Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
06/12/2022, 19:08
General
-
Target
dcdd046f3e45d2bf76cd39f6ee732ddfc69695320d581efe4ccb99a231d9fac6.exe
-
Size
40KB
-
MD5
00c57ab724a2f49bc710fe06b1848f00
-
SHA1
68f194c459e02a4d51156f48f0c1b154af877210
-
SHA256
dcdd046f3e45d2bf76cd39f6ee732ddfc69695320d581efe4ccb99a231d9fac6
-
SHA512
370160d7a56e5746d765279dce2f8988813c6743f7a9dc1be3f108c0bac17ab9c6e994acb32d251cd6764fa9ee8b0109e6f16ba88024ef936c5cb1566042eb3b
-
SSDEEP
768:B4B2JGYVNfV6vrFDPwp2Gt7YHN0m5vcdXwPXDzHvzExAPOE/3MwVrJ7H8oWXRrKD:BC2oAfIrJwp2Gium5vcxwPzzvzEx6L/9
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcdd046f3e45d2bf76cd39f6ee732ddfc69695320d581efe4ccb99a231d9fac6.exe"C:\Users\Admin\AppData\Local\Temp\dcdd046f3e45d2bf76cd39f6ee732ddfc69695320d581efe4ccb99a231d9fac6.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5ac61896f84cb387764f4f324d19959d9
SHA1e91f352f691f10229a29fadf412d9a4cb0d9f0aa
SHA25601796e601684a59035ab1f375cb51836a3f0ff8b30dcf6e6458eb3a2e8b16da0
SHA512ca2d617afc6d2d608563d58b2385ea28254d9da7ce743153543f4172e96c651246068aae7546bce7cdf7b6ac17e8295c0a8b278dc877aaa3fc27c2a510bbc358
-
Filesize
8KB
-
Filesize
212KB
-
Filesize
144KB