Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2025, 12:21
Behavioral task
behavioral1
Sample
ENQ-0092025.doc
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ENQ-0092025.doc
Resource
win10v2004-20241007-en
General
-
Target
ENQ-0092025.doc
-
Size
143KB
-
MD5
3db6baf168cecc916012a59b6530175a
-
SHA1
7d74c680b09f982271a50483ce350a5b3d9a0996
-
SHA256
96882b077a607f34cd963461341d728982e2075ffd4891f1b91e915da904cfe0
-
SHA512
5a4b22f622559b8db815b1dc8cfa206eb433e55541de7d2540bd786703a0a418d03d1b657bcbdf9ceff74c863a1c7e4d324e3a555fd66d0905034ccdf5d677c5
-
SSDEEP
1536:F7dgmjjy2lQkySTUb2roegTK+g9WomfaQjSqttJnkL5mS9kBwNR42qe3/w:FZPjbTU+J799IjSqtteL5N9kBF27
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 54 IoCs
resource yara_rule behavioral2/memory/3304-49-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-63-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-77-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-97-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-100-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-115-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-114-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-112-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-111-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-110-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-109-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-108-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-107-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-105-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-104-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-103-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-101-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-99-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-98-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-96-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-95-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-94-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-87-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-86-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-85-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-84-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-83-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-113-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-82-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-106-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-78-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-102-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-75-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-74-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-93-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-92-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-90-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-73-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-89-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-88-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-72-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-71-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-70-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-81-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-80-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-69-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-79-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-68-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-76-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-66-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-67-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-64-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-65-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 behavioral2/memory/3304-62-0x00000000028F0000-0x00000000038F0000-memory.dmp modiloader_stage2 -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 3304 brightness.exe 1700 jphwmyiA.pif -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aiymwhpj = "C:\\Users\\Public\\Aiymwhpj.url" brightness.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3304 set thread context of 1700 3304 brightness.exe 105 -
Program crash 1 IoCs
pid pid_target Process procid_target 4784 1700 WerFault.exe 105 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brightness.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 41 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3424 WINWORD.EXE 3424 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3424 WINWORD.EXE 3424 WINWORD.EXE 3424 WINWORD.EXE 3424 WINWORD.EXE 3424 WINWORD.EXE 3424 WINWORD.EXE 3424 WINWORD.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3424 wrote to memory of 3304 3424 WINWORD.EXE 93 PID 3424 wrote to memory of 3304 3424 WINWORD.EXE 93 PID 3424 wrote to memory of 3304 3424 WINWORD.EXE 93 PID 3304 wrote to memory of 1436 3304 brightness.exe 101 PID 3304 wrote to memory of 1436 3304 brightness.exe 101 PID 3304 wrote to memory of 1436 3304 brightness.exe 101 PID 3304 wrote to memory of 1700 3304 brightness.exe 105 PID 3304 wrote to memory of 1700 3304 brightness.exe 105 PID 3304 wrote to memory of 1700 3304 brightness.exe 105 PID 3304 wrote to memory of 1700 3304 brightness.exe 105 PID 3304 wrote to memory of 1700 3304 brightness.exe 105
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ENQ-0092025.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\brightness.exeC:\Users\Admin\AppData\Local\Temp\brightness.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd3⤵
- System Location Discovery: System Language Discovery
PID:1436
-
-
C:\Users\Public\Libraries\jphwmyiA.pifC:\Users\Public\Libraries\jphwmyiA.pif3⤵
- Executes dropped EXE
PID:1700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 124⤵
- Program crash
PID:4784
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1700 -ip 17001⤵PID:3112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
1.1MB
MD5483ab6bd562b28782d0999abec4f57f5
SHA1b758556af2b98708b97a6c3bdbd1e9f2905ed690
SHA256e5393c34240b7e1b8a35052d7e151c324a4aa6424b5a6e1a45717157042fb9ab
SHA5126f3f60153b3c4b1a780c80d59a4e17d8c109f57a1380f73b50498ac85a081b804d0f7c0ffade4ac193656b3135dedddcd607121d9571b4c3baf34103e36d129d
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize680B
MD5eb731e2826acc90c0c16ac96bf77545d
SHA1a340e7891319d2026b7091a0e6f74665d3463469
SHA25620a3e148f94ed7eb3b0d330917120072a6008ee3127fa3e1a6dfbb47cb08ad11
SHA512c14ddf9e65e3ca524ecda249553446a35c2ec2045665e3c0b73df5831b1d35ca2b16ad1285a4b6ecd167eff4bd4b05901ea3dae85a681e152d5b7c75a67eb965
-
Filesize
8KB
MD560cd0be570decd49e4798554639a05ae
SHA1bd7bed69d9ab9a20b5263d74921c453f38477bcb
SHA256ca6a6c849496453990beceef8c192d90908c0c615fa0a1d01bcd464bad6966a5
SHA512ab3dbdb4ed95a0cb4072b23dd241149f48ecff8a69f16d81648e825d9d81a55954e5dd9bc46d3d7408421df30c901b9ad1385d1e70793fa8d715c86c9e800c57
-
Filesize
171KB
MD522331abcc9472cc9dc6f37faf333aa2c
SHA12a001c30ba79a19ceaf6a09c3567c70311760aa4
SHA256bdfa725ec2a2c8ea5861d9b4c2f608e631a183fca7916c1e07a28b656cc8ec0c
SHA512c7f5baad732424b975a426867d3d8b5424aa830aa172ed0ff0ef630070bf2b4213750e123a36d8c5a741e22d3999ca1d7e77c62d4b77d6295b20a38114b7843c