Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 22:55
Static task
static1
Behavioral task
behavioral1
Sample
1f1d348153db601b03af017745a5a0a1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1f1d348153db601b03af017745a5a0a1.exe
Resource
win10v2004-20231215-en
General
-
Target
1f1d348153db601b03af017745a5a0a1.exe
-
Size
290KB
-
MD5
1f1d348153db601b03af017745a5a0a1
-
SHA1
dc80dfd810ff88b3acb011f6cb4b7a269441beb5
-
SHA256
d118deba30379041074abca2dca83f00e02940ef1309a6a8153c9e68c4cf40ef
-
SHA512
690b610245bfd0d5415c670b0813c04ea819054e52711a1beba440f7cb600c763f717e745920406e4fa784e3562f7411d1661a4cf04995623eb82fc487fd6dc5
-
SSDEEP
6144:n0J+kIyh66vNZoHhzWES2GBTrn2BNs/FjSocEC5qbcHyhQcrEzRLa:0JBIeNIWQG5n2BNAj2Z5qbuSQcA1a
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
resource yara_rule behavioral1/memory/1144-13-0x0000000000400000-0x000000000054A000-memory.dmp modiloader_stage2 behavioral1/memory/768-21-0x0000000000400000-0x000000000054A000-memory.dmp modiloader_stage2 behavioral1/memory/1144-23-0x0000000000400000-0x000000000054A000-memory.dmp modiloader_stage2 behavioral1/memory/768-31-0x0000000000400000-0x000000000054A000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 3016 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1144 360Safe.exe -
Loads dropped DLL 7 IoCs
pid Process 768 1f1d348153db601b03af017745a5a0a1.exe 768 1f1d348153db601b03af017745a5a0a1.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe 2856 WerFault.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe 1f1d348153db601b03af017745a5a0a1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe 1f1d348153db601b03af017745a5a0a1.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat 1f1d348153db601b03af017745a5a0a1.exe -
Program crash 1 IoCs
pid pid_target Process 2856 1144 WerFault.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 768 wrote to memory of 1144 768 1f1d348153db601b03af017745a5a0a1.exe 29 PID 768 wrote to memory of 1144 768 1f1d348153db601b03af017745a5a0a1.exe 29 PID 768 wrote to memory of 1144 768 1f1d348153db601b03af017745a5a0a1.exe 29 PID 768 wrote to memory of 1144 768 1f1d348153db601b03af017745a5a0a1.exe 29 PID 1144 wrote to memory of 2856 1144 360Safe.exe 28 PID 1144 wrote to memory of 2856 1144 360Safe.exe 28 PID 1144 wrote to memory of 2856 1144 360Safe.exe 28 PID 1144 wrote to memory of 2856 1144 360Safe.exe 28 PID 768 wrote to memory of 3016 768 1f1d348153db601b03af017745a5a0a1.exe 32 PID 768 wrote to memory of 3016 768 1f1d348153db601b03af017745a5a0a1.exe 32 PID 768 wrote to memory of 3016 768 1f1d348153db601b03af017745a5a0a1.exe 32 PID 768 wrote to memory of 3016 768 1f1d348153db601b03af017745a5a0a1.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f1d348153db601b03af017745a5a0a1.exe"C:\Users\Admin\AppData\Local\Temp\1f1d348153db601b03af017745a5a0a1.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe"C:\Program Files\Common Files\Microsoft Shared\MSINFO\360Safe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat""2⤵
- Deletes itself
PID:3016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 2921⤵
- Loads dropped DLL
- Program crash
PID:2856