Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09/12/2024, 03:59

General

  • Target

    e2634807e9b9fccdafe9f16df27a6c4a369a34aed71087c251ee163cf139bd96.exe

  • Size

    1.1MB

  • MD5

    d4efdf88092c56fce0c9234f7643fe00

  • SHA1

    b07aca8a004b9881bcff391b641bef44b0abd078

  • SHA256

    e2634807e9b9fccdafe9f16df27a6c4a369a34aed71087c251ee163cf139bd96

  • SHA512

    8888211c489e16f4f72f5b873fd67a6ff7231ce3a1c5b293067d11a9139707aec1f4d8ef2ba0b31dd68f5610244bb37cb22e180a0a859dccfe16e58b323dcf1a

  • SSDEEP

    24576:ypSSRhZFvsEBFumx8eDmCfPVLHhz3eAD4pbSHw/cDKgM3Ty+Kk:ypSS7AEBF8eDPNHNxMbSHw/eKgST1Z

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader First Stage 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2634807e9b9fccdafe9f16df27a6c4a369a34aed71087c251ee163cf139bd96.exe
    "C:\Users\Admin\AppData\Local\Temp\e2634807e9b9fccdafe9f16df27a6c4a369a34aed71087c251ee163cf139bd96.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Users\Admin\AppData\Local\Temp\INSAEE5.tmp
      C:\Users\Admin\AppData\Local\Temp\INSAEE5.tmp /SL3 $5014E C:\Users\Admin\AppData\Local\Temp\e2634807e9b9fccdafe9f16df27a6c4a369a34aed71087c251ee163cf139bd96.exe 1070831 1074277 65536
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\xSharez Scanner 3\unins000.exe

    Filesize

    73KB

    MD5

    8c0e2b408af6dc79c4e0252988097e14

    SHA1

    a0973fb6985d3c959448ba4ec3476339f30eb97b

    SHA256

    06e98db809d9d7785ced0d149d20a3c8fa943371446439e3c1d18983cb885249

    SHA512

    d05e7fc17da4eed2138802b5f93fbcd64040a26da96219269c49399dcf955dbac9d909eac6888c0942873744e72548efbe94bf2893ec7c45fb664347c44435ae

  • \Program Files (x86)\xSharez Scanner 3\unins000.exe

    Filesize

    64KB

    MD5

    4aa2479ed0c28e1941a3160ff5eacba1

    SHA1

    302067290cd0873a38dec6986fe609b149c77ca4

    SHA256

    4b34c348e526408d33bc4a47cec8c8bc0fe6698bef86089654b8ea77c9e7d39c

    SHA512

    b280d024e9a87e9451f4d14bdbad6a82c44dfbde983d9dd1953ee898aba1a404730393bb4efcecd8279458130dbb524f76e609c28b8319265fa867dab33d5881

  • \Program Files (x86)\xSharez Scanner 3\xSharez_d.exe

    Filesize

    1.5MB

    MD5

    b802e159ed7deffb96eff2c62f711a40

    SHA1

    9e47fea853dd8c6346fc77d34952b6d57d71aace

    SHA256

    87cb8763dc50a6c84430bb259280b86bb63725ae90354b7253363a71fe164fea

    SHA512

    e8aa81769c0fd2f287f41fec2240ed637860ad99130c4c0c5d26eb41cc126520312fe6eb8a0bcb118bed7c7aaff93ea5a43597e4125f49e8cfda313cd4ac1bb6

  • \Users\Admin\AppData\Local\Temp\INSAEE5.tmp

    Filesize

    481KB

    MD5

    8a9dd2367a2ea516265e256259d3ddbd

    SHA1

    f28f99914149bbb2cba8747bc67a06b36ac96d15

    SHA256

    af7200ba3f315a97fbbb2a61c24c6069fbac22e9a4014b8e92b19344a8bef989

    SHA512

    6f4cfb824a473826e1b1ac448820a81559479eba6ddbc535b8a7aa393f98053549c24716c9aec8e105f68fc4d32d489a878539ed4b5668ee06a29289b3a7fca8

  • \Users\Admin\AppData\Local\Temp\is-GVGUJ.tmp\_isbunzp.dll

    Filesize

    32KB

    MD5

    59a7e0fa5404db5e9f1f18e2a2f69797

    SHA1

    43045d5102ad7e552e0c674dcddbd6f3e207fb62

    SHA256

    5bcc823ba75c9bf6a8e01101eb5cee690fd3dcb2d635432ad4e26bf76024954c

    SHA512

    296671e7082dbde345f5a92af947c56ac5c73eefe9c47606347ac55a54864675e038d70ed4efc01623fd9780eaa2d49dad68474e294704bcccc8333e3a0a41f2

  • \Users\Admin\AppData\Local\Temp\is-GVGUJ.tmp\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/2404-19-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2404-17-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2404-15-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2404-65-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2404-68-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2568-14-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2568-69-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB