Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04

  • Size

    1.0MB

  • Sample

    221201-zrjbysag95

  • MD5

    ea152391202b4fcef52ec714ae5684bb

  • SHA1

    0646192dd09e55ab2958fb753fc801d1ff293dcc

  • SHA256

    94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04

  • SHA512

    0940fb9e270d180d5b1b68b7db15425d20ba314a41da7042b07008312fa98ffbce21c78ca677b22eaea2e4b7b1b58fe9d38aa1483a93ef00cce1f5d9d3d83048

  • SSDEEP

    24576:0cNJP38kXIxRkm0BCRLo50WD15X8ezAMPZWWPItL9wuWm7I1vq53b2:0cTPMkMRp5ORnXyG8tLPWm7aq53b2

Malware Config

Targets

    • Target

      94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04

    • Size

      1.0MB

    • MD5

      ea152391202b4fcef52ec714ae5684bb

    • SHA1

      0646192dd09e55ab2958fb753fc801d1ff293dcc

    • SHA256

      94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04

    • SHA512

      0940fb9e270d180d5b1b68b7db15425d20ba314a41da7042b07008312fa98ffbce21c78ca677b22eaea2e4b7b1b58fe9d38aa1483a93ef00cce1f5d9d3d83048

    • SSDEEP

      24576:0cNJP38kXIxRkm0BCRLo50WD15X8ezAMPZWWPItL9wuWm7I1vq53b2:0cTPMkMRp5ORnXyG8tLPWm7aq53b2

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • UAC bypass

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks