Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 22:37
General
-
Target
40c1b54269a4ea770a51d2cfcdbb9eeb.exe
-
Size
777KB
-
MD5
40c1b54269a4ea770a51d2cfcdbb9eeb
-
SHA1
b96fcb61a7f20c090f931d4a123250937b030d41
-
SHA256
3cc9d68a2b59eccab8ede2b71539ef8e9b3b4e6941f5a78978c42265131d1340
-
SHA512
9bbb30a6ade82418b21485c69d2de91444cef5485e263ce6f450e42b0644c6c60dafa166d36e69ccd81e5e8758341e7b2124560c5bc336718addbaed9b006a2b
-
SSDEEP
12288:Bq+hQxVUzfvVYzSbAdmndFYw4tdN0a20JK2LMLGpH9gLWMccNt2wJVYSEg+rKZV:0+ykW8dFWAa2/6gGpdgLWMfN88V3Is
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 21 IoCs
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Themida packer 27 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\40c1b54269a4ea770a51d2cfcdbb9eeb.exe"C:\Users\Admin\AppData\Local\Temp\40c1b54269a4ea770a51d2cfcdbb9eeb.exe"1⤵
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\40c1b54269a4ea770a51d2cfcdbb9eeb.exe"2⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275KB
MD54aa49a1b67b07b6dcc00507cee9fbe22
SHA1fcc381ce0b4c5477b811df0d03d42341ea254cf2
SHA256a3b3ff9ef30e4517828eb92c48f3b1fdb26c6b0f55d2623f30cfe4ef1cf3cdb8
SHA5124ca08680698e6cb7f2ecad97872434bc0b82e571cc836b0fc7f9bddc3aa8f7f781b1a5761372971c899b30d78e6f8d9f8ff85200d421d80f0a00dea2112513de
-
Filesize
390KB
MD5c7a8ffa57419a6736a160af5744a7e39
SHA12ede66d97d534a6c01e338ce970144e565c3a52e
SHA25608530e3c7280478c097b3cd6f7182f9fcf11cf3cf84784a2daa7c5420d2184bf
SHA5125b42452998387bc1a722c0a41c00a3c6646a1e933e2202662d84195695af1a0fcfa10ed9723caac6e43bc2f2695374f917818d57bf02e121235d9711b465fbb0
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
52KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
960KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB