Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 22:37
Behavioral task
behavioral1
Sample
40c1b54269a4ea770a51d2cfcdbb9eeb.exe
Resource
win7-20231215-en
General
-
Target
40c1b54269a4ea770a51d2cfcdbb9eeb.exe
-
Size
777KB
-
MD5
40c1b54269a4ea770a51d2cfcdbb9eeb
-
SHA1
b96fcb61a7f20c090f931d4a123250937b030d41
-
SHA256
3cc9d68a2b59eccab8ede2b71539ef8e9b3b4e6941f5a78978c42265131d1340
-
SHA512
9bbb30a6ade82418b21485c69d2de91444cef5485e263ce6f450e42b0644c6c60dafa166d36e69ccd81e5e8758341e7b2124560c5bc336718addbaed9b006a2b
-
SSDEEP
12288:Bq+hQxVUzfvVYzSbAdmndFYw4tdN0a20JK2LMLGpH9gLWMccNt2wJVYSEg+rKZV:0+ykW8dFWAa2/6gGpdgLWMfN88V3Is
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 21 IoCs
resource yara_rule behavioral1/memory/1972-2-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1972-23-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1972-29-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1972-26-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1972-33-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1972-38-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-44-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-78-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-76-0x0000000076AA0000-0x0000000076B90000-memory.dmp modiloader_stage2 behavioral1/memory/1996-80-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-81-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-83-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-84-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-86-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-87-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-88-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-89-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-90-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-91-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-92-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 behavioral1/memory/1996-93-0x0000000000400000-0x00000000005BC000-memory.dmp modiloader_stage2 -
resource yara_rule behavioral1/files/0x00060000000055d8-37.dat aspack_v212_v242 behavioral1/files/0x00060000000055d8-34.dat aspack_v212_v242 -
Deletes itself 1 IoCs
pid Process 1996 mstwain32.exe -
Executes dropped EXE 1 IoCs
pid Process 1996 mstwain32.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Wine 40c1b54269a4ea770a51d2cfcdbb9eeb.exe Key opened \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Wine mstwain32.exe -
resource yara_rule behavioral1/memory/1972-0-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1972-1-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1972-2-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1972-23-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1972-29-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1972-26-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/files/0x00060000000055d8-37.dat themida behavioral1/files/0x00060000000055d8-34.dat themida behavioral1/memory/1972-33-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1972-38-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-42-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-43-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-44-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-78-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-76-0x0000000076AA0000-0x0000000076B90000-memory.dmp themida behavioral1/memory/1996-80-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-81-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-83-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-84-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-86-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-87-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-88-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-89-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-90-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-91-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-92-0x0000000000400000-0x00000000005BC000-memory.dmp themida behavioral1/memory/1996-93-0x0000000000400000-0x00000000005BC000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 40c1b54269a4ea770a51d2cfcdbb9eeb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1972 40c1b54269a4ea770a51d2cfcdbb9eeb.exe 1996 mstwain32.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\mstwain32.exe 40c1b54269a4ea770a51d2cfcdbb9eeb.exe File opened for modification C:\Windows\mstwain32.exe 40c1b54269a4ea770a51d2cfcdbb9eeb.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1972 40c1b54269a4ea770a51d2cfcdbb9eeb.exe 1996 mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1972 40c1b54269a4ea770a51d2cfcdbb9eeb.exe Token: SeBackupPrivilege 2832 vssvc.exe Token: SeRestorePrivilege 2832 vssvc.exe Token: SeAuditPrivilege 2832 vssvc.exe Token: SeDebugPrivilege 1996 mstwain32.exe Token: SeDebugPrivilege 1996 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1996 mstwain32.exe 1996 mstwain32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1996 1972 40c1b54269a4ea770a51d2cfcdbb9eeb.exe 31 PID 1972 wrote to memory of 1996 1972 40c1b54269a4ea770a51d2cfcdbb9eeb.exe 31 PID 1972 wrote to memory of 1996 1972 40c1b54269a4ea770a51d2cfcdbb9eeb.exe 31 PID 1972 wrote to memory of 1996 1972 40c1b54269a4ea770a51d2cfcdbb9eeb.exe 31 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\40c1b54269a4ea770a51d2cfcdbb9eeb.exe"C:\Users\Admin\AppData\Local\Temp\40c1b54269a4ea770a51d2cfcdbb9eeb.exe"1⤵
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\40c1b54269a4ea770a51d2cfcdbb9eeb.exe"2⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1996
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275KB
MD54aa49a1b67b07b6dcc00507cee9fbe22
SHA1fcc381ce0b4c5477b811df0d03d42341ea254cf2
SHA256a3b3ff9ef30e4517828eb92c48f3b1fdb26c6b0f55d2623f30cfe4ef1cf3cdb8
SHA5124ca08680698e6cb7f2ecad97872434bc0b82e571cc836b0fc7f9bddc3aa8f7f781b1a5761372971c899b30d78e6f8d9f8ff85200d421d80f0a00dea2112513de
-
Filesize
390KB
MD5c7a8ffa57419a6736a160af5744a7e39
SHA12ede66d97d534a6c01e338ce970144e565c3a52e
SHA25608530e3c7280478c097b3cd6f7182f9fcf11cf3cf84784a2daa7c5420d2184bf
SHA5125b42452998387bc1a722c0a41c00a3c6646a1e933e2202662d84195695af1a0fcfa10ed9723caac6e43bc2f2695374f917818d57bf02e121235d9711b465fbb0