Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
21/08/2024, 19:30
240821-x76q3sweqg 1021/08/2024, 17:42
240821-v92h2avgpj 1012/06/2024, 16:01
240612-tgps4a1bqh 10Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
21/08/2024, 19:30
General
-
Target
4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exe
-
Size
29KB
-
MD5
0d14590170f35263c0e3f0e0e1594720
-
SHA1
21414e31724eb95408a4031a0c0508b2a12260e7
-
SHA256
4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08
-
SHA512
76e6fbd04c08b749b46ce1499e15ad58d7bb8d0c20db0a0fae54001f973aaa73e961cf80558c090d31d7f69918562c519c01c2cb441548feca63cea37792aa3c
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/V:AEwVs+0jNDY1qi/qt
Malware Config
Signatures
-
Detects MyDoom family 11 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exe"C:\Users\Admin\AppData\Local\Temp\4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5bd4430f9d6b9aa69dae8f263042dd68a
SHA16de668bf1c5856fc37dfbbe60c02d3f77cdaa6e4
SHA25690cc2c1e5d437376e20a79e742751ed0a3f4ddca643386340bf9e820cf90edfe
SHA512d4499997167fd8c4ea6ad29da93212677276c8140c2f0fc3d520517e4a02311a45ba3f8c8fbd2e1635b8413af3b510d7d812757aaba0eaa491342c9f6712064b
-
Filesize
320B
MD586ee7017b3615a14811e5b9aa884caba
SHA162ddefc03f7d2e2f5895dc862e6f23def21ab01b
SHA256b3e33246c9c4684bc24516f93e4277caa113d8d4547add8241e33aea43e72e98
SHA512e47a5b52caede7ebb9d616af1d6b335307bc221d81aaf5c3d91d76b8811cc56b4f8b8d2d3fd514608cca062c63e130b9fb023f3d3a3fb005cf40135f1bbbc959
-
Filesize
320B
MD5abe4bfebf8e386dc90ce23682ae4060a
SHA18d7f291c1f46cac34f2e47dd388dacdeed90e6f4
SHA25688d5346c2361e8e7814901008f83624e46e7ef4c1b6ff785174dda8e7436c140
SHA512b7a109d571d0c3b7ce5219cb1cdc3cb54ca71afb3c87236426cd43a769fd9b396221ffaa22eb2c9fa78e3c0fa808ba7c05ed4467315ccefd191d788288ad54de
-
Filesize
320B
MD5a42ba4dffc228681d67b47d858cb0b53
SHA1be112ac09cef4da7d1b43f054599e8cd206187b1
SHA256c0a7be006493d7320dadbace18f50de9e6db161ac650092b853f50a3509792ce
SHA512e14d96c3bea4c5fada18de67bd83abb7b49a9914c956ba48afd8ba542773d7d60df6106b45f35e6966396bb2c4b98532e3e70a8ca35f78ceb46757593c76f97f
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB