Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
e1bce9fa204b90eab1a70e1c10514877
-
Size
308KB
-
Sample
240327-qa5desfg9z
-
MD5
e1bce9fa204b90eab1a70e1c10514877
-
SHA1
b182cf33c30cd0051b36f1a6d2b10d94d60845dc
-
SHA256
4ca293fe0a4d58ea5b5072eca47230527d1eb3eed176f85863063208fb3d641c
-
SHA512
f3c00a7a510170231f6b0c3b62730aed124721adb6bf295bed17d4c00fbb3b89cd9dd6e212b87480498cddc0dd7557df0d8ce7ac4b2261e8804ec8368c383faa
-
SSDEEP
6144:Yo890AlTPq3OVzGgTmPN72kYinMjIirxE2hGXRJWUqH07j1:YoUTC3OVGVPrYxjIwKJj7R
Static task
static1
Behavioral task
behavioral1
Sample
e1bce9fa204b90eab1a70e1c10514877.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1bce9fa204b90eab1a70e1c10514877.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
e1bce9fa204b90eab1a70e1c10514877
-
Size
308KB
-
MD5
e1bce9fa204b90eab1a70e1c10514877
-
SHA1
b182cf33c30cd0051b36f1a6d2b10d94d60845dc
-
SHA256
4ca293fe0a4d58ea5b5072eca47230527d1eb3eed176f85863063208fb3d641c
-
SHA512
f3c00a7a510170231f6b0c3b62730aed124721adb6bf295bed17d4c00fbb3b89cd9dd6e212b87480498cddc0dd7557df0d8ce7ac4b2261e8804ec8368c383faa
-
SSDEEP
6144:Yo890AlTPq3OVzGgTmPN72kYinMjIirxE2hGXRJWUqH07j1:YoUTC3OVGVPrYxjIwKJj7R
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1