Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/01/2025, 16:41

General

  • Target

    f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727.exe

  • Size

    112KB

  • MD5

    f7d1f12676113c34b6f3395963fbbc83

  • SHA1

    afcd81150405f397e3741196d40c7f7dab8a424e

  • SHA256

    f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727

  • SHA512

    38c0f95952527dbf3310a4916b78cb9a2c7581879260440845c60031052d2eddf34715c2ae9a7253b8645a2e6192efd01c07d5dd3c4748bdd3ecf15f09fc6f0c

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJz:tVIr7zI+fAceoGxSKKo5z

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727.exe
    "C:\Users\Admin\AppData\Local\Temp\f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2560
    • C:\Users\Admin\AppData\Local\Temp\f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727.exe
      "C:\Users\Admin\AppData\Local\Temp\f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2196
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NBCXT.bat" "
        3⤵
          PID:2852
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f
            4⤵
              PID:2884
          • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
            3⤵
              PID:1612
              • C:\Windows\SysWOW64\svchost.exe
                "C:\Windows\system32\svchost.exe"
                4⤵
                  PID:1624
                • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
                  4⤵
                    PID:1908
                  • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
                    4⤵
                      PID:2244

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\NBCXT.bat

                Filesize

                148B

                MD5

                3a4614705555abb049c3298e61170b7f

                SHA1

                c8686410756f346d9551256a5b878b04770950ba

                SHA256

                cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b

                SHA512

                65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

              • \Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

                Filesize

                112KB

                MD5

                509e774760eb06658fe93fc35b541ed6

                SHA1

                2ae89e74456d3f666677af4e28e4801f51a25988

                SHA256

                5c7d25f5fd350301543f060998be0a972338d1a674bf9897875846763c911293

                SHA512

                193212fbda54f73de7dce47906d52c1cf714fe52d651693ed5ba2b706cade2d5ef22984a8e0fe94b44022ed298b6d1d04266eedb5c1c4a678b09c7ca16e4d1b8

              • memory/1908-292-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/1908-281-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2196-129-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2196-289-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2196-125-0x0000000000400000-0x000000000040B000-memory.dmp

                Filesize

                44KB

              • memory/2244-286-0x0000000000400000-0x0000000000414000-memory.dmp

                Filesize

                80KB

              • memory/2324-51-0x00000000003F0000-0x00000000003F2000-memory.dmp

                Filesize

                8KB

              • memory/2324-4-0x0000000000230000-0x0000000000231000-memory.dmp

                Filesize

                4KB

              • memory/2324-56-0x0000000001C40000-0x0000000001C42000-memory.dmp

                Filesize

                8KB

              • memory/2324-81-0x0000000001C90000-0x0000000001C91000-memory.dmp

                Filesize

                4KB

              • memory/2324-90-0x0000000001CB0000-0x0000000001CB2000-memory.dmp

                Filesize

                8KB

              • memory/2324-89-0x0000000001C80000-0x0000000001C82000-memory.dmp

                Filesize

                8KB

              • memory/2324-50-0x00000000003E0000-0x00000000003E2000-memory.dmp

                Filesize

                8KB

              • memory/2324-32-0x00000000003C0000-0x00000000003C1000-memory.dmp

                Filesize

                4KB

              • memory/2324-8-0x0000000000250000-0x0000000000251000-memory.dmp

                Filesize

                4KB

              • memory/2324-14-0x0000000000270000-0x0000000000271000-memory.dmp

                Filesize

                4KB

              • memory/2324-2-0x0000000000230000-0x0000000000231000-memory.dmp

                Filesize

                4KB

              • memory/2324-20-0x00000000002E0000-0x00000000002E1000-memory.dmp

                Filesize

                4KB

              • memory/2324-38-0x00000000003E0000-0x00000000003E2000-memory.dmp

                Filesize

                8KB

              • memory/2324-28-0x0000000000320000-0x0000000000321000-memory.dmp

                Filesize

                4KB

              • memory/2560-91-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2560-95-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2560-93-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2560-99-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2560-126-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2560-101-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

              • memory/2560-103-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2560-290-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2560-291-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/2560-97-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB