Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/02/2025, 08:50
Static task
static1
Behavioral task
behavioral1
Sample
QYqXYpTo9nLX2kX.exe
Resource
win7-20240903-en
General
-
Target
QYqXYpTo9nLX2kX.exe
-
Size
554KB
-
MD5
7fda0310485ec8de0a5bc10e1d027284
-
SHA1
3ada290a132e69fd88b5c9f8beac4ea2ee3655de
-
SHA256
50b35f848446146fece2aef6b039a20230bad0040cdd39084675a466792cff52
-
SHA512
6b9b7f0ce3959fab35bb961f53500c5a7ffc605698f765f59d661e4dd07e4408628cd1a0ae24b9cdbcaddce7973fd2154f3730901a3ef0e4cb0c2ddb125a826d
-
SSDEEP
12288:hw5d04ufAI2LK5Td3suvB+1rA5fgZQTDVlGF7u2GfGZyVgIRi:y5d+fAtm5p3sceAFgQhgF7ulGZaR
Malware Config
Extracted
formbook
4.1
oy30
rfc234.top
danielcavalari.com
elperegrinocabo.com
aryor.info
surelistening.com
premium-numero-telf.buzz
orlynyml.click
tennislovers-ro.com
holdmytracker.com
eewapay.com
jaimesinstallglass.com
damactrade.net
swapspecialities.com
perfumesrffd.today
salesfactory.pro
supportive-solutions.com
naiol.com
khoyr.com
kalendeargpt44.com
web-tech-spb.store
lodjireal.online
ultraflooringmore.com
iwantbundles.com
theroofer.lat
qwxry.fun
faserfreunde.com
body-for-living.com
welnessfit.com
clublucky.store
nlast.cyou
gkoders.com
okxmttwa.click
nodesofty.com
alemania-paredes.com
travel-insuranceprice.shop
thechaay.com
formulavsupplements.com
gstringtheory.com
ruopenai.com
evi-based.com
danleugers.com
lojinhaevelyn.com
denzaimivsem.buzz
izmn2vd8.click
asliy.top
kawitrack.com
brandiai.com
ssssne.com
asianewsgood.online
proloop.work
dhikaedwina.com
onemarinallc.com
realmpabq.com
boswells.biz
jpxiaoxi.top
ishirink.com
thundershorts.com
rainydayroofs.com
atatra.com
hftroi.xyz
fundamentplus.com
gsvaedpzugtdn.com
mic-reform.info
vacuumbagsuppliers.com
gaoxiba150.com
Signatures
-
Formbook family
-
Formbook payload 3 IoCs
resource yara_rule behavioral1/memory/2740-12-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2740-16-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/2800-21-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
pid Process 2776 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1860 set thread context of 2740 1860 QYqXYpTo9nLX2kX.exe 31 PID 2740 set thread context of 1208 2740 QYqXYpTo9nLX2kX.exe 21 PID 2800 set thread context of 1208 2800 control.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYqXYpTo9nLX2kX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language control.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2740 QYqXYpTo9nLX2kX.exe 2740 QYqXYpTo9nLX2kX.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe 2800 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2740 QYqXYpTo9nLX2kX.exe 2740 QYqXYpTo9nLX2kX.exe 2740 QYqXYpTo9nLX2kX.exe 2800 control.exe 2800 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2740 QYqXYpTo9nLX2kX.exe Token: SeDebugPrivilege 2800 control.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2740 1860 QYqXYpTo9nLX2kX.exe 31 PID 1860 wrote to memory of 2740 1860 QYqXYpTo9nLX2kX.exe 31 PID 1860 wrote to memory of 2740 1860 QYqXYpTo9nLX2kX.exe 31 PID 1860 wrote to memory of 2740 1860 QYqXYpTo9nLX2kX.exe 31 PID 1860 wrote to memory of 2740 1860 QYqXYpTo9nLX2kX.exe 31 PID 1860 wrote to memory of 2740 1860 QYqXYpTo9nLX2kX.exe 31 PID 1860 wrote to memory of 2740 1860 QYqXYpTo9nLX2kX.exe 31 PID 1208 wrote to memory of 2800 1208 Explorer.EXE 32 PID 1208 wrote to memory of 2800 1208 Explorer.EXE 32 PID 1208 wrote to memory of 2800 1208 Explorer.EXE 32 PID 1208 wrote to memory of 2800 1208 Explorer.EXE 32 PID 2800 wrote to memory of 2776 2800 control.exe 33 PID 2800 wrote to memory of 2776 2800 control.exe 33 PID 2800 wrote to memory of 2776 2800 control.exe 33 PID 2800 wrote to memory of 2776 2800 control.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\QYqXYpTo9nLX2kX.exe"C:\Users\Admin\AppData\Local\Temp\QYqXYpTo9nLX2kX.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\QYqXYpTo9nLX2kX.exe"C:\Users\Admin\AppData\Local\Temp\QYqXYpTo9nLX2kX.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QYqXYpTo9nLX2kX.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2776
-
-