Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 13:04
Static task
static1
Behavioral task
behavioral1
Sample
e1bce9fa204b90eab1a70e1c10514877.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1bce9fa204b90eab1a70e1c10514877.exe
Resource
win10v2004-20240226-en
General
-
Target
e1bce9fa204b90eab1a70e1c10514877.exe
-
Size
308KB
-
MD5
e1bce9fa204b90eab1a70e1c10514877
-
SHA1
b182cf33c30cd0051b36f1a6d2b10d94d60845dc
-
SHA256
4ca293fe0a4d58ea5b5072eca47230527d1eb3eed176f85863063208fb3d641c
-
SHA512
f3c00a7a510170231f6b0c3b62730aed124721adb6bf295bed17d4c00fbb3b89cd9dd6e212b87480498cddc0dd7557df0d8ce7ac4b2261e8804ec8368c383faa
-
SSDEEP
6144:Yo890AlTPq3OVzGgTmPN72kYinMjIirxE2hGXRJWUqH07j1:YoUTC3OVGVPrYxjIwKJj7R
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe -
ModiLoader Second Stage 22 IoCs
resource yara_rule behavioral1/memory/1692-3-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1692-4-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1692-6-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1692-7-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1692-14-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-31-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-79-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-80-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-85-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-86-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-87-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-88-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-89-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-91-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-92-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-93-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-94-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-95-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-96-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-97-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-98-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1992-99-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
pid Process 1376 winlogon.exe 1992 winlogon.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Windows\\winlogon.exe" winlogon.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e1bce9fa204b90eab1a70e1c10514877.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winlogon.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2176 set thread context of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 1376 set thread context of 1992 1376 winlogon.exe 33 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\ntdtcstp.dll winlogon.exe File created C:\Windows\winlogon.exe e1bce9fa204b90eab1a70e1c10514877.exe File opened for modification C:\Windows\winlogon.exe e1bce9fa204b90eab1a70e1c10514877.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1692 e1bce9fa204b90eab1a70e1c10514877.exe Token: SeBackupPrivilege 2696 vssvc.exe Token: SeRestorePrivilege 2696 vssvc.exe Token: SeAuditPrivilege 2696 vssvc.exe Token: SeDebugPrivilege 1992 winlogon.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2176 e1bce9fa204b90eab1a70e1c10514877.exe 1376 winlogon.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 2176 wrote to memory of 1692 2176 e1bce9fa204b90eab1a70e1c10514877.exe 28 PID 1692 wrote to memory of 1376 1692 e1bce9fa204b90eab1a70e1c10514877.exe 32 PID 1692 wrote to memory of 1376 1692 e1bce9fa204b90eab1a70e1c10514877.exe 32 PID 1692 wrote to memory of 1376 1692 e1bce9fa204b90eab1a70e1c10514877.exe 32 PID 1692 wrote to memory of 1376 1692 e1bce9fa204b90eab1a70e1c10514877.exe 32 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 PID 1376 wrote to memory of 1992 1376 winlogon.exe 33 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winlogon.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"2⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\winlogon.exe"C:\Windows\winlogon.exe" \melt "C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\winlogon.exe"C:\Windows\winlogon.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1992
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308KB
MD5e1bce9fa204b90eab1a70e1c10514877
SHA1b182cf33c30cd0051b36f1a6d2b10d94d60845dc
SHA2564ca293fe0a4d58ea5b5072eca47230527d1eb3eed176f85863063208fb3d641c
SHA512f3c00a7a510170231f6b0c3b62730aed124721adb6bf295bed17d4c00fbb3b89cd9dd6e212b87480498cddc0dd7557df0d8ce7ac4b2261e8804ec8368c383faa