Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
04/01/2024, 18:43
General
-
Target
modio-5-3-en-win (1).exe
-
Size
1.9MB
-
MD5
abc04b6edd6bef467f2da78912dcabbd
-
SHA1
3be94b55305b5061b24f5e80f09a8afbb6b44ad0
-
SHA256
c2d32b65e9e9516c2653c0ac88c975a61b9bedb694c44ff70ca01f7b5ba34bbc
-
SHA512
560455ff55e3b5b149a31ebcd33da825e875b26854ca77d4ddae062beb458a39bdd62c5a5ca13f31a21404a3f4ad7deb6c4b9fffa8ab980bcd4f1ecc2f5af5e0
-
SSDEEP
49152:i9J8Leica8VrwjQBFd0Ds1FVx0nwt56Edvca:shivz4FdfZxewpN
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\modio-5-3-en-win (1).exe"C:\Users\Admin\AppData\Local\Temp\modio-5-3-en-win (1).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0G3UA.tmp\modio-5-3-en-win (1).tmp"C:\Users\Admin\AppData\Local\Temp\is-0G3UA.tmp\modio-5-3-en-win (1).tmp" /SL5="$80064,1745570,424960,C:\Users\Admin\AppData\Local\Temp\modio-5-3-en-win (1).exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Modio 5\Modio.exe"C:\Program Files (x86)\Modio 5\Modio.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5b9c7a8de1df01cbe9d74cd41b225cd9f
SHA1b5dbe7fa7e6b28068786f437fe72244d0874e33c
SHA256b20d97f8cd6d4f0499055e79ba826dfbbd75c646a5b73fc6648512b8d6527d7f
SHA512ed04a03a4e458b0063aa390a229a229f325436d1e8334c361237847490029e87dfbd2f81d067b7526d6934dbdd00825fba3b5a84e105223691a437ead3b57a12
-
Filesize
1.4MB
MD578076ba56d3e07c5f8417fde3c4d1637
SHA1d112820f8bae96732ae6f4c249402b5995fa4d76
SHA256d7984f704b27b636d5b09249f258c92ea5a29d58ecbcfc13e62dc6d3f9d7780e
SHA512d008c54036f43f7969c0898f3788b83f23fe2cd77e7ee6c939f1938683a9ee4f2a76914805fb9eb49c4c2fa62d1e5c01f5e8ff6d3301c806ce38107c115cdeff
-
Filesize
787KB
MD5c31e5a46f97b561942b53dab5d16bb29
SHA12a7445c9bf257645f626d5444857ac4b46499677
SHA2564bba4c246f4c2f59c76b2135149998f8a96fce7cceae945fb68903e086670110
SHA512906d34ae3d39ae0ca1e85cf6ffbcea386d72306ace19992be192bfde707ce8a56f9fcc334cb5f3e9c3a0504362d54d83c2466dd88716b1549b98bf861c1de018
-
Filesize
92KB
MD541a95a385fe271ffd50df5591f3076a0
SHA1e37484c43c23adf2a3548c044abf4f35fe7a65ec
SHA25639882cf0c653e9f702895380e793a7572be93dd3f03afb972e81a14a4e941b15
SHA51244c6e3eb90e508643b901d327b63a22d4ef2ed670b25231860abf815d146fc240444f3f926894ffecd85c4247aafc27106e63134536cf52f7693eefdec3f437e
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
2.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
344KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB