Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 13:04
Static task
static1
Behavioral task
behavioral1
Sample
e1bce9fa204b90eab1a70e1c10514877.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1bce9fa204b90eab1a70e1c10514877.exe
Resource
win10v2004-20240226-en
General
-
Target
e1bce9fa204b90eab1a70e1c10514877.exe
-
Size
308KB
-
MD5
e1bce9fa204b90eab1a70e1c10514877
-
SHA1
b182cf33c30cd0051b36f1a6d2b10d94d60845dc
-
SHA256
4ca293fe0a4d58ea5b5072eca47230527d1eb3eed176f85863063208fb3d641c
-
SHA512
f3c00a7a510170231f6b0c3b62730aed124721adb6bf295bed17d4c00fbb3b89cd9dd6e212b87480498cddc0dd7557df0d8ce7ac4b2261e8804ec8368c383faa
-
SSDEEP
6144:Yo890AlTPq3OVzGgTmPN72kYinMjIirxE2hGXRJWUqH07j1:YoUTC3OVGVPrYxjIwKJj7R
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
resource yara_rule behavioral2/memory/4080-3-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4080-4-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4080-6-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4080-7-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/4080-19-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation e1bce9fa204b90eab1a70e1c10514877.exe -
Executes dropped EXE 1 IoCs
pid Process 2880 winlogon.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e1bce9fa204b90eab1a70e1c10514877.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3348 set thread context of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\winlogon.exe e1bce9fa204b90eab1a70e1c10514877.exe File opened for modification C:\Windows\winlogon.exe e1bce9fa204b90eab1a70e1c10514877.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4908 2880 WerFault.exe 95 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4080 e1bce9fa204b90eab1a70e1c10514877.exe Token: SeBackupPrivilege 5056 vssvc.exe Token: SeRestorePrivilege 5056 vssvc.exe Token: SeAuditPrivilege 5056 vssvc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3348 e1bce9fa204b90eab1a70e1c10514877.exe 2880 winlogon.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 3348 wrote to memory of 4080 3348 e1bce9fa204b90eab1a70e1c10514877.exe 88 PID 4080 wrote to memory of 2880 4080 e1bce9fa204b90eab1a70e1c10514877.exe 95 PID 4080 wrote to memory of 2880 4080 e1bce9fa204b90eab1a70e1c10514877.exe 95 PID 4080 wrote to memory of 2880 4080 e1bce9fa204b90eab1a70e1c10514877.exe 95 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\winlogon.exe"C:\Windows\winlogon.exe" \melt "C:\Users\Admin\AppData\Local\Temp\e1bce9fa204b90eab1a70e1c10514877.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 4684⤵
- Program crash
PID:4908
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2880 -ip 28801⤵PID:744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308KB
MD5e1bce9fa204b90eab1a70e1c10514877
SHA1b182cf33c30cd0051b36f1a6d2b10d94d60845dc
SHA2564ca293fe0a4d58ea5b5072eca47230527d1eb3eed176f85863063208fb3d641c
SHA512f3c00a7a510170231f6b0c3b62730aed124721adb6bf295bed17d4c00fbb3b89cd9dd6e212b87480498cddc0dd7557df0d8ce7ac4b2261e8804ec8368c383faa