Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2023, 23:00

General

  • Target

    fe7e6ab79f347ca092fcfd4c0c349dca.exe

  • Size

    651KB

  • MD5

    fe7e6ab79f347ca092fcfd4c0c349dca

  • SHA1

    e14d383c51074bd6073ae30f08306ebf10eaf27a

  • SHA256

    22c0b06fc10fcc0244ca749e3ed55fcb3f6858178a5800a8cb98fd5ff28a0f02

  • SHA512

    2cf78f968330ab6bbfc1dc7d4afb2dfde2dbfc48273bb95c8f5cc00c167e149bec5119073311dbc9b1c3ca94ee19df624c160229f27c3a21ba0fa4303e0c5341

  • SSDEEP

    12288:kpyZT1lrCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx1ljOD3SxcDDcNDqWYurL0

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • ModiLoader Second Stage 15 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 18 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 52 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exe
    "C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\fe7e6ab79f347ca092fcfd4c0c349dca.exe
      fe7e6ab79f347ca092fcfd4c0c349dca.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Users\Admin\dHY4IvP3.exe
        C:\Users\Admin\dHY4IvP3.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del dHY4IvP3.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2712
        • C:\Users\Admin\hiiemih.exe
          "C:\Users\Admin\hiiemih.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2816
      • C:\Users\Admin\azhost.exe
        C:\Users\Admin\azhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Users\Admin\azhost.exe
          azhost.exe
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1532
      • C:\Users\Admin\bzhost.exe
        C:\Users\Admin\bzhost.exe
        3⤵
        • Executes dropped EXE
        PID:2944
      • C:\Users\Admin\czhost.exe
        C:\Users\Admin\czhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2316
        • C:\Users\Admin\czhost.exe
          czhost.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2288
      • C:\Users\Admin\dzhost.exe
        C:\Users\Admin\dzhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2004
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
            PID:1456
        • C:\Users\Admin\ezhost.exe
          C:\Users\Admin\ezhost.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1164
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del fe7e6ab79f347ca092fcfd4c0c349dca.exe
          3⤵
          • Deletes itself
          PID:2024
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:668
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs
      1⤵
        PID:876
        • C:\Windows\system32\wbem\WMIADAP.EXE
          wmiadap.exe /F /T /R
          2⤵
            PID:2332
        • C:\Windows\system32\csrss.exe
          %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
          1⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • Suspicious use of UnmapMainImage
          PID:336
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          1⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2812
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 88
          1⤵
          • Loads dropped DLL
          • Program crash
          PID:1988
        • C:\Windows\system32\wbem\wmiprvse.exe
          C:\Windows\system32\wbem\wmiprvse.exe -Embedding
          1⤵
            PID:3068

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\azhost.exe

            Filesize

            248KB

            MD5

            27ef898ce7ec9c0b79a6996a0b419de1

            SHA1

            4e8aed756fbc6133af13028c33366d2eaa43f954

            SHA256

            f08df8dd8e3fe3de4a1ba4ba3bd355a233cf7febd5917b982ec5a949726c36a6

            SHA512

            5c7fa67e7ed1e8ce238e58f0b55618d1fc13af4e19d9267f6e88e277beb2f10e6c0f0027a532a2d1d4b6e40da1b31dfcacf50ccb71a75dc231ff876869b6787a

          • C:\Users\Admin\dzhost.exe

            Filesize

            3KB

            MD5

            bf443ad3602f739cff0761735af0fba6

            SHA1

            63788512c02ef7c9a256fa869c1f1c45b7a364ad

            SHA256

            a86b9cada68d7c8a66cb54cc057c64cda216fd898330a5da2324539bbbfbcd26

            SHA512

            285fe01c816646661531f323653c4a1d58d39c45d94a022e79f809fdde9b3cbd686167f002fc6acc850059d65f237e5b7bd0fcc43aba70ce1522a895371220d6

