Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/09/2023, 15:45

General

  • Target

    (UFMA) RFQ #180222BR24 & #160222BR7.scr

  • Size

    1.2MB

  • MD5

    3e890cd7def59cadc0be2850f79b717d

  • SHA1

    f9d0155561621c9d6feeff881b2f42502e4fb42b

  • SHA256

    7df63232b813270ba3333eeb76ae423da2a35fabf2bcf21a01269b9c8d29e8c5

  • SHA512

    14add30a809257feae32af8b95dcd43cd4e336761c7d80c0a8424b29e2f346658eb8a33cd4f6707582657f16ec1f2ff24b1abc8596b444191f0a7636cb39ffe4

  • SSDEEP

    12288:dN7i6PeBQ9p1nU+Ji+/F1u1mlNHbsgyAvBvvc+X2B+d4ELSQZBLLKbIt383739Da:d5i6lnUr+fuMpNDJ2UxtkRN0D9t1

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\(UFMA) RFQ #180222BR24 & #160222BR7.scr
    "C:\Users\Admin\AppData\Local\Temp\(UFMA) RFQ #180222BR24 & #160222BR7.scr" /S
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\FmmtrhwkO.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c mkdir "\\?\C:\Windows "
        3⤵
          PID:2420
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c mkdir "\\?\C:\Windows \System32"
          3⤵
            PID:4832
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c ECHO F
            3⤵
              PID:2788
            • C:\Windows\SysWOW64\xcopy.exe
              xcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y
              3⤵
              • Enumerates system info in registry
              PID:2484
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c ECHO F
              3⤵
                PID:4268
              • C:\Windows\SysWOW64\xcopy.exe
                xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y
                3⤵
                • Enumerates system info in registry
                PID:1460
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c ECHO F
                3⤵
                  PID:3172
                • C:\Windows\SysWOW64\xcopy.exe
                  xcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y
                  3⤵
                  • Enumerates system info in registry
                  PID:2084
                • C:\Windows \System32\easinvoker.exe
                  "C:\Windows \System32\easinvoker.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:2820
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3492
                    • C:\Windows\system32\cmd.exe
                      cmd.exe /c start /min powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1884
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4612
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1 -n 6
                  3⤵
                  • Runs ping.exe
                  PID:3820
              • C:\Windows\SysWOW64\colorcpl.exe
                C:\Windows\System32\colorcpl.exe
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2652

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_etoia21g.do0.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Public\Libraries\FmmtrhwkO.bat

              Filesize

              466B

              MD5

              9e80036aabe3227dbf98b3975051a53b

              SHA1

              9670aab8897770a93293d85426b7b13dda23a152

              SHA256

              964aab3b72b3545fabc58a209714ebeade739a0fec40b33af675d7157b9cb252

              SHA512

              107fb6b364cf92730aca1a044f7769a1f4aed39a72f031a5004ccf09b3bebabac5fc88b3d0f85eb64c665404136db13678718bad36bea4311f07726684ed0a03

            • C:\Users\Public\Libraries\KDECO.bat

              Filesize

              152B

              MD5

              7e5fbd29557a68383dfb34e696964e93

              SHA1

              c1f748f89b47864301255d1fb2bfed04ed0d1300

              SHA256

              4e55b1bbe2e0e099592ac57a747fa8d4ef67409901d6c64323a1b73d50e5de67

              SHA512

              7dcb6582b03e7bf0cab2168dc775ca6d7a15ebb097fd2cdd3445b6d35ee128386fb9aa6a548b745c32540e358b2aa4d7c78a6f59f85c32065735fc54a6a2bb6a

            • C:\Users\Public\Libraries\easinvoker.exe

              Filesize

              128KB

              MD5

              231ce1e1d7d98b44371ffff407d68b59

              SHA1

              25510d0f6353dbf0c9f72fc880de7585e34b28ff

              SHA256

              30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

              SHA512

              520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

            • C:\Users\Public\Libraries\netutils.dll

              Filesize

              110KB

              MD5

              555712f7ff7d7402d21c40a5fe8cba39

              SHA1

              30bab111d69ca87c940b019a8d55152c132696bd

              SHA256

              101d84e0e2b1bcbe2ca8a38ebc29b1dfa43de3b7a29439ea678f60ce54318c86

              SHA512

              0ea11c51208f8edd1b19a534e7ca2d0b5d4bdbc42ad599a445f8a983744c9480b78e96d6650b46d96b580ebbf6a4fa8cacd8b62d37e451bd9863d352a894e6ac

            • C:\Windows \System32\easinvoker.exe

              Filesize

              128KB

              MD5

              231ce1e1d7d98b44371ffff407d68b59

              SHA1

              25510d0f6353dbf0c9f72fc880de7585e34b28ff

              SHA256

              30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

              SHA512

              520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

            • C:\Windows \System32\easinvoker.exe

              Filesize

              128KB

              MD5

              231ce1e1d7d98b44371ffff407d68b59

              SHA1

              25510d0f6353dbf0c9f72fc880de7585e34b28ff

              SHA256

              30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

              SHA512

              520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

            • C:\Windows \System32\netutils.dll

              Filesize

              110KB

              MD5

              555712f7ff7d7402d21c40a5fe8cba39

              SHA1

              30bab111d69ca87c940b019a8d55152c132696bd

              SHA256

              101d84e0e2b1bcbe2ca8a38ebc29b1dfa43de3b7a29439ea678f60ce54318c86

              SHA512

              0ea11c51208f8edd1b19a534e7ca2d0b5d4bdbc42ad599a445f8a983744c9480b78e96d6650b46d96b580ebbf6a4fa8cacd8b62d37e451bd9863d352a894e6ac

            • C:\Windows \System32\netutils.dll

              Filesize

              110KB

              MD5

              555712f7ff7d7402d21c40a5fe8cba39

              SHA1

              30bab111d69ca87c940b019a8d55152c132696bd

              SHA256

              101d84e0e2b1bcbe2ca8a38ebc29b1dfa43de3b7a29439ea678f60ce54318c86

              SHA512

              0ea11c51208f8edd1b19a534e7ca2d0b5d4bdbc42ad599a445f8a983744c9480b78e96d6650b46d96b580ebbf6a4fa8cacd8b62d37e451bd9863d352a894e6ac

            • C:\windows \system32\KDECO.bat

              Filesize

              152B

              MD5

              7e5fbd29557a68383dfb34e696964e93

              SHA1

              c1f748f89b47864301255d1fb2bfed04ed0d1300

              SHA256

              4e55b1bbe2e0e099592ac57a747fa8d4ef67409901d6c64323a1b73d50e5de67

              SHA512

              7dcb6582b03e7bf0cab2168dc775ca6d7a15ebb097fd2cdd3445b6d35ee128386fb9aa6a548b745c32540e358b2aa4d7c78a6f59f85c32065735fc54a6a2bb6a

            • memory/1556-1-0x0000000003FA0000-0x0000000004FA0000-memory.dmp

              Filesize

              16.0MB

            • memory/1556-0-0x00000000022F0000-0x00000000022F1000-memory.dmp

              Filesize

              4KB

            • memory/1556-4-0x0000000000400000-0x000000000053E000-memory.dmp

              Filesize

              1.2MB

            • memory/1556-5-0x00000000022F0000-0x00000000022F1000-memory.dmp

              Filesize

              4KB

            • memory/1556-2-0x0000000003FA0000-0x0000000004FA0000-memory.dmp

              Filesize

              16.0MB

            • memory/2652-47-0x0000000004B30000-0x0000000005B30000-memory.dmp

              Filesize

              16.0MB

            • memory/2652-49-0x0000000016D00000-0x000000001704A000-memory.dmp

              Filesize

              3.3MB

            • memory/2820-27-0x00000000613C0000-0x00000000613E2000-memory.dmp

              Filesize

              136KB

            • memory/4612-41-0x00007FFBD8DD0000-0x00007FFBD9891000-memory.dmp

              Filesize

              10.8MB

            • memory/4612-43-0x000002375F3E0000-0x000002375F3F0000-memory.dmp

              Filesize

              64KB

            • memory/4612-44-0x000002375F3E0000-0x000002375F3F0000-memory.dmp

              Filesize

              64KB

            • memory/4612-46-0x00007FFBD8DD0000-0x00007FFBD9891000-memory.dmp

              Filesize

              10.8MB

            • memory/4612-42-0x000002375F3E0000-0x000002375F3F0000-memory.dmp

              Filesize

              64KB

            • memory/4612-31-0x000002375F3F0000-0x000002375F412000-memory.dmp

              Filesize

              136KB