Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/03/2024, 13:04

General

  • Target

    e1bce9fa204b90eab1a70e1c10514877.exe

  • Size

    308KB

  • MD5

    e1bce9fa204b90eab1a70e1c10514877

  • SHA1

    b182cf33c30cd0051b36f1a6d2b10d94d60845dc

  • SHA256

    4ca293fe0a4d58ea5b5072eca47230527d1eb3eed176f85863063208fb3d641c

  • SHA512

    f3c00a7a510170231f6b0c3b62730aed124721adb6bf295bed17d4c00fbb3b89cd9dd6e212b87480498cddc0dd7557df0d8ce7ac4b2261e8804ec8368c383faa

  • SSDEEP

    6144:Yo890AlTPq3OVzGgTmPN72kYinMjIirxE2hGXRJWUqH07j1:YoUTC3OVGVPrYxjIwKJj7R

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 22 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe
    "C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe
      "C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"
      2⤵
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\winlogon.exe
        "C:\Windows\winlogon.exe" \melt "C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1376
        • C:\Windows\winlogon.exe
          "C:\Windows\winlogon.exe"
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:1992
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\winlogon.exe

    Filesize

    308KB

    MD5

    e1bce9fa204b90eab1a70e1c10514877

    SHA1

    b182cf33c30cd0051b36f1a6d2b10d94d60845dc

    SHA256

    4ca293fe0a4d58ea5b5072eca47230527d1eb3eed176f85863063208fb3d641c

    SHA512

    f3c00a7a510170231f6b0c3b62730aed124721adb6bf295bed17d4c00fbb3b89cd9dd6e212b87480498cddc0dd7557df0d8ce7ac4b2261e8804ec8368c383faa

  • memory/1376-26-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/1692-14-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1692-3-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1692-4-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1692-6-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1692-7-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1692-15-0x0000000001F60000-0x0000000001F6C000-memory.dmp

    Filesize

    48KB

  • memory/1692-18-0x0000000001F60000-0x0000000001F6C000-memory.dmp

    Filesize

    48KB

  • memory/1992-83-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/1992-89-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-31-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-79-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-80-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-99-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-84-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/1992-85-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-86-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-87-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-88-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-98-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-91-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-92-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-93-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-94-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-95-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-96-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1992-97-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2176-5-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/2176-0-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB