Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2025, 04:11
Static task
static1
Behavioral task
behavioral1
Sample
order confirmation.exe
Resource
win7-20241023-en
General
-
Target
order confirmation.exe
-
Size
688KB
-
MD5
c662d081f4cd41e817cc9e246ca54633
-
SHA1
0d1383e23f4b4a9aec5b8a43725af2212a5bdc83
-
SHA256
d0cff61258d18def7ad7129368ecaccf5d2389eb1fd79b6cbb411c65c5783e0d
-
SHA512
9230b6c03e706740dfd262dea4bf9848b87d92659a5e9431c97ee790c664f31bf20867feb98f6819f8bb24c300ba45e784c94e30f9961443362ff4f7e40b9ac0
-
SSDEEP
12288:vYN/Dswecl9h3/IWs0CFEhNnut872bdnP54UBBTFGLJmqHtJLfPDGlVFSl2p0f+p:bweO3/9/Cq/leTFGdm8tJL6l6AHVLn
Malware Config
Extracted
formbook
4.1
3nop
subur88wap.sbs
tyai1.top
skillbeast.site
kcclassiccars.net
lghomes.net
eijanno.cyou
work-in-usa-60100.bond
268chill.store
bharatwin.biz
cakjitu01.xyz
misafert.xyz
hiretemp.net
lvekz-onearmed.top
amanda-manopo.info
seo-companies22.online
casinowalletth.net
maynrson.monster
bewizi.com
thedronetechhub.shop
car-insurance-93947.bond
javabits.net
dzcodelab.xyz
adeelrao.online
amazing-cruise-pakages.today
wftoutsource.services
stormbeauty.online
a8dz7m5.com
875capehornrdjeffersonny.com
odadesign.site
reejunkremoval7.life
g59q18eq.top
wk0003.top
rtpradar138af.xyz
wnsyl11.vip
nexilis.rest
top-dubai-cruise-deals.today
zoril.lol
englishmaterials.net
uzumluescortg.xyz
dutchpay.net
visprintdesign.biz
kneepain661.shop
xuq-smart-fridge-uj0.rest
jam-nins.com
rentabay.shop
victoryvo2.info
i2c2.tech
wck37.top
refrigerators-69792.bond
abc1network.net
amilia-do-gil.net
806477628.xyz
luxdrive.vip
unika.lat
sculptify.today
winatwork.today
onlinegamehub.online
petnino.club
amtrade.icu
macular-degeneration-39252.bond
argastipster.click
1nvuti.fun
beautifyaura.com
savings-accounts-57645.bond
ok33r.shop
Signatures
-
Formbook family
-
Formbook payload 4 IoCs
resource yara_rule behavioral2/memory/2976-20-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2976-34-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2976-72-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4252-76-0x00000000004D0000-0x00000000004FF000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2652 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\Control Panel\International\Geo\Nation order confirmation.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4088 set thread context of 2976 4088 order confirmation.exe 92 PID 2976 set thread context of 3324 2976 RegSvcs.exe 55 PID 2976 set thread context of 3324 2976 RegSvcs.exe 55 PID 4252 set thread context of 3324 4252 raserver.exe 55 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language order confirmation.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 936 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4088 order confirmation.exe 2652 powershell.exe 4088 order confirmation.exe 2976 RegSvcs.exe 2976 RegSvcs.exe 2976 RegSvcs.exe 2976 RegSvcs.exe 2652 powershell.exe 2976 RegSvcs.exe 2976 RegSvcs.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe 4252 raserver.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2976 RegSvcs.exe 2976 RegSvcs.exe 2976 RegSvcs.exe 2976 RegSvcs.exe 4252 raserver.exe 4252 raserver.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4088 order confirmation.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeDebugPrivilege 2976 RegSvcs.exe Token: SeShutdownPrivilege 3324 Explorer.EXE Token: SeCreatePagefilePrivilege 3324 Explorer.EXE Token: SeDebugPrivilege 4252 raserver.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3324 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4088 wrote to memory of 2652 4088 order confirmation.exe 88 PID 4088 wrote to memory of 2652 4088 order confirmation.exe 88 PID 4088 wrote to memory of 2652 4088 order confirmation.exe 88 PID 4088 wrote to memory of 936 4088 order confirmation.exe 90 PID 4088 wrote to memory of 936 4088 order confirmation.exe 90 PID 4088 wrote to memory of 936 4088 order confirmation.exe 90 PID 4088 wrote to memory of 2976 4088 order confirmation.exe 92 PID 4088 wrote to memory of 2976 4088 order confirmation.exe 92 PID 4088 wrote to memory of 2976 4088 order confirmation.exe 92 PID 4088 wrote to memory of 2976 4088 order confirmation.exe 92 PID 4088 wrote to memory of 2976 4088 order confirmation.exe 92 PID 4088 wrote to memory of 2976 4088 order confirmation.exe 92 PID 3324 wrote to memory of 4252 3324 Explorer.EXE 93 PID 3324 wrote to memory of 4252 3324 Explorer.EXE 93 PID 3324 wrote to memory of 4252 3324 Explorer.EXE 93 PID 4252 wrote to memory of 2588 4252 raserver.exe 94 PID 4252 wrote to memory of 2588 4252 raserver.exe 94 PID 4252 wrote to memory of 2588 4252 raserver.exe 94
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\order confirmation.exe"C:\Users\Admin\AppData\Local\Temp\order confirmation.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GkYIbr.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GkYIbr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp450.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5859fcd92c69960d5a0547b410b810e65
SHA1b58d280ca09b4fad9bbcf607bfea2a3fc989e2dc
SHA256029c54c6fcf4da14b4992ec14282ade4dba3b2a39d47ad07344a43d6fb99fdb9
SHA5120770317e08b9ade156798469f9fb72b658c217a27a30dc3b5cef9a56d3303119d69f6bb4d1ef5da33d0e03523f2ccd827fd7df3e51aa98087e78f5e05521ed12