Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    110s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2025, 16:41

General

  • Target

    f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727.exe

  • Size

    112KB

  • MD5

    f7d1f12676113c34b6f3395963fbbc83

  • SHA1

    afcd81150405f397e3741196d40c7f7dab8a424e

  • SHA256

    f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727

  • SHA512

    38c0f95952527dbf3310a4916b78cb9a2c7581879260440845c60031052d2eddf34715c2ae9a7253b8645a2e6192efd01c07d5dd3c4748bdd3ecf15f09fc6f0c

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJz:tVIr7zI+fAceoGxSKKo5z

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727.exe
    "C:\Users\Admin\AppData\Local\Temp\f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4216
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
        PID:1000
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 84
          3⤵
          • Program crash
          PID:4060
      • C:\Users\Admin\AppData\Local\Temp\f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727.exe
        "C:\Users\Admin\AppData\Local\Temp\f34564b0b5d6bedeb034173a5051d9702d05fc75ca73afe10e7e017669834727.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3124
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QHGRO.bat" "
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1484
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f
            4⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:1596
        • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2972
          • C:\Windows\SysWOW64\svchost.exe
            "C:\Windows\system32\svchost.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:2668
          • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2952
          • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1000 -ip 1000
      1⤵
        PID:2072

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\QHGRO.txt

        Filesize

        148B

        MD5

        3a4614705555abb049c3298e61170b7f

        SHA1

        c8686410756f346d9551256a5b878b04770950ba

        SHA256

        cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b

        SHA512

        65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

      • C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe

        Filesize

        112KB

        MD5

        44c9e5e2907c5b48bc21b2345537e6e7

        SHA1

        e79b1bb136ebc3a87e6dcfe5f588205085d2686b

        SHA256

        f4117cff95f191f3d2e5483bc03d1af7034b07ce9c2134e6c252bca4158797ab

        SHA512

        ceb7324cca2b49233d9150314beedb501558dd1bf2efac360e177b05723e29da1c3bf63ad9c1750a710b7bfb6071a2bc718cff1a14809a5a315b9491b3bd119d

      • memory/2668-69-0x0000000000400000-0x000000000040C000-memory.dmp

        Filesize

        48KB

      • memory/2668-52-0x0000000000400000-0x000000000040C000-memory.dmp

        Filesize

        48KB

      • memory/2668-47-0x0000000000400000-0x000000000040C000-memory.dmp

        Filesize

        48KB

      • memory/2668-44-0x0000000000400000-0x000000000040C000-memory.dmp

        Filesize

        48KB

      • memory/2952-68-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/2972-39-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

      • memory/2972-65-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

      • memory/2972-43-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

      • memory/2972-41-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

      • memory/2972-40-0x0000000000400000-0x000000000041F000-memory.dmp

        Filesize

        124KB

      • memory/3124-11-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/3124-12-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/3124-42-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/3124-13-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/3124-66-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/3124-8-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/3448-59-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3448-70-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3448-55-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3448-60-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3448-62-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3448-61-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/4216-7-0x0000000002D20000-0x0000000002D22000-memory.dmp

        Filesize

        8KB

      • memory/4216-5-0x0000000002CB0000-0x0000000002CB2000-memory.dmp

        Filesize

        8KB

      • memory/4216-9-0x0000000002C00000-0x0000000002C02000-memory.dmp

        Filesize

        8KB

      • memory/4216-4-0x0000000002C50000-0x0000000002C52000-memory.dmp

        Filesize

        8KB

      • memory/4216-2-0x0000000002C00000-0x0000000002C02000-memory.dmp

        Filesize

        8KB

      • memory/4216-3-0x0000000002C20000-0x0000000002C22000-memory.dmp

        Filesize

        8KB