Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05/12/2024, 05:06
General
-
Target
top flash to video.exe
-
Size
1.6MB
-
MD5
2aa4d2caa73ed5160cc34fba921236c1
-
SHA1
022d065ddb70ffa3bba898e183179772d7c484fd
-
SHA256
5e5ae825b31fa0863f8a3055379306e20ac9f3c554f121f4f0c29430f79e51cf
-
SHA512
3a3b0104b0005d1a158727ca51a797255616af0365090921db58cc70ec3a4a2cadb9a7630384af4cb7a5b134a9de5217bb7499cb02d13c9c92f6124a127fd7fd
-
SSDEEP
24576:G1tYL4dVpWK5GYFHGgGfqa2B7yzzLP0DTXYWCs/tSVmzvIPUrsj2WnkIdINwByd6:G1t5GYEaaD/YTKsVSVHPfnkII96
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\top flash to video.exe"C:\Users\Admin\AppData\Local\Temp\top flash to video.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 8202⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\CF06674C-EDA6-48df-B12C-F810984ACF54.exe"C:\Users\Admin\AppData\Local\Temp\CF06674C-EDA6-48df-B12C-F810984ACF54.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1528 -ip 15281⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c5be6b4274a62a7be11d1c018235a79b
SHA1a6e81b63a198fee34498cd95c78dec73b6957bcc
SHA256551a361bbfb5e01e7de1656059736c0bc0d119d85d020f1b6c61867abc0ca778
SHA512c06d6820c5998f13be5eabb8dd32c5cf2da27168d6ade1defa934ff464e05be276728a02f30d7d803dc6d64ce5eb22a80d2769b0fd6e6517c8351e631daadfde
-
Filesize
1KB
MD5f09be87202d5817120c8fbe46ccbea5e
SHA1d6417a20302afecaff6b5076ddef06100dc4f371
SHA2564fddf2db6fed4ba8712cb85b684f438648f08d21859748eed2160f8ce2eb4ee3
SHA512aac55dd50852fe41b2b3be2c826c155643521c5be4606324e70840a4d5df983d3ec616a3e68d542a2fb9edecbe3d4659d0b7de0df30e5125d919bf3b4c9b9dc2
-
Filesize
1KB
MD5ce49ea586115b986531f671cbb38d6ff
SHA10a0ab2fc21992937f89dd3639f2624c52d88f5dd
SHA256c146e621a9efb7d5ffbe24a36ca11a0a07edcd6341a77abb49dd1f04f88ab8a2
SHA512f4c32e1a584c0ff1fd414a58e40f5af77d2b9052e823ecc1ee0c37311c48de4a5a35f6b33d2d7580c79c2260b73fd652524b6174845f615cb426a5d7d173bd76
-
Filesize
1KB
MD519dc727886e5cf77151fecc6602b18e3
SHA1db0552406905cc6fb28ad17566313ea7059c70ce
SHA2563fd58ce91525999f79267507b364338ee0d193f7ad42508b7c253b7678f32046
SHA5126e35f482f142ba2fc86297694573f8bef3adb3c8db0e69371cc76ecce24338a872a5271af0ca1efe00ee40ca1a5788b6d23b9be0cb72413c9bef705794685b65
-
Filesize
4KB
-
Filesize
3.4MB
-
Filesize
8.8MB
-
Filesize
984KB
-
Filesize
8.8MB
-
Filesize
36KB
-
Filesize
8.8MB
-
Filesize
3.4MB
-
Filesize
984KB
-
Filesize
36KB