Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

9cfcd7cc47...53.exe

windows7-x64

10

9cfcd7cc47...53.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9cfcd7cc477b78c554c9f88c60dfd073a17af09872663d15bc689493f5e78053

  • Size

    110KB

  • Sample

    221126-ccr9zsdd33

  • MD5

    a0a4452bf9d24f1082680bd6052b9fd0

  • SHA1

    150cbac129712a7f58710c8b5d4999163f240223

  • SHA256

    9cfcd7cc477b78c554c9f88c60dfd073a17af09872663d15bc689493f5e78053

  • SHA512

    f8cedd2898376d8b57c68df13f5e7ff43cdcaff5fa09c1903eb26833241b04fa37a7535cf1cf73cd6c993d3a7b8269c9913fe910d61f5df5e50cc39938ae5ae1

  • SSDEEP

    3072:G1+MJKrUnFYY5z1i0Nmbi5fJBN1O581esZXjout:OIrPj0NmWtN1d1esFjoS

Score
10/10
modiloaderevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      9cfcd7cc477b78c554c9f88c60dfd073a17af09872663d15bc689493f5e78053

    • Size

      110KB

    • MD5

      a0a4452bf9d24f1082680bd6052b9fd0

    • SHA1

      150cbac129712a7f58710c8b5d4999163f240223

    • SHA256

      9cfcd7cc477b78c554c9f88c60dfd073a17af09872663d15bc689493f5e78053

    • SHA512

      f8cedd2898376d8b57c68df13f5e7ff43cdcaff5fa09c1903eb26833241b04fa37a7535cf1cf73cd6c993d3a7b8269c9913fe910d61f5df5e50cc39938ae5ae1

    • SSDEEP

      3072:G1+MJKrUnFYY5z1i0Nmbi5fJBN1O581esZXjout:OIrPj0NmWtN1d1esFjoS

    Score
    10/10
    modiloaderevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks