Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2024, 02:26

General

  • Target

    9d874d03589c772615de01051953e8e6073b0e9bcc56a6f2004a49736d43c8cdN.exe

  • Size

    112KB

  • MD5

    b6f5802b6314728a56d3d930dd836420

  • SHA1

    bf922bf806d249168ff79bf76ca3ab3596adbbf3

  • SHA256

    9d874d03589c772615de01051953e8e6073b0e9bcc56a6f2004a49736d43c8cd

  • SHA512

    aa9520f7b57698f5616b5635c045ae3f3c4990218992afc54ed1f33e390e481304f6577d10538260a0760516301ac5f2e26ab08ef9a71fc7941fcbfc2c5ffe84

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d874d03589c772615de01051953e8e6073b0e9bcc56a6f2004a49736d43c8cdN.exe
    "C:\Users\Admin\AppData\Local\Temp\9d874d03589c772615de01051953e8e6073b0e9bcc56a6f2004a49736d43c8cdN.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2688
    • C:\Users\Admin\AppData\Local\Temp\9d874d03589c772615de01051953e8e6073b0e9bcc56a6f2004a49736d43c8cdN.exe
      "C:\Users\Admin\AppData\Local\Temp\9d874d03589c772615de01051953e8e6073b0e9bcc56a6f2004a49736d43c8cdN.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2804
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NPKIL.bat" "
        3⤵
          PID:1776
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f
            4⤵
              PID:2860
          • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
            3⤵
              PID:1692
              • C:\Windows\SysWOW64\svchost.exe
                "C:\Windows\system32\svchost.exe"
                4⤵
                  PID:696
                • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
                  4⤵
                    PID:2488
                  • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
                    4⤵
                      PID:604

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\NPKIL.bat

                Filesize

                148B

                MD5

                3a4614705555abb049c3298e61170b7f

                SHA1

                c8686410756f346d9551256a5b878b04770950ba

                SHA256

                cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b

                SHA512

                65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

              • \Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

                Filesize

                112KB

                MD5

                f1238d59b7c91e273c09a415e215508a

                SHA1

                bce3c51af04f32b134d109bffe05e284ba6637d9

                SHA256

                e4e1f01f3301c05d42a8c9d787ff4bb415fbf9752adcf27c685f29a29fd05f72

                SHA512

                461a94146ac9e254bc252605346e11f066ef6b3a218f9c3ad32270c4d703f9b54fc8f977b1cdb3e8823f96f91cc2de15d3ce2b44449c327af7a4304bae736b47

              • memory/604-290-0x0000000000400000-0x0000000000414000-memory.dmp

                Filesize

                80KB

              • memory/604-282-0x0000000000400000-0x0000000000414000-memory.dmp

                Filesize

                80KB

              • memory/956-49-0x0000000000510000-0x0000000000512000-memory.dmp

                Filesize

                8KB

              • memory/956-20-0x00000000002A0000-0x00000000002A1000-memory.dmp

                Filesize

                4KB

              • memory/956-32-0x00000000004A0000-0x00000000004A1000-memory.dmp

                Filesize

                4KB

              • memory/956-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

                Filesize

                4KB

              • memory/956-48-0x00000000004C0000-0x00000000004C2000-memory.dmp

                Filesize

                8KB

              • memory/956-38-0x00000000004C0000-0x00000000004C2000-memory.dmp

                Filesize

                8KB

              • memory/956-80-0x0000000000570000-0x0000000000571000-memory.dmp

                Filesize

                4KB

              • memory/956-88-0x0000000002470000-0x0000000002472000-memory.dmp

                Filesize

                8KB

              • memory/956-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

                Filesize

                4KB

              • memory/956-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

                Filesize

                4KB

              • memory/956-28-0x00000000003E0000-0x00000000003E1000-memory.dmp

                Filesize

                4KB

              • memory/956-14-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

              • memory/2488-289-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2688-97-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2688-95-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2688-93-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2688-91-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2688-126-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2688-99-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

              • memory/2688-286-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2688-89-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2688-106-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2804-125-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2804-285-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB