Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2025, 02:59

General

  • Target

    REVISED DOCUMENT.exe

  • Size

    686KB

  • MD5

    3ce1a7e44b4edafafc9e2ac8b3ab3295

  • SHA1

    f35ea88bdd6cc369a640263690855116adeb3f01

  • SHA256

    acdcfb74712f171a6527ea14112eeb4bd482b7ae74f4e2990a946c8ccea8ad65

  • SHA512

    319baa767941b2dd181062b89555e10ebbd30e47fa83683db306baafe5edbb6dae8216bd3f57291733a618da724a5b8005d24b02f0d525d4505694704d9593fa

  • SSDEEP

    12288:hRNk5ea1sMXs8c/jH2MgIQFdSlabXulG1rdtf+nyzu3zE/FC/h2pHcQ/Q:h45D5cb2MEFdSDGRDpzszEw

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

a03d

Decoy

nfluencer-marketing-13524.bond

cebepu.info

lphatechblog.xyz

haoyun.website

itiz.xyz

orld-visa-center.online

si.art

alata.xyz

mmarketing.xyz

elnqdjc.shop

ensentoto.cloud

voyagu.info

onvert.today

1fuli9902.shop

otelhafnia.info

rumpchiefofstaff.store

urvivalflashlights.shop

0090.pizza

ings-hu-13.today

oliticalpatriot.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3468
    • C:\Users\Admin\AppData\Local\Temp\REVISED DOCUMENT.exe
      "C:\Users\Admin\AppData\Local\Temp\REVISED DOCUMENT.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3932
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\REVISED DOCUMENT.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2340
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TQjwUwdCH.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5032
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TQjwUwdCH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFDA9.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:708
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4632
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:5000
      • C:\Windows\SysWOW64\cmstp.exe
        "C:\Windows\SysWOW64\cmstp.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1152
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4180

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      959e558521d80e6ae2db2ae3be8e6532

      SHA1

      f771c6355f9a9207acf588d354d8c2788e405b71

      SHA256

      2f7d5a9459fdbc26cc60c264a3af617471e8b2b63373579ec2d3c767d59e24a7

      SHA512

      fea6b586e65d3a067e2258d8025b2234314fa7b0d1eddad3eb5b766d371ff3fb90de8f4e04b3c2c7b3da21a2d94ef7b80a0d2a970d50ee1c637e200b9a164451

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f1wzezhu.cax.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpFDA9.tmp

      Filesize

      1KB

      MD5

      cc2cf40113b5f85de67c29d6f0d0762e

      SHA1

      3a317a17b871c172d9e4c6cb3bf218b37dd45305

      SHA256

      031cfef40223490dbc58fa9952a947eecfa8b643fec5aaed0035fa714856b305

      SHA512

      f16d47dc1c76ebb2dd5fe14e6726df7a0d44aa25ce6ec0aefe2df187be4e2381713c8c93f630126e6a1da791ccc30cf67e732bdf78e7db146f0c8ca72977fd88

    • memory/1152-92-0x0000000000730000-0x000000000075F000-memory.dmp

      Filesize

      188KB

    • memory/1152-80-0x0000000000850000-0x0000000000866000-memory.dmp

      Filesize

      88KB

    • memory/2340-23-0x0000000005F40000-0x0000000005F62000-memory.dmp

      Filesize

      136KB

    • memory/2340-24-0x0000000005FE0000-0x0000000006046000-memory.dmp

      Filesize

      408KB

    • memory/2340-81-0x0000000007C40000-0x0000000007C4E000-memory.dmp

      Filesize

      56KB

    • memory/2340-76-0x0000000007A80000-0x0000000007A8A000-memory.dmp

      Filesize

      40KB

    • memory/2340-73-0x0000000007960000-0x0000000007A03000-memory.dmp

      Filesize

      652KB

    • memory/2340-62-0x0000000006B70000-0x0000000006B8E000-memory.dmp

      Filesize

      120KB

    • memory/2340-16-0x0000000005120000-0x0000000005156000-memory.dmp

      Filesize

      216KB

    • memory/2340-17-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/2340-18-0x00000000058C0000-0x0000000005EE8000-memory.dmp

      Filesize

      6.2MB

    • memory/2340-19-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/2340-20-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/2340-91-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/2340-52-0x0000000075A10000-0x0000000075A5C000-memory.dmp

      Filesize

      304KB

    • memory/2340-25-0x0000000006050000-0x00000000060B6000-memory.dmp

      Filesize

      408KB

    • memory/2340-51-0x0000000006B90000-0x0000000006BC2000-memory.dmp

      Filesize

      200KB

    • memory/2340-37-0x00000000060D0000-0x0000000006424000-memory.dmp

      Filesize

      3.3MB

    • memory/3468-95-0x0000000007B40000-0x0000000007CAF000-memory.dmp

      Filesize

      1.4MB

    • memory/3932-1-0x00000000000F0000-0x00000000001A2000-memory.dmp

      Filesize

      712KB

    • memory/3932-2-0x0000000005040000-0x00000000055E4000-memory.dmp

      Filesize

      5.6MB

    • memory/3932-0-0x000000007518E000-0x000000007518F000-memory.dmp

      Filesize

      4KB

    • memory/3932-5-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/3932-7-0x0000000005E50000-0x0000000005EF2000-memory.dmp

      Filesize

      648KB

    • memory/3932-4-0x0000000004B50000-0x0000000004B5A000-memory.dmp

      Filesize

      40KB

    • memory/3932-47-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/3932-11-0x0000000002540000-0x00000000025B8000-memory.dmp

      Filesize

      480KB

    • memory/3932-6-0x0000000004E70000-0x0000000004F0C000-memory.dmp

      Filesize

      624KB

    • memory/3932-10-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/3932-8-0x00000000056F0000-0x000000000570E000-memory.dmp

      Filesize

      120KB

    • memory/3932-3-0x0000000004B70000-0x0000000004C02000-memory.dmp

      Filesize

      584KB

    • memory/3932-9-0x000000007518E000-0x000000007518F000-memory.dmp

      Filesize

      4KB

    • memory/4632-79-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/4632-26-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/5032-50-0x00000000069B0000-0x00000000069FC000-memory.dmp

      Filesize

      304KB

    • memory/5032-78-0x0000000007980000-0x0000000007991000-memory.dmp

      Filesize

      68KB

    • memory/5032-77-0x0000000007A00000-0x0000000007A96000-memory.dmp

      Filesize

      600KB

    • memory/5032-82-0x00000000079C0000-0x00000000079D4000-memory.dmp

      Filesize

      80KB

    • memory/5032-83-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

      Filesize

      104KB

    • memory/5032-84-0x0000000007AA0000-0x0000000007AA8000-memory.dmp

      Filesize

      32KB

    • memory/5032-87-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/5032-74-0x0000000007DC0000-0x000000000843A000-memory.dmp

      Filesize

      6.5MB

    • memory/5032-75-0x0000000007780000-0x000000000779A000-memory.dmp

      Filesize

      104KB

    • memory/5032-63-0x0000000075A10000-0x0000000075A5C000-memory.dmp

      Filesize

      304KB

    • memory/5032-49-0x0000000006460000-0x000000000647E000-memory.dmp

      Filesize

      120KB

    • memory/5032-21-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB