Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

a297af323f...6b.exe

windows7-x64

10

a297af323f...6b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2024, 13:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a297af323f6f088bfd429e16f2e42c0c5781d1456c7a7fbb36fd66b2e810e26b.exe

  • Size

    999KB

  • MD5

    cc51809989809e6f161ebe95b9c409c4

  • SHA1

    a15d2a28d813c0ee017c2dcca2f89297d9165c23

  • SHA256

    a297af323f6f088bfd429e16f2e42c0c5781d1456c7a7fbb36fd66b2e810e26b

  • SHA512

    77c548562f57093220483507845440b7b6b33f266154e7b8d3c9b593a58bd1dd43345f328ba15a9ab0133648cf843c70cee602c18e1aa27520f4bb521af77eb1

  • SSDEEP

    24576:YN/BUBb+tYjBFHryjPrjrjhtXRfktHs5BzdUOMYyS:cpUlRhcDjrjhtXRMOOS

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modiloader family
    modiloader
  • ModiLoader Second Stage 3 IoCs
  • Executes dropped EXE 3 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
    defense_evasion
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a297af323f6f088bfd429e16f2e42c0c5781d1456c7a7fbb36fd66b2e810e26b.exe
    "C:\Users\Admin\AppData\Local\Temp\a297af323f6f088bfd429e16f2e42c0c5781d1456c7a7fbb36fd66b2e810e26b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\cmd.cmd" "
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Users\Admin\AppData\Local\Temp\lolowkdwqadaefdfasdffsd.exe
        lolowkdwqadaefdfasdffsd.exe -p132
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2300
        • C:\Users\Admin\AppData\Local\Temp\lol1.exe
          "C:\Users\Admin\AppData\Local\Temp\lol1.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2540
          • C:\Users\Admin\AppData\Local\Temp\lol.exe
            "C:\Users\Admin\AppData\Local\Temp\lol.exe"
            5⤵
            • Executes dropped EXE
            • Impair Defenses: Safe Mode Boot
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            PID:2968
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:2060

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\cmd.cmd
      Filesize

      39B

      MD5

      4b9d51163be5a8f47b0120239c50443a

      SHA1

      078be1bb76cd2e50f6602fa4376456203045ff6c

      SHA256

      a79443eb354257843d2b03450e1363c6a792c2c0cadde1e2a4258861ca74d876

      SHA512

      b7e4b42310d957550641460663135107c9edebc937172be625425dad0c3c4398fb2d9a80e60cdc825acab08e29b5fdcc0ba69d95ab3c93778b8ecd70139839a2

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\lol1.exe
      Filesize

      521KB

      MD5

      6b5c0770e74e8449b50dac816eff2702

      SHA1

      a5a569f3365ad017a88629d984d3626f48b3df83

      SHA256

      3fea9d4dee2f892d5d21b6df7141f149ad772e5d10827f3d15255f6a53fd50dc

      SHA512

      33631d2434130556de3f8d2b6cba3af43e8f0d2a9648385f0ac3d3aa0098f43c75662e5c8efb57d05b2ba16dab9e171958dd6e23b1f189d9a4b644e853765a7d

      Download Submit

    • \Users\Admin\AppData\Local\Temp\lol.exe
      Filesize

      397KB

      MD5

      61fc1593c52193d1dad618118d1a2755

      SHA1

      3a170a48de81b9ca4b96f7204806857123925b85

      SHA256

      155998a2d38712697799ead332b6022df6f5e057242b5bc0f31134d38a4716b5

      SHA512

      ffd876a23388f693a62c8cbbb903b659fc36be8da704a66a4be8db26b7d8f7387ed7a7d824c96c0c3242104f93d12d4665e6aecafb8b7f686f73b26a0749d292

      Download Submit

    • \Users\Admin\AppData\Local\Temp\lolowkdwqadaefdfasdffsd.exe
      Filesize

      704KB

      MD5

      3b5d0257561b76baa84d00a3589c6fc8

      SHA1

      3ec6384ba63f15e916510c8f2852e3509c8732b0

      SHA256

      0b770d7e3a29f9a20542ef42be88decb17962022f5303b075ae4b12c53f711dc

      SHA512

      0a3761456990956ddb905b981b0053a86f47acf61d6fc2b5d2fb4c3b7b711125c457ae7234ffbc1e9329b0b1c0db234a08454af642892e802d3d096a5e6ffcc3

      Download Submit

    • memory/2968-49-0x0000000000400000-0x000000000046A000-memory.dmp

      Filesize

      424KB

      Download

    • memory/2968-50-0x0000000000400000-0x000000000046A000-memory.dmp

      Filesize

      424KB

      Download