Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06/03/2024, 10:28
General
-
Target
b731c27418414867d0eb3a5d75a22e06.exe
-
Size
395KB
-
MD5
b731c27418414867d0eb3a5d75a22e06
-
SHA1
13b3badeada7bba0f332372523e0469422b4f215
-
SHA256
b5bd429e0a66a4f42d713adca86b44ba18cb910c963f3f9ec436b9e51e708ae3
-
SHA512
578eab0a919a1445a25eeb5c6a8fc511e3b356b6301415277f65abc65646d28adc6e6efff0dca87eba0be472ce834f0cbef4b0a1412e24debdd6ad5a11305af3
-
SSDEEP
12288:m2b8N1fa9nJXl2LWE90c5ALz9oQpkqNJ+Q0iPkOS:mKE1S9X2VOynaJ+QDvS
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b731c27418414867d0eb3a5d75a22e06.exe"C:\Users\Admin\AppData\Local\Temp\b731c27418414867d0eb3a5d75a22e06.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 3962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2676 -ip 26761⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
855KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
855KB