Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 21:07
Behavioral task
behavioral1
Sample
979ae583b77ae8fbc18e0fd89a99797a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
979ae583b77ae8fbc18e0fd89a99797a.exe
Resource
win10v2004-20231215-en
General
-
Target
979ae583b77ae8fbc18e0fd89a99797a.exe
-
Size
86KB
-
MD5
979ae583b77ae8fbc18e0fd89a99797a
-
SHA1
7a9ca180e512ec592856cf1504eff119bd59b688
-
SHA256
69842ae5476580141b1a027761845cdb5a47d5b00d88825b7af57077f6d7112b
-
SHA512
caa1ca2b25c9cfbd34d6c64a7c4e3bcead41d5f625221664ec9a797d3b144016eb700c8fdc913ae66bdb9153bedd95debb3060171b4524ea7082d368df0357ec
-
SSDEEP
1536:scHA5dZuvrKA1r4Jwwi55dlvo89UBYKpJ0pHWG7m9pAsiyRsUuh8iO70Lt:scg7UrKqUwflAZYKX6aAsiyunQO
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 17 IoCs
resource yara_rule behavioral1/memory/2972-12-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2372-9-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-14-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-15-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-16-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-17-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-18-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-19-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-20-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-21-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-22-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-23-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-24-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-25-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-26-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-27-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 behavioral1/memory/2972-28-0x0000000000400000-0x000000000043A000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2972 msmgrs.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntdll.lnk msmgrs.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntdll.lnk msmgrs.exe -
Executes dropped EXE 1 IoCs
pid Process 2972 msmgrs.exe -
Loads dropped DLL 2 IoCs
pid Process 2372 979ae583b77ae8fbc18e0fd89a99797a.exe 2372 979ae583b77ae8fbc18e0fd89a99797a.exe -
resource yara_rule behavioral1/memory/2372-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000a00000001329e-3.dat upx behavioral1/memory/2972-12-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2372-9-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-14-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-15-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-16-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-17-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-18-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-19-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-20-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-21-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-22-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-23-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-24-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-25-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-26-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-27-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2972-28-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\wins\setup\msmgrs.exe 979ae583b77ae8fbc18e0fd89a99797a.exe File opened for modification C:\Windows\SysWOW64\wins\setup\msmgrs.exe 979ae583b77ae8fbc18e0fd89a99797a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2372 979ae583b77ae8fbc18e0fd89a99797a.exe 2372 979ae583b77ae8fbc18e0fd89a99797a.exe 2972 msmgrs.exe 2972 msmgrs.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2972 2372 979ae583b77ae8fbc18e0fd89a99797a.exe 28 PID 2372 wrote to memory of 2972 2372 979ae583b77ae8fbc18e0fd89a99797a.exe 28 PID 2372 wrote to memory of 2972 2372 979ae583b77ae8fbc18e0fd89a99797a.exe 28 PID 2372 wrote to memory of 2972 2372 979ae583b77ae8fbc18e0fd89a99797a.exe 28 PID 2972 wrote to memory of 2840 2972 msmgrs.exe 29 PID 2972 wrote to memory of 2840 2972 msmgrs.exe 29 PID 2972 wrote to memory of 2840 2972 msmgrs.exe 29 PID 2972 wrote to memory of 2840 2972 msmgrs.exe 29 PID 2972 wrote to memory of 2556 2972 msmgrs.exe 30 PID 2972 wrote to memory of 2556 2972 msmgrs.exe 30 PID 2972 wrote to memory of 2556 2972 msmgrs.exe 30 PID 2972 wrote to memory of 2556 2972 msmgrs.exe 30 PID 2556 wrote to memory of 2864 2556 cmd.exe 33 PID 2556 wrote to memory of 2864 2556 cmd.exe 33 PID 2556 wrote to memory of 2864 2556 cmd.exe 33 PID 2556 wrote to memory of 2864 2556 cmd.exe 33 PID 2556 wrote to memory of 2864 2556 cmd.exe 33 PID 2556 wrote to memory of 2864 2556 cmd.exe 33 PID 2556 wrote to memory of 2864 2556 cmd.exe 33 PID 2840 wrote to memory of 2600 2840 cmd.exe 34 PID 2840 wrote to memory of 2600 2840 cmd.exe 34 PID 2840 wrote to memory of 2600 2840 cmd.exe 34 PID 2840 wrote to memory of 2600 2840 cmd.exe 34 PID 2840 wrote to memory of 2600 2840 cmd.exe 34 PID 2840 wrote to memory of 2600 2840 cmd.exe 34 PID 2840 wrote to memory of 2600 2840 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\979ae583b77ae8fbc18e0fd89a99797a.exe"C:\Users\Admin\AppData\Local\Temp\979ae583b77ae8fbc18e0fd89a99797a.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\wins\setup\msmgrs.exe"C:\Windows\system32\wins\setup\msmgrs.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/JaguarEditControl.dll3⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/JaguarEditControl.dll4⤵PID:2600
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe + command.com /c regsvr32 /u /s %WINDIR%/"Downloaded Program Files"/tebedit.ocx3⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows/"Downloaded Program Files"/tebedit.ocx4⤵PID:2864
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5979ae583b77ae8fbc18e0fd89a99797a
SHA17a9ca180e512ec592856cf1504eff119bd59b688
SHA25669842ae5476580141b1a027761845cdb5a47d5b00d88825b7af57077f6d7112b
SHA512caa1ca2b25c9cfbd34d6c64a7c4e3bcead41d5f625221664ec9a797d3b144016eb700c8fdc913ae66bdb9153bedd95debb3060171b4524ea7082d368df0357ec