Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2022, 22:24

General

  • Target

    Dospjela faktura.exe

  • Size

    885KB

  • MD5

    e128d5970cc2d13408916706d4191d55

  • SHA1

    3405ca7211ed488ee29143783cc98ff91c78efb2

  • SHA256

    f7dfefe374452d90bc99631bdd38de65f37ff3aefabaeb525aa2b3d97c6680b5

  • SHA512

    f0d4424a75512e95d7934e8c643ac7807fec678e72c4593c62afc90fd22f9220462b27c1f0a23d27c2c0e4c80b17c15c334782c4aa1ebb7b951316b906584e56

  • SSDEEP

    12288:+dvSgikKHSXrFGZ/1nPaPih+gTiwCAI5T7grmN7vwui44YXas4E+Jymf7fv:+dkDSXrAzaNaizeaNydYXas4E+Dv

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euv4

Decoy

anniebapartments.com

hagenbicycles.com

herbalist101.com

southerncorrosion.net

kuechenpruefer.com

tajniezdrzi.quest

segurofunerarioar.com

boardsandbeamsdecor.com

alifdanismanlik.com

pkem.top

mddc.clinic

handejqr.com

crux-at.com

awp.email

hugsforbubbs.com

cielotherepy.com

turkcuyuz.com

teamidc.com

lankasirinspa.com

68135.online

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • ModiLoader Second Stage 63 IoCs
  • Xloader payload 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2940
    • C:\Users\Admin\AppData\Local\Temp\Dospjela faktura.exe
      "C:\Users\Admin\AppData\Local\Temp\Dospjela faktura.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\SysWOW64\iexpress.exe
        "C:\Windows\System32\iexpress.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2228
    • C:\Windows\SysWOW64\colorcpl.exe
      "C:\Windows\SysWOW64\colorcpl.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4912
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\iexpress.exe"
        3⤵
          PID:4604

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2228-268-0x0000000010410000-0x0000000010439000-memory.dmp

      Filesize

      164KB

    • memory/2228-269-0x0000000003F40000-0x000000000428A000-memory.dmp

      Filesize

      3.3MB

    • memory/2228-270-0x0000000003E30000-0x0000000003E41000-memory.dmp

      Filesize

      68KB

    • memory/2580-167-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-180-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-135-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-137-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-136-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-138-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-139-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-140-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-141-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-142-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-170-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-144-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-145-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-146-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-147-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-148-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-149-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-150-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-151-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-152-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-153-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-154-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-155-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-156-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-157-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-158-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-159-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-160-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-162-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-161-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-163-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-164-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-165-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-166-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-172-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-169-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-143-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-134-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-133-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-173-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-174-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-175-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-176-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-177-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-178-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-179-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-171-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-181-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-182-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-183-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-184-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-185-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-186-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-187-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-189-0x0000000010410000-0x0000000010439000-memory.dmp

      Filesize

      164KB

    • memory/2580-188-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-190-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-191-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-192-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-193-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-194-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-195-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-196-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2580-197-0x0000000003FD0000-0x0000000004022000-memory.dmp

      Filesize

      328KB

    • memory/2940-271-0x0000000003310000-0x00000000033D2000-memory.dmp

      Filesize

      776KB

    • memory/2940-278-0x0000000008550000-0x0000000008646000-memory.dmp

      Filesize

      984KB

    • memory/2940-280-0x0000000008550000-0x0000000008646000-memory.dmp

      Filesize

      984KB

    • memory/4912-273-0x00000000008A0000-0x00000000008B9000-memory.dmp

      Filesize

      100KB

    • memory/4912-274-0x0000000000190000-0x00000000001B9000-memory.dmp

      Filesize

      164KB

    • memory/4912-276-0x00000000023E0000-0x000000000272A000-memory.dmp

      Filesize

      3.3MB

    • memory/4912-277-0x0000000002170000-0x0000000002200000-memory.dmp

      Filesize

      576KB

    • memory/4912-279-0x0000000000190000-0x00000000001B9000-memory.dmp

      Filesize

      164KB