Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    08/12/2024, 23:14

General

  • Target

    5ea3b707b13ec9e17bdc954d1379f577e5b7aa78da14c7a6fd907a0b2b56c844.exe

  • Size

    705KB

  • MD5

    d4d7a0da419032e44874ffce2419b4f1

  • SHA1

    f9b2dbc2c4c70fa468ad44ce491d87633d94ecba

  • SHA256

    5ea3b707b13ec9e17bdc954d1379f577e5b7aa78da14c7a6fd907a0b2b56c844

  • SHA512

    2bd488676b925e08283dc1a624994d09e377421b3cad538b05ceb26714256bde2fcecfc12a0ad44cc71a6f6d225443f235cd94489ba59e3ecd2d2a3fb381d5cb

  • SSDEEP

    12288:O66k9uL+KUnVk2W5wwyPImzQ/+afpnRyY9jjU81wePXy1b6O4q7VRTp0nVnXG:hW+NR0wwuFQZfpcYRz17XWw2rp+X

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 21 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ea3b707b13ec9e17bdc954d1379f577e5b7aa78da14c7a6fd907a0b2b56c844.exe
    "C:\Users\Admin\AppData\Local\Temp\5ea3b707b13ec9e17bdc954d1379f577e5b7aa78da14c7a6fd907a0b2b56c844.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\Windows\mstwain32.exe
      "C:\Windows\mstwain32.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mstwain32.exe

    Filesize

    705KB

    MD5

    d4d7a0da419032e44874ffce2419b4f1

    SHA1

    f9b2dbc2c4c70fa468ad44ce491d87633d94ecba

    SHA256

    5ea3b707b13ec9e17bdc954d1379f577e5b7aa78da14c7a6fd907a0b2b56c844

    SHA512

    2bd488676b925e08283dc1a624994d09e377421b3cad538b05ceb26714256bde2fcecfc12a0ad44cc71a6f6d225443f235cd94489ba59e3ecd2d2a3fb381d5cb

  • \??\c:\users\admin\appdata\local\temp\00000000

    Filesize

    14B

    MD5

    1fa3c8597db4fd8d631b820eb2a64006

    SHA1

    e264bedeb5fe6ba01e749e7f5b104bf2999fad72

    SHA256

    5e79c301656be6dda9f3712cf92f877ea97525a2a7348ee38b15386c2b0918e1

    SHA512

    c0ed0c6d8a5363ad55800378f8381658f2b97fd1baf449f0d1033d3cc96c323ff8405d21eb8ef81f44a37cec07aaca9b56a55eea3f8d144bc8d65a31f8ad99f1

  • memory/2624-29-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-33-0x0000000002A90000-0x0000000002A9E000-memory.dmp

    Filesize

    56KB

  • memory/2624-71-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-68-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-15-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-65-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-19-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-18-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-62-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-23-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/2624-24-0x0000000002A90000-0x0000000002A9E000-memory.dmp

    Filesize

    56KB

  • memory/2624-27-0x00000000773F0000-0x00000000774E0000-memory.dmp

    Filesize

    960KB

  • memory/2624-26-0x0000000077400000-0x0000000077401000-memory.dmp

    Filesize

    4KB

  • memory/2624-28-0x00000000773F0000-0x00000000774E0000-memory.dmp

    Filesize

    960KB

  • memory/2624-59-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-30-0x00000000773F0000-0x00000000774E0000-memory.dmp

    Filesize

    960KB

  • memory/2624-56-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-31-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-32-0x00000000002F0000-0x00000000002F8000-memory.dmp

    Filesize

    32KB

  • memory/2624-34-0x00000000773F0000-0x00000000774E0000-memory.dmp

    Filesize

    960KB

  • memory/2624-35-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-38-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-41-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-44-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-47-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-50-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2624-53-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2628-6-0x00000000027F0000-0x0000000002800000-memory.dmp

    Filesize

    64KB

  • memory/2628-0-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2628-3-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2628-13-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB

  • memory/2628-14-0x0000000003630000-0x00000000039BD000-memory.dmp

    Filesize

    3.6MB

  • memory/2628-2-0x0000000000400000-0x000000000078D000-memory.dmp

    Filesize

    3.6MB