Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 22:27
Behavioral task
behavioral1
Sample
54bfbe067c074db7fb5c9d90bccd8460.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
54bfbe067c074db7fb5c9d90bccd8460.exe
Resource
win10v2004-20231215-en
General
-
Target
54bfbe067c074db7fb5c9d90bccd8460.exe
-
Size
699KB
-
MD5
54bfbe067c074db7fb5c9d90bccd8460
-
SHA1
33e788fd7e190ac96650e1e75dbd7f6ea96b87e0
-
SHA256
867c85168812654c8ded87e802a0b3e220362d3b5822aef7ed9cc75be1961d79
-
SHA512
710bad26e6c862f39b9010f3d24e97eb0e0896dcb4c70f035bf7475937e744709be5c3d750b22ec818056c3ddf226a005912ebfb430fd235b2ef4d5b411b6d6d
-
SSDEEP
12288:dFUuKT63xR5kuzwb3cIgnVKbW3G2voAIYrqOAuaM+TW7vr8:3pD3xoukcIajfvxdeuaM+TW7T8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/memory/1720-6-0x0000000000400000-0x00000000004C0000-memory.dmp modiloader_stage2 behavioral1/memory/1620-8-0x0000000000400000-0x00000000004C0000-memory.dmp modiloader_stage2 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1620 set thread context of 1720 1620 54bfbe067c074db7fb5c9d90bccd8460.exe 28 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt 54bfbe067c074db7fb5c9d90bccd8460.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1720 1620 54bfbe067c074db7fb5c9d90bccd8460.exe 28 PID 1620 wrote to memory of 1720 1620 54bfbe067c074db7fb5c9d90bccd8460.exe 28 PID 1620 wrote to memory of 1720 1620 54bfbe067c074db7fb5c9d90bccd8460.exe 28 PID 1620 wrote to memory of 1720 1620 54bfbe067c074db7fb5c9d90bccd8460.exe 28 PID 1620 wrote to memory of 1720 1620 54bfbe067c074db7fb5c9d90bccd8460.exe 28 PID 1620 wrote to memory of 1720 1620 54bfbe067c074db7fb5c9d90bccd8460.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\54bfbe067c074db7fb5c9d90bccd8460.exe"C:\Users\Admin\AppData\Local\Temp\54bfbe067c074db7fb5c9d90bccd8460.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\system32\mstsc.exe"2⤵PID:1720
-