          • \??\globalroot\systemroot\assembly\temp\@

            Filesize

            2KB

            MD5

            075e642a0ed6ab1c7f3fbf781f5c9b3b

            SHA1

            f0684fd9f749007b88ee523832092db2bbb945c9

            SHA256

            d183cb535895325015c5420ac097b829d7781cd1e9167b899df2bbd48bee8abd

            SHA512

            a689f620533c90521c406d60ab9408c7a0983e3a70697c9c731abd81e2cd361315c1398d5ac30128d29678b4c47cd252e79e83f3fe94de7935371ef63df67aa1

          • \Users\Admin\czhost.exe

            Filesize

            96KB

            MD5

            fb7e8882346223dfbad778b5a7f74f32

            SHA1

            8285032fbab2f9f52533657d46df457ab64d0e15

            SHA256

            6d6fa60b26cd2fc87c94afb20e7f3b35d6eca76d5a46191b8df802d30d4cbc3e

            SHA512

            31e3963dd156da4a57b3ffd37b857ee1d433c61dc22eb56356f2171b282f3735a1c31d65b3a0b431151b55bfebf964f82c5aa13a12f1c2a8a580840a7ea5da32

          • \Users\Admin\czhost.exe

            Filesize

            64KB

            MD5

            f1e45295dc0a7c93694c4144ae9da6af

            SHA1

            d08f17bcce31eebfc1ff804515cd038a0570ae68

            SHA256

            9e0afe0ac8f438913a9de0f3efb6027777f27b5522dc648c9933b43c26dbd468

            SHA512

            0e927f12a5a5a2e16b4b632e321dc695064b4502fd695f6d8d5390626c4c20705091206cb8650503abdc55c12a760e17d7dbb589bf34c4f75479afc309f1ea38

          • \Users\Admin\dzhost.exe

            Filesize

            221KB

            MD5

            5b414fb77d0dbec97ee529ec0bbcbeaf

            SHA1

            359cd24cd341f75eb46b99375824f6b649443f8e

            SHA256

            62027b13d4918e5e644952c977960a5e6dfe241e2bb35b387de0bfd0b752e882

            SHA512

            887b1b93e51d21927ffba49536f281003eef1dbee7634a08cab256f07701d54fe755acab7ae4a513c754067e4144c44c3580689ce187fd584ba440ab748a2360

          • \Users\Admin\hiiemih.exe

            Filesize

            288KB

            MD5

            24b65d3bfefa977fc57ee2f5c4a4a7f7

            SHA1

            098f1c85067be307ec2dc26a8efe35a5580c67ce

            SHA256

            7da4220af5b9d6527988ccf80d66ccb13dac6a11ed0bfc114d23739d80a47a4b

            SHA512

            690963d7321f9471a8d579cc2fddac562ab790cf1b635079bfca1f4264111aa7aecaeaa0d75462bd018aa3ec4d472075a6156132cd73ded5fc9c77794a4021b4

          • memory/336-161-0x0000000000E50000-0x0000000000E62000-memory.dmp

            Filesize

            72KB

          • memory/336-158-0x0000000000E40000-0x0000000000E41000-memory.dmp

            Filesize

            4KB

          • memory/336-186-0x0000000000E40000-0x0000000000E41000-memory.dmp

            Filesize

            4KB

          • memory/876-212-0x0000000000BA0000-0x0000000000BA8000-memory.dmp

            Filesize

            32KB

          • memory/876-220-0x0000000000BC0000-0x0000000000BCB000-memory.dmp

            Filesize

            44KB

          • memory/876-228-0x0000000000BC0000-0x0000000000BCB000-memory.dmp

            Filesize

            44KB

          • memory/1532-58-0x0000000000400000-0x0000000000437000-memory.dmp

            Filesize

            220KB

          • memory/1532-68-0x0000000000400000-0x0000000000437000-memory.dmp

            Filesize

            220KB

          • memory/1532-60-0x0000000000400000-0x0000000000437000-memory.dmp

            Filesize

            220KB

          • memory/1532-53-0x0000000000400000-0x0000000000437000-memory.dmp

            Filesize

            220KB

          • memory/1532-51-0x0000000000400000-0x0000000000437000-memory.dmp

            Filesize

            220KB

          • memory/1532-62-0x0000000000400000-0x0000000000437000-memory.dmp

            Filesize

            220KB

          • memory/1532-55-0x0000000000400000-0x0000000000437000-memory.dmp

            Filesize

            220KB

          • memory/1532-78-0x0000000000400000-0x0000000000437000-memory.dmp

            Filesize

            220KB

          • memory/2004-152-0x0000000000474000-0x0000000000475000-memory.dmp

            Filesize

            4KB

          • memory/2004-129-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

          • memory/2004-166-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

          • memory/2004-167-0x00000000003B0000-0x00000000003F5000-memory.dmp

            Filesize

            276KB

          • memory/2004-168-0x0000000000470000-0x00000000004B5000-memory.dmp

            Filesize

            276KB

          • memory/2004-127-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

          • memory/2004-130-0x0000000000220000-0x0000000000284000-memory.dmp

            Filesize

            400KB

          • memory/2004-154-0x00000000003B0000-0x00000000003F5000-memory.dmp

            Filesize

            276KB

          • memory/2004-150-0x0000000000470000-0x00000000004B5000-memory.dmp

            Filesize

            276KB

          • memory/2004-147-0x00000000003B0000-0x00000000003F5000-memory.dmp

            Filesize

            276KB

          • memory/2004-131-0x0000000000224000-0x0000000000225000-memory.dmp

            Filesize

            4KB

          • memory/2004-132-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

          • memory/2004-133-0x00000000003B0000-0x00000000003F5000-memory.dmp

            Filesize

            276KB

          • memory/2004-145-0x00000000003B0000-0x00000000003F5000-memory.dmp

            Filesize

            276KB

          • memory/2004-144-0x00000000003B0000-0x00000000003F5000-memory.dmp

            Filesize

            276KB

          • memory/2004-140-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

          • memory/2004-128-0x0000000000400000-0x0000000000464000-memory.dmp

            Filesize

            400KB

          • memory/2004-137-0x00000000003B0000-0x00000000003F5000-memory.dmp

            Filesize

            276KB

          • memory/2036-126-0x0000000000580000-0x00000000005E4000-memory.dmp

            Filesize

            400KB

          • memory/2036-12-0x0000000000400000-0x0000000000507000-memory.dmp

            Filesize

            1.0MB

          • memory/2036-193-0x0000000000400000-0x0000000000507000-memory.dmp

            Filesize

            1.0MB

          • memory/2036-2-0x0000000000400000-0x0000000000507000-memory.dmp

            Filesize

            1.0MB

          • memory/2036-11-0x0000000000400000-0x0000000000507000-memory.dmp

            Filesize

            1.0MB

          • memory/2036-5-0x0000000000400000-0x0000000000507000-memory.dmp

            Filesize

            1.0MB

          • memory/2036-3-0x0000000000400000-0x0000000000507000-memory.dmp

            Filesize

            1.0MB

          • memory/2036-13-0x0000000000400000-0x0000000000507000-memory.dmp

            Filesize

            1.0MB

          • memory/2036-125-0x0000000000580000-0x00000000005E4000-memory.dmp

            Filesize

            400KB

          • memory/2036-77-0x0000000000400000-0x0000000000507000-memory.dmp

            Filesize

            1.0MB

          • memory/2036-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2036-0-0x0000000000400000-0x0000000000507000-memory.dmp

            Filesize

            1.0MB

          • memory/2288-98-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2288-113-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2288-103-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2288-112-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2288-111-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2288-100-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2288-96-0x0000000000400000-0x000000000040E000-memory.dmp

            Filesize

            56KB

          • memory/2316-109-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2500-9-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

          • memory/2748-42-0x0000000003D30000-0x00000000047EA000-memory.dmp

            Filesize

            10.7MB

          • memory/2808-67-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2944-86-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2944-80-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/2944-83-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB