Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/12/2023, 10:10
General
-
Target
6632b98d005829a5de9f49459fec8cf9.exe
-
Size
2.3MB
-
MD5
6632b98d005829a5de9f49459fec8cf9
-
SHA1
cc23f7ebb188ede00ecafc1658addda75610027b
-
SHA256
e05926caf35a7b5ea9f0ea747a43b5b5645548440200f445b4374c0d0bf5c598
-
SHA512
3d70cde8ee64dbf0d0df10bca7ab45ad3f3b5ac0e25f7f30aadd7ffc4674380ec174b3b6149e6876df1ca703a40e2b18a53fc06f1f6d5e92a55f90bc1f2e8753
-
SSDEEP
49152:6AN9Ew2WfKWNVZZyTyr9cBc//////koTevDQ4hc//////nYIeI1:6ANW9GbyTyhcBc//////kHDjhc/////1
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6632b98d005829a5de9f49459fec8cf9.exe"C:\Users\Admin\AppData\Local\Temp\6632b98d005829a5de9f49459fec8cf9.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
475B
MD53d789700820b287d288bbf0ba1fed5fa
SHA15aeed2783cf4adaa261d58b54680df04683e6a1a
SHA25688b13dcb7cf3d1db49b81309cd1fe34e26530b65faa0801579cad2ed450e93c8
SHA5127318f25066adcae4ec90959f4fcf3c392a3cfdd15a0db1f65ad50f4256b0dded3969b95eea3a079c1ebbb28180f4b353ecf804ec006175be0afc40933fd69f50
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
4KB