutdownPrivilege 3484 Explorer.EXE Token: SeCreatePagefilePrivilege 3484 Explorer.EXE Token: SeShutdownPrivilege 3484 Explorer.EXE Token: SeCreatePagefilePrivilege 3484 Explorer.EXE Token: SeDebugPrivilege 4968 cmstp.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5068 wrote to memory of 3744 5068 MtpEVOhIlX08ZbN.exe 87 PID 5068 wrote to memory of 3744 5068 MtpEVOhIlX08ZbN.exe 87 PID 5068 wrote to memory of 3744 5068 MtpEVOhIlX08ZbN.exe 87 PID 5068 wrote to memory of 3256 5068 MtpEVOhIlX08ZbN.exe 89 PID 5068 wrote to memory of 3256 5068 MtpEVOhIlX08ZbN.exe 89 PID 5068 wrote to memory of 3256 5068 MtpEVOhIlX08ZbN.exe 89 PID 5068 wrote to memory of 2348 5068 MtpEVOhIlX08ZbN.exe 91 PID 5068 wrote to memory of 2348 5068 MtpEVOhIlX08ZbN.exe 91 PID 5068 wrote to memory of 2348 5068 MtpEVOhIlX08ZbN.exe 91 PID 5068 wrote to memory of 1748 5068 MtpEVOhIlX08ZbN.exe 93 PID 5068 wrote to memory of 1748 5068 MtpEVOhIlX08ZbN.exe 93 PID 5068 wrote to memory of 1748 5068 MtpEVOhIlX08ZbN.exe 93 PID 5068 wrote to memory of 1748 5068 MtpEVOhIlX08ZbN.exe 93 PID 5068 wrote to memory of 1748 5068 MtpEVOhIlX08ZbN.exe 93 PID 5068 wrote to memory of 1748 5068 MtpEVOhIlX08ZbN.exe 93 PID 3484 wrote to memory of 4968 3484 Explorer.EXE 95 PID 3484 wrote to memory of 4968 3484 Explorer.EXE 95 PID 3484 wrote to memory of 4968 3484 Explorer.EXE 95 PID 4968 wrote to memory of 4888 4968 cmstp.exe 98 PID 4968 wrote to memory of 4888 4968 cmstp.exe 98 PID 4968 wrote to memory of 4888 4968 cmstp.exe 98
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\MtpEVOhIlX08ZbN.exe"C:\Users\Admin\AppData\Local\Temp\MtpEVOhIlX08ZbN.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MtpEVOhIlX08ZbN.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sHjGErDAO.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3256
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sHjGErDAO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD764.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2348
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵PID:2192
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4888
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5db93c4f77a90d41912b09e418faa9666
SHA125d23bfa2158dce2e6741c89a9d0ad5b76c06f47
SHA25645b8f6afe756c4559bc0689c5cae62f5a7e562957479a27b99ae1cb5f07ad342
SHA51270f156903d3128b8d3ac7a90e8c5d2472325242a69158f2e3d36f76995b7aa9c74c7585f3a69b89e9333c282ebbc5afdd227472dbb0b712a0229d2880687fe7d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5ec200f5a4d88cee48b042c670581005a
SHA1a90732e01f92d1b6894f81afd3d2945b9da3de6c
SHA2569713b629a0a043165f60e2d43cc6a59adf8a32759c3f432ef747191ec4c6eca5
SHA51282c51c55e6531f055d2217c73e98f88327225110bb2e5863556a7c8c2a37765e8897e3d3c063fd7377c6f3804b40c82c6250155116c32d18c8ca8d43402bc1a1