Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 01:51
Static task
static1
Behavioral task
behavioral1
Sample
02102024_0151_x.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
02102024_0151_x.exe
Resource
win10v2004-20240802-en
General
-
Target
02102024_0151_x.exe
-
Size
1.1MB
-
MD5
4ddb14680584c0546ccbc70b8d0411c4
-
SHA1
1ff45158480cc901c99079f02b82d4a40163be7a
-
SHA256
1d8968fc899fd0ccb7737c1019808f034eb86e7c55359681f7e51cf1982ba07e
-
SHA512
18542630cb735f45b0cf8bf9f7b64bcb6110dc21e94e83bd25007afc6a2677660ba46ff2c83c0c040c4bf8fb3d22f30089dee655822313f6d72b1f75fb8d2d4d
-
SSDEEP
24576:cBMP2iSAAicPschqrDG3oxxRa/hoKg97y4zuaRacKHT:cOP+wm3Aihg9XzuaRe
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral1/memory/1480-2-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-68-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-65-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-17-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-53-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-52-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-50-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-48-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-47-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-46-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-42-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-44-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-40-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-39-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-38-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-36-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-35-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-33-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-30-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-32-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-29-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-27-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-25-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-24-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-23-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-22-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-20-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-19-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-86-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-16-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-15-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-85-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-82-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-80-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-77-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-75-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-14-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-73-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-71-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-13-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-12-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-11-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-10-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-9-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-8-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-61-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-58-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-55-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-51-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-49-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-45-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-43-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-41-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-37-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-34-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-31-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-28-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-26-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-7-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-21-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 behavioral1/memory/1480-18-0x00000000034E0000-0x00000000044E0000-memory.dmp modiloader_stage2 -
Executes dropped EXE 10 IoCs
pid Process 2024 alpha.pif 1936 alpha.pif 616 alpha.pif 1296 xpha.pif 440 per.exe 1732 per.exe 1704 alpha.pif 1696 alpha.pif 2880 alpha.pif 1952 lxsyrsiW.pif -
Loads dropped DLL 6 IoCs
pid Process 2052 cmd.exe 2052 cmd.exe 2052 cmd.exe 616 alpha.pif 1480 02102024_0151_x.exe 1480 02102024_0151_x.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wisrysxl = "C:\\Users\\Public\\Wisrysxl.url" 02102024_0151_x.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 drive.google.com 4 drive.google.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1480 set thread context of 1952 1480 02102024_0151_x.exe 46 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02102024_0151_x.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1356 esentutl.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1480 wrote to memory of 2052 1480 02102024_0151_x.exe 31 PID 1480 wrote to memory of 2052 1480 02102024_0151_x.exe 31 PID 1480 wrote to memory of 2052 1480 02102024_0151_x.exe 31 PID 1480 wrote to memory of 2052 1480 02102024_0151_x.exe 31 PID 2052 wrote to memory of 1504 2052 cmd.exe 33 PID 2052 wrote to memory of 1504 2052 cmd.exe 33 PID 2052 wrote to memory of 1504 2052 cmd.exe 33 PID 2052 wrote to memory of 1504 2052 cmd.exe 33 PID 2052 wrote to memory of 1356 2052 cmd.exe 34 PID 2052 wrote to memory of 1356 2052 cmd.exe 34 PID 2052 wrote to memory of 1356 2052 cmd.exe 34 PID 2052 wrote to memory of 1356 2052 cmd.exe 34 PID 2052 wrote to memory of 2024 2052 cmd.exe 35 PID 2052 wrote to memory of 2024 2052 cmd.exe 35 PID 2052 wrote to memory of 2024 2052 cmd.exe 35 PID 2052 wrote to memory of 2024 2052 cmd.exe 35 PID 2052 wrote to memory of 1936 2052 cmd.exe 36 PID 2052 wrote to memory of 1936 2052 cmd.exe 36 PID 2052 wrote to memory of 1936 2052 cmd.exe 36 PID 2052 wrote to memory of 1936 2052 cmd.exe 36 PID 2052 wrote to memory of 616 2052 cmd.exe 37 PID 2052 wrote to memory of 616 2052 cmd.exe 37 PID 2052 wrote to memory of 616 2052 cmd.exe 37 PID 2052 wrote to memory of 616 2052 cmd.exe 37 PID 616 wrote to memory of 1296 616 alpha.pif 38 PID 616 wrote to memory of 1296 616 alpha.pif 38 PID 616 wrote to memory of 1296 616 alpha.pif 38 PID 616 wrote to memory of 1296 616 alpha.pif 38 PID 2052 wrote to memory of 1704 2052 cmd.exe 41 PID 2052 wrote to memory of 1704 2052 cmd.exe 41 PID 2052 wrote to memory of 1704 2052 cmd.exe 41 PID 2052 wrote to memory of 1704 2052 cmd.exe 41 PID 2052 wrote to memory of 1696 2052 cmd.exe 42 PID 2052 wrote to memory of 1696 2052 cmd.exe 42 PID 2052 wrote to memory of 1696 2052 cmd.exe 42 PID 2052 wrote to memory of 1696 2052 cmd.exe 42 PID 2052 wrote to memory of 2880 2052 cmd.exe 43 PID 2052 wrote to memory of 2880 2052 cmd.exe 43 PID 2052 wrote to memory of 2880 2052 cmd.exe 43 PID 2052 wrote to memory of 2880 2052 cmd.exe 43 PID 1480 wrote to memory of 1556 1480 02102024_0151_x.exe 44 PID 1480 wrote to memory of 1556 1480 02102024_0151_x.exe 44 PID 1480 wrote to memory of 1556 1480 02102024_0151_x.exe 44 PID 1480 wrote to memory of 1556 1480 02102024_0151_x.exe 44 PID 1480 wrote to memory of 1952 1480 02102024_0151_x.exe 46 PID 1480 wrote to memory of 1952 1480 02102024_0151_x.exe 46 PID 1480 wrote to memory of 1952 1480 02102024_0151_x.exe 46 PID 1480 wrote to memory of 1952 1480 02102024_0151_x.exe 46 PID 1480 wrote to memory of 1952 1480 02102024_0151_x.exe 46 PID 1480 wrote to memory of 1952 1480 02102024_0151_x.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\02102024_0151_x.exe"C:\Users\Admin\AppData\Local\Temp\02102024_0151_x.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Libraries\lxsyrsiW.cmd" "2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o3⤵PID:1504
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1356
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1936
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 103⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Public\xpha.pifC:\\Users\\Public\\xpha.pif 127.0.0.1 -n 104⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1296
-
-
-
C:\Windows \SysWOW64\per.exe"C:\\Windows \\SysWOW64\\per.exe3⤵
- Executes dropped EXE
PID:440
-
-
C:\Windows \SysWOW64\per.exe"C:\Windows \SysWOW64\per.exe"3⤵
- Executes dropped EXE
PID:1732
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1704
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW643⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1696
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880
-
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\02102024_0151_x.exe /d C:\\Users\\Public\\Libraries\\Wisrysxl.PIF /o2⤵PID:1556
-
-
C:\Users\Public\Libraries\lxsyrsiW.pifC:\Users\Public\Libraries\lxsyrsiW.pif2⤵
- Executes dropped EXE
PID:1952
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5b87f096cbc25570329e2bb59fee57580
SHA1d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA51272901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7
-
Filesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1
-
Filesize
15KB
MD56242e3d67787ccbf4e06ad2982853144
SHA16ac7947207d999a65890ab25fe344955da35028e
SHA2564ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d
SHA5127d0d457e1537d624119a8023bcc086575696a5739c0460ef11554afac13af5e5d1edc7629a10e62834aba9f1b3ab1442011b15b4c3930399d91dca34b3b1cbaf
-
Filesize
94KB
MD5869640d0a3f838694ab4dfea9e2f544d
SHA1bdc42b280446ba53624ff23f314aadb861566832
SHA2560db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
SHA5126e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7
-
Filesize
66KB
MD5c116d3604ceafe7057d77ff27552c215
SHA1452b14432fb5758b46f2897aeccd89f7c82a727d
SHA2567bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
SHA5129202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6