Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2025, 04:18 UTC

General

  • Target

    8f45f8be860052d275855c87e90c576adb32c197e1154e1abd061b3ba7d75cd8.exe

  • Size

    130KB

  • MD5

    ac061b70f93d1a501b40c2b3510e91ce

  • SHA1

    5b9cd55e2eeb7646d0038a59b947a82f64ac5380

  • SHA256

    8f45f8be860052d275855c87e90c576adb32c197e1154e1abd061b3ba7d75cd8

  • SHA512

    536e7edeb04c57bd401a9869a925db36be4315acde8fd449668c170f23d1f0bdeba08ead82618cfbef4b21a02ca04ce75938490294a72eb34d58af980762c528

  • SSDEEP

    1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZ5:SKQJcinxphkG5Q6GdpIOkJHhKRyOXKX

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f45f8be860052d275855c87e90c576adb32c197e1154e1abd061b3ba7d75cd8.exe
    "C:\Users\Admin\AppData\Local\Temp\8f45f8be860052d275855c87e90c576adb32c197e1154e1abd061b3ba7d75cd8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Users\Admin\AppData\Local\Temp\8f45f8be860052d275855c87e90c576adb32c197e1154e1abd061b3ba7d75cd8.exe
      "C:\Users\Admin\AppData\Local\Temp\8f45f8be860052d275855c87e90c576adb32c197e1154e1abd061b3ba7d75cd8.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3648
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MJJVR.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2316
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:1796
      • C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
        "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
          "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1156
        • C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
          "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2780

Network

  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
  • flag-us
    DNS
    justgonnatry.hopto.org
    Flaseher.exe
    Remote address:
    8.8.8.8:53
    Request
    justgonnatry.hopto.org
    IN A
    Response
No results found
  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
    160 B
    1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    14.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    14.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

  • 8.8.8.8:53
    justgonnatry.hopto.org
    dns
    Flaseher.exe
    68 B
    128 B
    1
    1

    DNS Request

    justgonnatry.hopto.org

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MJJVR.txt

    Filesize

    145B

    MD5

    da0cbe87b720a79b294147ed6a4b98be

    SHA1

    ebf0dc9efd7a12cb192e355cda87546acb4ab360

    SHA256

    7ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed

    SHA512

    f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc

  • C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe

    Filesize

    130KB

    MD5

    af0c79be91c88aee8083ec56d137f1f0

    SHA1

    e26b929901448a784c370b3897c019e3f1894c5f

    SHA256

    1f66911127f0d43ad62c6a0422b28b5e016dc1864b183f292e813d9605094a98

    SHA512

    c88fe937719afeb8cc72806c5e62ed3169604034c5f0ee7ea8770a1727542b04672603728d82ad406e5c87620d54eec8820b30e44f398e2e0601a8ecc5783293

  • memory/1156-65-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2156-60-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2156-46-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2156-45-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2156-43-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2156-39-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/2780-56-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/2780-53-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/2780-67-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/2780-59-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/2780-61-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/2780-49-0x0000000000400000-0x0000000000411000-memory.dmp

    Filesize

    68KB

  • memory/3648-13-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3648-15-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3648-10-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3648-64-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3648-44-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4508-9-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

    Filesize

    4KB

  • memory/4508-5-0x0000000002C30000-0x0000000002C31000-memory.dmp

    Filesize

    4KB

  • memory/4508-0-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/4508-7-0x0000000002C90000-0x0000000002C91000-memory.dmp

    Filesize

    4KB

  • memory/4508-4-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

    Filesize

    4KB

  • memory/4508-6-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

  • memory/4508-8-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

    Filesize

    4KB

  • memory/4508-11-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

  • memory/4508-3-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

    Filesize

    4KB

  • memory/4508-17-0x0000000000400000-0x0000000000423000-memory.dmp

    Filesize

    140KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.